2026.10.15-3

Cherry-pick Release on top of 2026.15.01-2 with:

• b2957b6

Full Changelog: 2026.10.15-2...2026.10.15-3

2026.10.15-2

Cherry-pick Release on top of 2026.15.01-1 with:

• c6745bc
• 1b6f2ed

Full Changelog: 2026.10.15-1...2026.10.15-2

2026.10.15-1

This release's push hero is @diox

Cherry-pick Release on top of 2026.15.01 with:

• 5925e17

Full Changelog: 2026.10.15...2026.10.15-1

2026.10.15

This week's push hero is @chrstinalin

Previous Release: 2026.10.01-1

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

Addons-Frontend Changelog:

https://github.com/mozilla/addons-frontend/releases/tag/2026.10.15

Addons Server Changelog:

What's Changed

Notable things shipping

• feat: pinguino devhub landing page by @nothingrandom in #25488
• Handle scanner tasks created before we changed the wait_for_scanner_results() signature by @willdurand in #25535
• Developer Agreement API is_submission_allowed() check should not check dev agreement by @chrstinalin in #25529
• Check that client-supplied image content type is consistent with the actual image by @diox in #25549
• feat: pinguino devhub testing framework by @nothingrandom in #25536
• Reprompt admins for MFA if they make a POST request by @diox in #25542
• Bump yara-x version to 2026.10.05 by @willdurand in #25560
• Implement Devhub Agreement by @chrstinalin in #25537
• Remove mock data from Pinguino by @chrstinalin in #25579
• fix: pinguino home activity log implementation by @nothingrandom in #25558
• Upgrade django from 5.2.17 to 5.2.18 by @eviljeff in #25587
• Add a new on_listing_changed scanner webhook event by @willdurand in #25578
• Expose all users, including unlisted ones to scanners by @willdurand in #25567
• Add a command to sync a list of active accounts to FxA bigquery by @eviljeff in #25588
• Auto-create scanner rules reported by webhooks by @willdurand in #25561
• fix: do not localise the header name Authorization by @rvedotrc in #25589
• Hide irrelevant fields and reorder scanner rule admin forms by @willdurand in #25562
• Add the on_version_scanned scanner webhook event by @willdurand in #25514
• Additional confusable characters by @diox in #25590
• Hide description field for "webhook" scanner rules when empty by @willdurand in #25609

