Weblate 5.17.1

Released on April 30th 2026.

New features

• Add-ons that opt in to manual triggering can now be run from add-on management and the Add-ons.

• Admins can now clean up blocked or abusive users by reverting edits, rejecting pending suggestions, and deleting comments across project or site-wide scopes.

• Admin user management can now find users by audit log IP address.

• Announcements can now also be managed via the Weblate’s REST API for categories.

• Added LTEngine machine translation service.

Improvements

• Improved documentation for the global user.edit permission, Autoclean translation memory, Terminology, and current Translation Memory management options in the UI.

• Improved Screenshots and visual context documentation and linked it from the screenshots UI.

• Documented restoring Docker-based setups from backups, see Restoring Docker based setup.

• Clarified Generic upgrade instructions to state that Celery queues should be empty before upgrading.

• The OpenAPI schema is cleaner and now describes action endpoints with their actual list, statistics, status, upload, and download response payloads.

• The web installation flow for Add missing languages now shows a preview and requires confirmation before creating missing language files across projects, categories, or site-wide scopes.

• Component discovery now offers guided client-side presets, suggests presets detected from component repository layouts, validates {{ component }} more clearly, and includes a worked discovery-template example in the docs.

• Superuser and site-wide team changes are now tracked in Audit log.

• URL validation alerts now show clearer errors for project website and repository browser URLs, and project-level machine translation validation better explains private or local endpoint restrictions on hosted and self-managed sites.

• Automatic translation now attributes copied translations to the add-on user and records automatic translation results in the add-on activity log.

• Extended the conflicting repository setup alert to direct Git pushes, see Translation component alerts.

• Profile links now show an external-link warning where possible.

• Client-side popup notifications triggered by JavaScript now use Bootstrap toasts, with higher-contrast dark theme colors for Bootstrap subtle and emphasis variants.

• The SSH keys management page can now remove stored host keys so changed host keys can be replaced there.

• Project listings now show review progress columns when any listed project has reviews enabled.

Bug fixes

• Image URLs in Markdown are now escaped before rendering (GHSA-5cmv-3rc4-7279).

• Tightened Weblate’s REST API input validation to prevent translation enumeration (GHSA-gcg5-86jr-f7jg).

• Project backup imports now revalidate component repository URLs before restoring from backup (CVE 2026-41654 / GHSA-cwcx-382v-8m9g).

• Fixed revert links in the translate-view history tab after moving a component to another project.

• Invitation acceptance now verifies the invited e-mail address and invitation expiry before granting team membership.

• Inconsistent reStructuredText no longer crashes on repeated explicit-link targets.

• The Add-ons now validates required add-on configuration when installing add-ons.

• Component updates no longer time out waiting on their own repository lock during validation.

• Punctuation spacing check no longer triggers false positives for placeholders.

• Repository alerts, history entries, and task messages now preserve multiline Git and SSH backend error output.

• Interrupted Git rebases now recover more reliably after worker restarts, and signal-terminated backend commands are reported more clearly.

• Borg backups that finish with warnings are no longer shown as failed in the management UI, and backup logs now show C entries for files that changed during the backup.

• Git exporter no longer rejects shared-history fetches just because the first negotiated have revisions are newer than Weblate’s local history.

• Weblate Translation Memory automatic translation avoids broad PostgreSQL searches.

• Malformed IPv6 repository URLs no longer crash SSH host key detection.

• Update POT file (xgettext) and related POT update add-ons now replace the standard descriptive-title placeholder in normalized POT headers again.

• Update POT file (Django) now skips repository locale trees during preflight validation, fixing components that store django.pot in a top-level locale directory.

• Screenshot OCR now skips corrupted or truncated image files instead of failing the request.

• Monolingual component validation now honors Source language when checking duplicate files alongside a separate Monolingual base language file.

• Translation memory upload and import_memory now report a validation error for TMX files missing the required header instead of failing the request.

• <a href="https://docs.weblate.org/en/weblate-5.17.1/admin/machine.html#mt-weblate-translation-memory" class="r...