Dependendabots

• Bump jsdom from 30.0.1 to 30.1.1 by @dependabot[bot] in #25517
• Bump ipython from 9.15.0 to 9.17.1 by @dependabot[bot] in #25401
• Bump brace-expansion by @dependabot[bot] in #25522
• Bump fast-uri from 3.1.7 to 3.1.8 by @dependabot[bot] in #25523
• Bump prettier from 3.9.8 to 3.9.9 by @dependabot[bot] in #25524
• Bump nginx from 1.31.5 to 1.31.6 by @dependabot[bot] in #25518
• Bump sentry-sdk from 2.69.2 to 2.70.0 by @dependabot[bot] in #25521
• Bump mysql from 8.4.11 to 8.4.11 by @dependabot[bot] in #25519
• Bump vitest from 5.0.1 to 5.0.2 by @dependabot[bot] in #25538
• Bump knip from 6.37.0 to 6.38.0 by @dependabot[bot] in #25525
• Bump networkx from 3.6.1 to 3.7 by @dependabot[bot] in #25520
• Bump ruff from 0.16.8 to 0.16.9 by @dependabot[bot] in #25541
• Bump vite from 8.3.0 to 8.3.1 by @dependabot[bot] in #25539
• Bump wcwidth from 0.8.4 to 0.9.1 by @dependabot[bot] in #25531
• Bump probe-image-size from 7.3.0 to 7.4.0 by @dependabot[bot] in #25548
• Bump the google group across 1 directory with 5 updates by @dependabot[bot] in #25540
• Bump elasticsearch from 8.19.21 to 8.19.22 by @dependabot[bot] in #25534
• Bump dotenv from 18.0.2 to 18.0.4 by @dependabot[bot] in #25543
• Bump source-map-js from 1.2.1 to 1.2.2 by @dependabot[bot] in #25550
• Bump pyjwt from 2.14.0 to 2.15.0 in /requirements by @dependabot[bot] in #25528
• Bump source-map-js from 1.2.1 to 1.2.2 in /src/pinguino/devhub by @dependabot[bot] in #25551
• Bump smol-toml from 1.8.0 to 1.9.0 by @dependabot[bot] in #25552
• Bump justhtml from 3.11.2 to 3.12.0 by @dependabot[bot] in #25547
• Bump deprecated from 1.3.1 to 3.0.0 by @dependabot[bot] in #25546
• Bump shell-quote from 1.10.0 to 1.12.0 by @dependabot[bot] in #25557
• Bump mozilla/addons-frontend from 2026.09.17 to 2026.10.01 by @dependabot[bot] in #25564
• Bump charset-normalizer from 3.5.1 to 3.5.2 by @dependabot[bot] in #25563
• Bump vitest from 5.0.2 to 5.0.3 by @dependabot[bot] in #25569
• Bump the google group across 1 directory with 7 updates by @dependabot[bot] in #25566
• Bump addons-linter from 10.13.0 to 10.14.0 by @dependabot[bot] in #25581
• Bump regex from 2026.9.10 to 2026.9.29 by @dependabot[bot] in #25554
• Bump pyjwt from 2.15.0 to 2.15.1 by @dependabot[bot] in #25556
• Bump stylelint from 17.15.0 to 17.16.0 by @dependabot[bot] in #25571
• Bump ruff from 0.16.9 to 0.16.10 by @dependabot[bot] in #25583
• Bump justhtml from 3.12.0 to 3.13.0 by @dependabot[bot] in #25575
• Bump sentry-sdk from 2.70.0 to 2.71.0 by @dependabot[bot] in #25555
• Bump knip from 6.38.0 to 6.39.0 by @dependabot[bot] in #25568
• Bump cryptography from 50.0.1 to 50.0.2 by @dependabot[bot] in #25576
• Bump nginx from 1.31.6 to 1.31.6 by @dependabot[bot] in #25598
• Bump seroval and solid-js in /src/pinguino/devhub by @dependabot[bot] in #25580
• Bump dotenv from 18.0.4 to 18.0.5 by @dependabot[bot] in #25573
• Bump jsdom from 30.1.1 to 30.1.2 by @dependabot[bot] in #25597

New Contributors

• @rvedotrc made their first contribution in #25589

Full Changelog: 2026.10.01...2026.10.15

2026.10.01-1

This release's push hero is @diox

Cherry-pick Release on top of 2026.10.01 with:

• 1e4fe31

Full Changelog: 2026.10.01...2026.10.01-1

2026.10.01

This week's push hero is @diox

Previous Release: 2026.09.17

Addons Server Changelog:

What's Changed

Notable things shipping

• Store auth_at when authenticating through fake FxA by @diox in #25439
• Add Activity Feed API by @chrstinalin in #25414
• Record force-disable decision when disabling an add-on as part of a block by @diox in #25438
• Retry scanner webhook deliveries instead of a fixed grace period by @willdurand in #25377
• Add management command to re-run scanners on versions stuck by @willdurand in #25435
• urls should always reverse to /firefox/, regardless of UA or ?app= param by @eviljeff in #25463
• fix more ruff rule exclusions; ignore BLE001 intentionally by @eviljeff in #25462
• feat: pinguino foundation by @nothingrandom in #25424
• Version Filtering only Applies to List by @chrstinalin in #25454
• Call all scanners in call_webhooks() by @willdurand in #25464
• Add Developer Agreement API by @chrstinalin in #25418
• Log request id when calling the webhook scanners by @willdurand in #25469
• Add CODEOWNERS file by @diox in #25468
• drop apps from sitemap - only generate /firefox/ urls by @eviljeff in #25470
• enable Persian (fa) locale for stage/prod by @eviljeff in #25477
• Remove old CODEOWNERS file in .github/ by @diox in #25479
• Reduce session expiry time: 14 days normal users, 1 day privileged users by @diox in #25485
• Fix intermittent test failure by @willdurand in #25487
• Change restriction type for DISABLE_AND_BLOCK by @chrstinalin in #25449
• Pin our own mozilla/addons actions to a specific tag by @diox in #25480
• Show link to the service account sheet on ScannerWebhook creation by @eviljeff in #25453
• Print file/version/upload PKs in the logs when creating a new file by @willdurand in #25478
• Extract is_waiting_on_scanner_webhook_events() by @willdurand in #25489
• docs: add some things worth knowing about the scanner pipeline by @willdurand in #25502
• Pass the events to wait for to wait_for_scanner_results by @willdurand in #25490
• Hold restrictions set by scanners for disable&block until the decision is executed by @diox in #25496
• docs: proofread the scanner pipeline page by @willdurand in #25505
• Remove unused run_scanner() function by @willdurand in #25503
• Remove the use-yara-x waffle switch and old yara by @willdurand in #25504
• Truncate descriptions from XPI using summary max-length when scanning with NARC by @diox in #25506

Dependendabots

• Bump addons-linter from 10.12.0 to 10.13.0 by @dependabot[bot] in #25458
• Bump mozilla/addons-frontend from 2026.09.03 to 2026.09.17 by @dependabot[bot] in #25447
• Bump pytest-env from 1.7.0 to 1.7.1 by @dependabot[bot] in #25445
• Bump pip-api from 0.0.34 to 0.0.35 by @dependabot[bot] in #25443
• Bump time-machine from 3.5.0 to 3.5.1 by @dependabot[bot] in #25442
• Bump the google group across 1 directory with 6 updates by @dependabot[bot] in #25467
• Bump django-dbbackup from 5.3.0 to 5.3.1 by @dependabot[bot] in #25451
• Bump stylelint from 17.14.1 to 17.15.0 by @dependabot[bot] in #25434
• Bump zod from 4.4.3 to 4.6.5 by @dependabot[bot] in #25465
• Bump lxml from 6.1.1 to 6.1.3 by @dependabot[bot] in #25422
• Bump elasticsearch from 8.19.21 to 8.19.21 by @dependabot[bot] in #25427
• Bump @eslint/compat from 2.1.0 to 2.1.1 by @dependabot[bot] in #25425
• Bump pure-eval from 0.2.3 to 0.2.4 by @dependabot[bot] in #25460
• Bump vitest from 4.1.11 to 5.0.0 by @dependabot[bot] in #25426
• Bump mysql from 8.4.11 to 8.4.11 by @dependabot[bot] in #25408
• Bump pyjwt from 2.13.0 to 2.14.0 by @dependabot[bot] in #25466
• Bump ruff from 0.16.5 to 0.16.7 by @dependabot[bot] in #25459
• Bump wrapt from 2.3.0 to 2.4.1 by @dependabot[bot] in #25461
• Bump esbuild from 0.28.1 to 0.28.2 by @dependabot[bot] in #25304
• Bump less from 4.9.0 to 4.9.1 by @dependabot[bot] in #25421
• Bump djangorestframework from 3.18.0 to 3.18.1 by @dependabot[bot] in #25437
• Bump jszip from 3.10.1 to 3.10.2 by @dependabot[bot] in #25440
• Bump vitest from 5.0.0 to 5.0.1 by @dependabot[bot] in #25471
• Bump vite from 8.2.2 to 8.3.0 by @dependabot[bot] in #25455
• Bump the ssdlc-actions group across 1 directory with 2 updates by @dependabot[bot] in #25482
• Bump the google group across 1 directory with 2 updates by @dependabot[bot] in #25473
• Bump urllib3 from 2.7.0 to 2.8.0 by @dependabot[bot] in #25484
• Bump elasticsearch from 8.19.21 to 8.19.21 by @dependabot[bot] in #25486
• Bump sentry-sdk from 2.68.1 to 2.69.2 by @dependabot[bot] in #25483
• Bump the google group with 2 updates by @dependabot[bot] in #25499
• Bump wcwidth from 0.8.3 to 0.8.4 by @dependabot[bot] in #25501
• Bump eslint from 10.9.1 to 10.10.0 by @dependabot[bot] in #25432
• Bump knip from 6.15.0 to 6.36.0 by @dependabot[bot] in #25492
• Bump ruff from 0.16.7 to 0.16.8 by @dependabot[bot] in #25494
• Bump regex from 2026.9.3 to 2026.9.10 by @dependabot[bot] in #25452
• Bump click-repl from 0.3.0 to 0.4.0 by @dependabot[bot] in #25495
• Bump django-vite from 3.1.0 to 3.2.0 by @dependabot[bot] in #25475
• Bump idna from 3.19 to 3.20 by @dependabot[bot] in #25500
• Bump redis from 6.2.24 to 6.2.24 by @dependabot[bot] in #25511
• Bump prettier from 3.9.6 to 3.9.8 by @dependabot[bot] in #25498
• Bump amqp from 5.3.1 to 5.4.0 by @dependabot[bot] in #25513
• Bump nginx from 1.31.5 to 1.31.5 by @dependabot[bot] in #25448
• Bump dotenv from 17.4.2 to 18.0.1 by @dependabot[bot] in #25509
• Bump pyparsing from 3.3.2 to 3.3.3 by @dependabot[bot] in #25512
• Bump knip from 6.36.0 to 6.37.0 by @dependabot[bot] in #25508
• Bump justhtml from 2.2.0 to 3.11.2 by @dependabot[bot] in #25388
• Bump undici by @dependabot[bot] in #25515
• Bump dotenv from 18.0.1 to 18.0.2 by @dependabot[bot] in #25516