Weblate 5.17

Released on April 15th 2026.

New features

• Added PROJECT_WEB_RESTRICT_ALLOWLIST to exempt selected project slugs from project website restriction settings.

• Added WEBSITE_ALERTS_ENABLED setting to allow disabling project website availability checks and alerts.

• Added new management command list_format_features, which generates RST documentation snippets describing the supported features for every file format.

• Shared components can now be categorized within the target project, including through the Weblate’s REST API using the category_id parameter.

• Added Update POT file (xgettext), Update POT file (Meson), Update POT file (Django), and Update POT file (Sphinx) to update POT files with configurable update cadence.

• Added PASSWORD_RESET_URL to customize the sign-in page password reset link, useful for external identity providers (Docker env: WEBLATE_PASSWORD_RESET_URL).

• Added bulk user invitations.

• Added Objective-C format.

• Added Forgejo notification webhook, see Automatically receiving changes from Forgejo Repos.

• Added translation memory API filtering, scoped access, and bulk lookup support.

• Added from_component support to the REST API for creating components from existing component content and for seeding new translations by automatic translation from existing components.

• Announcements can now be managed via the Weblate’s REST API for projects, components and translations.

• Added a soft mode to VERSION_DISPLAY to hide the Weblate version from prominent UI while keeping it available on the About page and GET /api/metrics/.

Improvements

• Track origin of newly added source strings.

• Markdown now uses auto-safe-html by default, applying Unsafe HTML and Unsafe HTML cleanup only to plain text and source strings that contain standard HTML markup or valid custom elements.

• Improved LLM interfaces for better reliability.

• Improved logic for adding monolingual plurals in GNU gettext PO (Portable Object).

• Added a component alert for conflicting merge request repository setup, see Translation component alerts.

• Improved plural handling in Automatic translation.

• Improved error messages in some Weblate’s REST API endpoints.

• Updated Microsoft Entra ID authentication docs and Microsoft sign-in branding while keeping legacy Azure AD backend identifiers and documentation anchors for compatibility.

• Improved performance of project and category search result pages with very large match sets.

• Docker now exposes WEBLATE_COMMIT_PENDING_HOURS, WEBLATE_SOCIAL_AUTH_KEYCLOAK_ID_KEY for customizing the Keycloak unique user identifier claim, and WEBLATE_NGINX_IPV6 for controlling IPv6 listeners in the bundled NGINX.

• Project history now records project backups and project/component restore events.

• Improved documentation with auto-generated snippets for Add-ons, Translation types capabilities, Quality checks, and Automatic suggestions machines, and clarified merge-conflict behavior for exported repositories using shallow clones by default.

• Added PROJECT_WEB_RESTRICT_PRIVATE to reject project website and repository browser URLs targeting internal or non-public addresses, WEBHOOK_RESTRICT_PRIVATE to reject webhook URLs targeting internal or non-public addresses, and VCS_RESTRICT_PRIVATE to reject repository and push URLs targeting internal or non-public addresses. These are exposed in Docker as <span...

Weblate 5.16.2

Released on March 6th 2026.

New features

• New setting PUBLIC_ENGAGE to make the engage page public even with REQUIRE_LOGIN.

Improvements

• Improved matching in Translation Memory.

• Show the number of strings waiting for review in listings.

Bug fixes

• Avoid displaying confusing status icons for ghost languages on project or category level.

• Fixed missing plural source strings when creating new bilingual plural units.

• Crash on certain pages with nested categories.

• Improved API validation when adding strings.

• Disabled throttling for incoming webhooks.

• Avoid displaying non-actionable ghost languages.

• Fixed highlighting in the translation editor.

Upgrading

Please follow Generic upgrade instructions in order to perform update.

Contributors

Code contributions
Michal Čihař, Karen Konou, Kartik Ohri

Documentation contributions
Michal Čihař

All changes in detail.

Weblate 5.16.1

Released on February 26th 2026.

New features

• AsciiDoc files, XLIFF 1.1 and 1.2 with Apple extensions, and WixLocalization file are now supported file formats.