New Contributors

• @nothingrandom made their first contribution in #25424

Full Changelog: 2026.09.17...2026.10.01

2026.09.17-1

This release's push hero is @diox

Cherry-pick Release on top of 2026.09.17 with:

• cb2b923
• c4c9957
• 566178f
• c03d3c6

Full Changelog: 2026.09.17...2026.09.17-1

2026.09.17

This week's push hero is @chrstinalin

Previous Release: 2026.09.03-1

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

Addons-Frontend Changelog:

https://github.com/mozilla/addons-frontend/releases/tag/2026.09.17

Addons Server Changelog:

What's Changed

Notable things shipping

• Add Enterprise Option in Rollback Menu by @chrstinalin in #25343
• Move the auto-approval blocking webhook events to the scanners package by @willdurand in #25370
• order CinderPolicy instances shown in the reviewer tools form by @eviljeff in #25372
• Improve descriptions of hotness and bayesian average in api docs by @eviljeff in #25384
• Ask user for second factor again for some actions by @diox in #25376
• Extract a build_webhook_payload() helper for scanner webhooks by @willdurand in #25371
• Remove more ignored ruff rules by @eviljeff in #25389
• Clarify nominated status is not public tip in addon_details.html by @ubershmekel in #25338
• log activity log when delayed blocklistsubmission is created with ContentAction by @eviljeff in #25353
• Add unique constraint to the scanner webhook name field by @willdurand in #25383
• Record which restriction instance(s) disabled auto-approval by @jasonBirchall in #25344
• Add api/v5/developers/support endpoint by @chrstinalin in #25374
• Apply auto-fixes to UPxxx formatting rules; update ignore list by @eviljeff in #25390
• Prevent channel confusion at version creation by @chrstinalin in #25405
• Add filename to the list of yara externals by @willdurand in #25407
• Disallow control characters in filenames inside zip/tar/xpi files by @diox in #25406
• Improve ratings API performance & scalability by @diox in #25404
• Bump addons-linter to 10.11.0 by @willdurand in #25412
• Don't check auto-approval restrictions for enterprise versions by @jasonBirchall in #25413
• Auto-merge locales PR by @diox in #25415
• Remove --auto from locales pr merge, feature is not enabled on the l10n repos by @diox in #25419
• unignore more ruff rules; decide that RUF015 isn't a good change by @eviljeff in #25398
• Run actions/policies when a pushed rule matches by @willdurand in #25382
• Handle opacity in generated theme previews by @willdurand in #25431
• Show matched restriction instances on review page by @jasonBirchall in #25423

Dependendabots

• Bump imagesize from 2.0.0 to 2.0.1 by @dependabot[bot] in #25363
• Bump the google group across 1 directory with 8 updates by @dependabot[bot] in #25296
• Bump browserslist from 4.28.1 to 4.28.8 by @dependabot[bot] in #25365
• Bump fast-uri from 3.1.5 to 3.1.7 by @dependabot[bot] in #25375
• Bump @humanfs/node from 0.16.6 to 0.16.8 by @dependabot[bot] in #25373
• Bump idna from 3.18 to 3.19 by @dependabot[bot] in #25340
• Bump pytest-env from 1.6.0 to 1.7.0 by @dependabot[bot] in #25210
• Bump cssselect from 1.4.0 to 1.5.0 by @dependabot[bot] in #25233
• Bump time-machine from 3.4.0 to 3.5.0 by @dependabot[bot] in #25362
• Bump ruff from 0.16.3 to 0.16.4 by @dependabot[bot] in #25354
• Bump responses from 0.26.2 to 0.26.3 by @dependabot[bot] in #25380
• Bump python-dotenv from 1.2.2 to 1.2.3 by @dependabot[bot] in #25331
• Bump bitarray from 3.8.2 to 3.10.1 by @dependabot[bot] in #25300
• Bump ruff from 0.16.4 to 0.16.5 by @dependabot[bot] in #25387
• Bump django-tables2 from 3.0.0 to 3.0.1 by @dependabot[bot] in #25395
• Bump mozilla/addons-frontend from 2026.08.06 to 2026.09.03 by @dependabot[bot] in #25367
• Bump packaging from 26.2 to 26.3 by @dependabot[bot] in #25290
• Bump actions/deploy-pages from 5.0.0 to 5.0.1 by @dependabot[bot] in #25402
• Bump @vitest/mocker and vitest by @dependabot[bot] in #25417
• Bump js-yaml from 4.3.1 to 4.3.2 by @dependabot[bot] in #25416
• Bump smol-toml from 1.6.1 to 1.8.0 by @dependabot[bot] in #25420
• Bump django-admin-rangefilter from 0.14.0 to 0.15.0 by @dependabot[bot] in #25396
• Bump setuptools from 83.0.0 to 84.0.0 by @dependabot[bot] in #25309
• Bump nginx from 1.31.3 to 1.31.5 by @dependabot[bot] in #25379
• Bump elasticsearch from 8.19.19 to 8.19.21 by @dependabot[bot] in #25368
• Bump charset-normalizer from 3.4.9 to 3.5.1 by @dependabot[bot] in #25334
• Bump grpcio from 1.83.0 to 1.83.1 in the google group across 1 directory by @dependabot[bot] in #25385
• Bump vite from 8.2.0 to 8.2.2 by @dependabot[bot] in #25351
• Bump eslint from 10.8.1 to 10.9.1 by @dependabot[bot] in #25360
• Bump sentry-sdk from 2.66.1 to 2.68.1 by @dependabot[bot] in #25361
• Bump cryptography from 50.0.0 to 50.0.1 by @dependabot[bot] in #25369
• Bump webencodings from 0.5.1 to 0.6.1 by @dependabot[bot] in #25330
• Bump wcwidth from 0.8.2 to 0.8.3 by @dependabot[bot] in #25393
• Bump redis from 6.2.22 to 6.2.24 by @dependabot[bot] in #25358
• Bump globals from 17.9.0 to 17.12.0 by @dependabot[bot] in #25400
• Bump mmh3 from 5.2.1 to 5.3.0 by @dependabot[bot] in #25366
• Bump click from 8.4.2 to 8.5.0 by @dependabot[bot] in #25381
• Bump regex from 2026.7.19 to 2026.9.3 by @dependabot[bot] in #25403
• Bump bitarray from 3.10.1 to 3.11.0 by @dependabot[bot] in #25410
• Bump addons-linter from 10.11.0 to 10.12.0 by @dependabot[bot] in #25433