• Added REGISTRATION_ALLOW_DISPOSABLE_EMAILS to optionally allow disposable e-mail domains during registration (Docker env: WEBLATE_REGISTRATION_ALLOW_DISPOSABLE_EMAILS).

Improvements

• Improved documentation for translation states to clarify the difference between Needs editing, Needs rewriting, and Needs checking states.

• Improved initial import of translations for Markdown files and HTML files.

Bug fixes

• Slack Webhooks properly delivers all events.

• Punctuation spacing better handles XML markup.

• Stringsdict format better handle some plurals.

• Improved plurals handling for language variants.

• Fixed API access control.

  • Users can manage their own notification subscriptions via the API.

  • Project administrators can manage teams in their projects via the API, according to access control rules.

  • The add-ons listing in the API now correctly honors user permissions (CVE 2026-27457 / GHSA-wppc-7cq7-cgfv).

• Fixed source column being cleared when translating monolingual CSV files.

Upgrading

Please follow Generic upgrade instructions in order to perform update.

Contributors

Code contributions
Michal Čihař, Simon Urli, Karen Konou, Kartik Ohri, Hendrik Leethaus

Translations contributions
Heimen Stoffels, Michal Čihař, delvani, Yaron Shahrabani, ℂ𝕠𝕠𝕠𝕝 (𝕘𝕚𝕥𝕙𝕦𝕓.𝕔𝕠𝕞/ℂ𝕠𝕠𝕠𝕝), Priit Jõerüüt, Zahid Rizky Fakhri, Pierfrancesco Passerini, Massimo Pissarello, Romhányi-Kakucska Viktor, Mickaël Binos, Milo Ivir, Blueberry, 大王叫我来巡山, VfBFan, Besnik Bleta, Nikolay Korotkiy, Pavel Borecki, Matthaiks, Agnieszka C, Emin Tufan Çetin, Agustina Giselle, Fjuro, RViktor, ojppe, eulalio, Pavel Miniutka, Kristoffer Grundström, Aindriú Mac Giolla Eoin, reducedradius, Максим Горпиніч, Руслан Пузич, Francisco Serrador, Kyotaro Iijima, Petr Kadlec, தமிழ்நேரம், Dick Groskamp, PICOPress, justcontributor, Valentin Ljuba, Daniel Nylander, Arantxa, Marino Díaz, Artemka

Documentation contributions
Michal Čihař, michael-smt, Kartik Ohri, Hendrik Leethaus

All changes in detail.

Weblate 5.16

Released on February 16th 2026.

New features

• Multiple capitals quality check.

• XML surrounding characters reduce translation errors for strings with XML entities.

• Bulk accepting suggestions from a specific user in Suggestions.

• Cloning suggestions into translation in Suggestions.

• HIDE_SHARED_GLOSSARY_COMPONENTS to hide glossaries shared into other projects.

• Added new management command list_change_events, which lists all possible change events, Change events.

• Added Anthropic machinery integration, see Anthropic.

• Encoding for Localization file formats can now be configured using File format parameters (e.g., csv_encoding, properties_encoding).

• Added support for anonymous commit names via PRIVATE_COMMIT_NAME_TEMPLATE.

• Consolidating identical strings in Markdown files, HTML files, and Text files files using *merge_duplicates parameters in File format parameters.

Improvements

• Delete announcements permission can be assigned to teams, see List of privileges.

• Searching better reports errors in the query strings.

• Regular repository maintenance is now performed in the background.

• Repository cleanup now recovers failed merges or rebases.

• Better visibility of Translation quality filter to translators.

• Validation of VCS settings Pushing changes from Weblate has been extended.

• The default values for Enable reviews and Enable source reviews can be configured in settings.

• The PRIVATE_COMMIT_EMAIL_TEMPLATE now supports the {user_id} and {site_title} variables.

• The default value for personal translation memory contribution is now based on the DEFAULT_AUTOCLEAN_TM configuration.

Bug fixes

• Argument injection in the management console (CVE 2026-24126 / GHSA-33fm-6gp7-4p47).