New Contributors

• @ubershmekel made their first contribution in #25338
• @jasonBirchall made their first contribution in #25344

Full Changelog: 2026.09.03...2026.09.17

2026.09.03-1

This release's push hero is @diox

Cherry-pick Release on top of 2026.09.03 with:

• 1659cc9
• db755b2
• 85f4ef7

2026.09.03

This week's push hero is @diox

Previous Release: 2026.08.20

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

Addons Server Changelog:

What's Changed

Notable things shipping

• Allow any combination of channels in scanner query rules by @chrstinalin in #25312
• Make reviewer/decision email copy more empathetic and constructive by @bacharakis in #25032
• Fix localizations by @eviljeff in #25321
• expose devhub submit_notification_warning via site status api by @eviljeff in #25302
• Add Enterprise Add-on API by @chrstinalin in #25215
• Update dependabot.yml by @eviljeff in #25325
• Add Enterprise Version Link to Blocklist Submission by @chrstinalin in #25341
• Use external l10n repos to extract and build locales by @diox in #25342
• Store a reference to the activity for ContentDecision.action by @eviljeff in #25335
• Enable Enterprise Version Upload Subscriptions by @chrstinalin in #25349
• Fix locales job by adding missing GH_TOKEN and skipping if there are no template changes by @diox in #25350
• Remove Binary Choice for Channels by @chrstinalin in #25336
• re-enable more ruff rules by @eviljeff in #25339
• Skip webhooks for langpacks by @chrstinalin in #25359
• Remove --no-location from l10n extraction since Pontoon adds it back by @diox in #25355
• Allow unreject action in reviewer tools on versions rejected by automation by @diox in #25364
• Add an (author only) AddonViewSet list function by @eviljeff in #25318

Dependendabots

• Bump ruff from 0.16.1 to 0.16.3 by @dependabot[bot] in #25327
• Bump less from 4.8.1 to 4.9.0 by @dependabot[bot] in #25326
• Bump docker/metadata-action from 5.7.0 to 6.2.0 in /.github/actions/build-docker by @dependabot[bot] in #25328
• Bump time-machine from 3.3.1 to 3.4.0 by @dependabot[bot] in #25315
• Bump pytest-django from 4.12.0 to 4.14.0 by @dependabot[bot] in #25314
• Bump django-debug-toolbar from 7.0.0 to 7.1.1 by @dependabot[bot] in #25329
• Bump @vitest/eslint-plugin from 1.6.26 to 1.6.27 by @dependabot[bot] in #25303
• Bump eslint from 10.8.0 to 10.8.1 by @dependabot[bot] in #25305
• Bump pytest-forked from 1.6.0 to 1.7.5 by @dependabot[bot] in #25307
• Bump pygments from 2.20.0 to 2.21.0 by @dependabot[bot] in #25332
• Bump djangorestframework from 3.17.2 to 3.18.0 by @dependabot[bot] in #25310

Full Changelog: 2026.08.20...2026.09.03