• Adding plural strings with singular matching existing string is now prohibited for bilingual translations (see Bilingual and monolingual formats).

• Automatic Repository browser URL for common code hosting sites.

• Improved cache isolation for suggestion checks to avoid interference with the parent unit checks.

• Gracefully handle invalid check flags in Customizing behavior using flags.

• App store metadata files no longer rewrites unchanged files.

Compatibility

• Regular expression no longer marks matched portions as non-translatable to allow generic regular-expression-based checking of strings. Use Placeholders for checking regular expression matched placeholders.

• The default value for WEBLATE_FORMATS changed because of the removal of encoding-specific formats.

• File formats that only differed in encoding (CSV, GWT Properties, Java Properties, iOS Strings) have been merged into single formats.

• Fonts used by Weblate are now shipped in a standalone package.

• Dropped deprecated compatibility wrappers some classes with typos.

Upgrading

Please follow Generic upgrade instructions in order to perform update.

Contributors

Code contributions
Michal Čihař, Kartik Ohri, Karen Konou, Serrano Pereira, moonchoe, softworkz, Gersona, hugorezende, Hendrik Leethaus, AliceVisek, devimarj, evanjhoward11, Zahid Rizky Fakhri, Francisco Serrador

Translations contributions
தமிழ்நேரம், Andi Chandler, Daniel Nylander, Michal Čihař, VfBFan, ButterflyOfFire, Emin Tufan Çetin, eulalio, Milo Ivir, Yuri Chornoivan, 大王叫我来巡山, Zahid Rizky Fakhri, Peter Vančo, Kyotaro Iijima, amano, Hyeonjeong Lee, Yaron Shahrabani, Massimo Pissarello, Blueberry, Aindriú Mac Giolla Eoin, CRISTIAN ANDREI, Максим Горпиніч, Shah Zaman Pathan, Eduard Ereza Martínez, Alexis Launay, Luis Carlos González Morales, AlaxLima, Andrei Stepanov, Pierfrancesco Passerini, Valentin Ljuba, Anusuk Sangubon, Supaplex, Besnik Bleta, Matthaiks, Agnieszka C, Sketch6580, Mickaël Binos, U G, Kristoffer Grundström, Fjuro, 109247019824, Miguel A. Bouzada, Jim Spentzos, Fulup Jakez, Jim Kats, Omer I.S., nautilusx, jonnysemon, Martin Srebotnjak, Umida Hikmatilla, Arif Budiman, Ldm Public, pan93412, Heimen Stoffels, Romhányi-Kakucska Viktor, Pedro Leite, RViktor, Dick Groskamp, Alexander Gabilondo, Любомир Василев, Francisco Serrador, devimarj, Cyrille Duverne, 大学没毕业, Hotripak, delvani, A J.

Documentation contributions
Michal Čihař, Kartik Ohri, moonchoe, Karen Konou, softworkz, Serhii H., shorelskyi, Gersona, hugorezende, Hendrik Leethaus, AliceVisek, devimarj, evanjhoward11

All changes in detail.

Weblate 5.15.2

Released on January 14th 2026.

Improvements

• Statistics generator is now triggered upon installation.

• Screenshots updated from the repository have proper history.

• reStructuredText syntax error now reports unintended list conversion.

• Unchanged translation check ignores AsciiDoc source code blocks.

Bug fixes

• Information leak via screenshots (CVE 2026-21889 / GHSA-3g2f-4rjg-9385).

• Explanation sync in TermBase eXchange format.

• User interface fixes.

• Clarified needs editing/checking/rewriting states.

• Automatically translated flag with bulk approvals.

• GitHub forks no longer trigger actions.

• Tighter validation of user provided websites to avoid confusing homoglyphs.

• Glossary support in Google Cloud Translation Advanced.

• Invitations accepting when REQUIRE_LOGIN is turned on.

• CyrTranslit installation.

Compatibility

• Screenshot images are no longer served directly by the HTTP server, please adjust your HTTP server by removing serving of /media/.

Upgrading

Please follow Generic upgrade instructions in order to perform update.

• To make the fix for CVE 2026-21889 effective, the serving of /media/ path should be removed from the HTTP server configuration; see Serving static files.

Contributors

Code contributions
Michal Čihař, Kartik Ohri, Karen Konou, Marek Lukášík, shyraptor, Korpyc, Benjamin Alan Jamie

Translations contributions
Jim Kats, Horus68, Francisco Serrador, VfBFan, Fjuro, Andi Chandler, Eduard Ereza Martínez, Takeru Mikenu, eulalio, Mickaël Binos, Любомир Василев, Peter Vančo, Mateus Liberale Gomes, Hanu E., Pierfrancesco Passerini, amano, Blueberry, ButterflyOfFire, Basheer Radman, therealmate, មនុញ្ញ - MᴇᴀнNսɴн, தமிழ்நேரம், EdoAug, Zahid Rizky Fakhri, Milo Ivir, Kristoffer Grundström, searinminecraft, Kyotaro Iijima, adecorte, Priit Jõerüüt, Rhoslyn Prys, Shah Zaman Pathan, Daniel Nylander, Michal Čihař, Kristijan "Fremen" Velkovski, Aindriú Mac Giolla Eoin, Tuomas Hietala, 이정희, pan93412, Anusuk Sangubon, پرویز قادر, Fulup Jakez, Matthaiks, Besnik Bleta, Hotripak, 大王叫我来巡山, Agnieszka C

Documentation contributions
Michal Čihař, Kartik Ohri, michael-smt, Marek Lukášík, shyraptor, Korpyc, alexis-pinon, Benjamin Alan Jamie

All changes in detail.

Weblate 5.15.1

Released on December 18th 2025.

New features

• Added GET /api/projects/(string:project)/languages/(string:language_code)/file/ to download a ZIP file of all component translations of a project for a specified language.

Improvements

• Updated list of OpenAI models.

• Added Migrating to Weblate guide to help users migrate from other localization platforms.

• Gracefully handle unreachable authentication providers.

• Update language definitions to CLDR 48.

Bug fixes

• Git config file overwrite remote code execution (CVE 2025-68398 / GHSA-8vcg-cfxj-p5m3).

• Arbitrary file read via symbolic links (CVE 2025-68279 / GHSA-g925-f788-4jh7).

• Locking error that prevented updating linked components.

• Fixed e-mail SSL configuration in Docker container.

• Invitations on sites with required authentication.

Upgrading

Please follow Generic upgrade instructions in order to perform update.

Contributors

Code contributions
Michal Čihař, Karen Konou, Kartik Ohri, ZhuHengjin, Edison, aditi-agni, aditi, Edison Dao, biplopghimire

Translations contributions
eulalio, Yauhen, Emin Tufan Çetin, Priit Jõerüüt, Любомир Василев, Fjuro, Zahid Rizky Fakhri, Takeru Mikenu, ButterflyOfFire, 김인수, Manuela Silva, Pierfrancesco Passerini, Michal Čihař, 大王叫我来巡山, Dick Groskamp, Максим Горпиніч, Matthaiks, γλωσσολαλιά, Turkish Language Team 🇹🇷, Besnik Bleta, Massimo Pissarello, មនុញ្ញ - MᴇᴀнNսɴн, Jim Kats, Aindriú Mac Giolla Eoin, VfBFan

Documentation contributions
Michal Čihař, ZhuHengjin, Edison, aditi-agni, aditi, Edison Dao, biplopghimire

All changes in detail.

Weblate 5.15

Released on December 15th 2025.

New features

• Batch automatic translation can now be manually triggered at project language, category or component level, see Automatic translation.

• Added ability to completely disable the admin contact form by setting CONTACT_FORM to "disabled".

• Added new Ollama machinery tool for local Ollama AI model integration, see Ollama.

• Added GET /api/units/(int:id)/comments/ to get a list of comments for the given translation unit.

• Memory contents imported from TMX files include string context.

• XLIFF 2.0, Nextcloud Apps JSON files, JavaScript Resource Files (RESJSON), and TOML are now supported file formats.

• Fedora Messaging integration is now available as add-on.

• Added Laravel format quality check.

Improvements

• Added disk usage overview in Performance report.

• GET /api/groups/ now includes admins.

• ModernMT better supports language variants.

• Automatically translated strings are now identified by a dedicated flag instead of a label.

• Component discovery preserves File format parameters.

• CyrTranslit now supports Belarusian and Greek.

• Blocking users now accepts internal notes that are not visible to the user.

• Slack Webhooks and Webhook can be installed multiple times.

• Compatibility with Git SHA256 repositories.

• The allowed version control URLs can now be configured using VCS_ALLOW_SCHEMES and VCS_ALLOW_HOSTS.

• The API timeout for creating pull requests or forking can now be configured via VCS_API_TIMEOUT.

• Improved VCS integration documentation to clarify Docker environment variables, commit authorship, hosted vs. self-hosted setup, and authentication options.

• Timestamps from past are now shown with more detail.

Bug fixes

• Improper invitation validation upon accepting (CVE 2025-64725 / GHSA-m6hq-f4w9-qrjj).

• Server-Side Request Forgery while cloning repository (CVE 2025-66407 / GHSA-hfpv-mc5v-p9mm).

• Over‑permissive webhook endpoint enabling mass repository updates plus component enumeration (CVE 2025-67492 / GHSA-pj86-258h-qrvf).

• Notification settings disclosure via Weblate API (CVE 2025-67715 / GHSA-3pmh-24wp-xpf4).

• DeepL integration now correctly handles translating to Chinese variants.

• CSV files format saving translations with empty source fields when using monolingual base files.

• Tighter validation of user and full names to avoid confusing homoglyphs.

• Avoid false positive checks upon committing pending changes.

• Performance improvements for file upload.

• Show glossary matches for the source language.

Compatibility

• Replaced custom RequireLoginMiddleware with Django 5.1’s LoginRequiredMiddleware. This makes settings LOGIN_REQUIRED_URLS and LOGIN_REQUIRED_URLS_EXCEPTIONS no longer supported, including their Docker environment variable counterparts.

• Webhook secret length is now validated to match the Standard Webhooks specification.

• Python 3.12 or newer is now required.

• GLib 2.80 or newer is now required.

• Dropped support for Web Monetization.

• Laravel PHP strings no longer includes return prefix in the keys.

• There are several changes in settings_example.py, most notable are changed settings CRISPY_ALLOWED_TEMPLATE_PACKS and INSTALLED_APPS; please adjust your settings accordingly.

Upgrading

Please follow Generic upgrade instructions in order to perform update.

Contributors

Code contributions
Michal Čihař, michael-smt, Steven Loria, Tudor Gradinaru, Karen Konou, Gersona, Miguel A. Bouzada, Kartik Ohri, Florian, Abtin, Aaditya Joshi, Urtzi Odriozola, Cakex2005, was000, KamikazEr101

Translations contributions
Miguel A. Bouzada, Turkish Language Team 🇹🇷, Francisco Serrador, hoanghuy309, Priit Jõerüüt, Ldm Public, eulalio, ssantos, Christian Wia, Andi Chandler, Joel A, Peter Vančo, Dick Groskamp, Besnik Bleta, Dũng Vũ, Nicola...

Weblate 5.14.3

Released on November 7th 2025.

Bug fixes

• Observed HTTPS status in Performance report.

• Forced synchronization in the Repository maintenance.

Upgrading

Please follow Generic upgrade instructions in order to perform update.

Contributors

Code contributions
Michal Čihař

Documentation contributions
Michal Čihař

All changes in detail.

Weblate 5.14.2

Released on November 6th 2025.

Improvements

• Performance when adding strings.

Bug fixes

• Adding terms to glossary was not working in some situations.

Upgrading

Please follow Generic upgrade instructions in order to perform update.

Contributors

Code contributions
Michal Čihař

Documentation contributions
Michal Čihař

All changes in detail.