2025.07.24

This week's push hero is @KevinMind

Previous Release: 2025.07.10

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

Addons-Frontend Changelog:

Full Changelog: mozilla/addons-frontend@2025.06.26...2025.07.24

Addons Server Changelog:

What's Changed

Notable things shipping

• Allow health_check to retrigger on failure with correct permissions by @KevinMind in #23680
• Remove reference to amo-admins in force-disabled tooltip by @wagnerand in #23686
• Remove email reply for account deletion notification emails by @wagnerand in #23687
• Update ci.yml by @KevinMind in #23696
• Bump mozilla/addons/.github actions by @KevinMind in #23698
• Remove CTA to email amo-admins by @wagnerand in #23695
• Move email address for regional restriction notifications by @wagnerand in #23697
• add fi and nb-NO to supported locales by @eviljeff in #23704
• Update second_level_notification.txt by @eviljeff in #23703
• Bump mozilla/addons/* actions by @KevinMind in #23699
• cinder returns 201 for override decision by @eviljeff in #23708
• update CINDER_SERVER_URL to saas cinder by @eviljeff in #23709
• Make sure _health_check.yml can run on fork PRs by only attempting a slack notification if the channel is defined. by @KevinMind in #23716

Dependendabots

• Bump addons-linter from 7.16.0 to 7.17.0 by @dependabot[bot] in #23676
• Bump addons-linter from 7.17.0 to 7.18.0 by @dependabot[bot] in #23705

Full Changelog: 2025.07.10...2025.07.24

2025.07.10

This week's push hero is @eviljeff

Previous Release: 2025.06.26-1

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

• Run atlantis apply -d amo/tf/prod in mozilla/webservices-infra#6139
  This is for https://mozilla-hub.atlassian.net/browse/SVCSE-2457. Changes in PR 6139 has been verified in the dev and stage as noted in the ticket.

Addons-Frontend Changelog:

Addons Server Changelog:

What's Changed

Notable things shipping

• Update Makefile-docker by @eviljeff in #23610
• send email to 2nd level approvers when something enters the queue by @eviljeff in #23608
• remove NOT_PROMOTED group as a concept. by @KevinMind in #23626
• Use updated github action for slack workflow notifications by @KevinMind in #23625
• Fix overrides of negative reviewer/moderator actions for add-ons by @diox in #23623
• Expose private notes and/or reasoning from reviewer by @eviljeff in #23644
• Handle decisions coming from webhook we already created by @diox in #23633
• Add duplicate_addon_version_for_rollback task by @eviljeff in #23638
• Reduce number of queries caused by promoted groups checks by @diox in #23657
• fix 2nd level template layout for private_notes from Cinder by @eviljeff in #23666
• Compare correct data type for notify value on _health_check.yml workflow by @KevinMind in #23674
• Make enable/disable auto-approval an action in review page by @diox in #23651

Dependendabots

• Bump addons-linter from 7.15.0 to 7.16.0 by @dependabot in #23621
• Bump ruff from 0.11.13 to 0.12.2 in /requirements by @dependabot in #23665

Full Changelog: 2025.06.26...2025.07.10

2025.06.26-1

This week's push hero is @KevinMind

See: 2025.06.26

Cherry-picks:

• ee720de

2025.06.26

This week's push hero is @KevinMind

Previous Release: 2025.06.12

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

run ./manage auto_resolve_reports (no rush)

Addons-Frontend Changelog:

mozilla/addons-frontend@2025.06.12...2025.06.26

Addons Server Changelog:

What's Changed

Notable things shipping

• Replace twitter links with bluesky by @diox in #23561
• Put add-on hard-deletion for old deleted users behind a waffle switch by @diox in #23550
• Add auto_resolve_reports command to run on reviewer tools backlog by @eviljeff in #23560
• Reset user sessions when users are banned by @diox in #23562
• Expose data collection permissions in API by @diox in #23581
• define Config keys in constants, with safeguards by @eviljeff in #23565
• Only hold version rejections for 2nd level approval if they would lead to the listing being unavailable by @diox in #23589
• Don't add NHR for a version we couldn't auto-approve if it's waiting for 2nd level approval by @diox in #23583
• Lock down github action permissions by @KevinMind in #23566
• Use commit sha as ref because commit message is too unpredictable by @KevinMind in #23602
• Build policy rendering with placeholder values as django form fields by @eviljeff in #23582
• Include policy text in stakeholder email (if reviewer tools uses policies) by @eviljeff in #23607
• Refactor CI workflow: Remove unnecessary Git step and update job names and conditions for builds by @KevinMind in #23606
• Update draft_release.yml by @KevinMind in #23611
• exclude 2nd level approval requeued jobs from being auto resolved by @eviljeff in #23603

Dependendabots

• Bump addons-linter from 7.14.0 to 7.15.0 by @dependabot in #23593
• Bump protobuf from 4.25.6 to 4.25.8 in /requirements by @dependabot in #23518
• Bump freezegun from 1.5.1 to 1.5.2 in /requirements by @dependabot in #23501
• Bump pytest-xdist from 3.6.1 to 3.7.0 in /requirements by @dependabot in #23508
• Bump yara-python from 4.5.2 to 4.5.4 in /requirements by @dependabot in #23513
• Bump cryptography from 44.0.2 to 45.0.4 in /requirements by @dependabot in #23558
• Bump mozilla/autograph from 7.3.6 to 7.5.0 by @dependabot in #23502
• Bump watchdog[watchmedo] from 3.0.0 to 6.0.0 in /requirements by @dependabot in #22815
• Bump python from 31a416d to 0175d8f by @dependabot in #23552
• Bump jsonschema from 4.23.0 to 4.24.0 in /requirements by @dependabot in #23507
• Bump drf-spectacular-sidecar from 2024.7.1 to 2025.6.1 in /requirements by @dependabot in #23525
• Bump uritemplate from 4.1.1 to 4.2.0 in /requirements by @dependabot in #23535
• Bump @babel/preset-env from 7.26.9 to 7.27.2 by @dependabot in #23428
• Bump the celery group across 1 directory with 2 updates by @dependabot in #23288
• Bump the google group across 1 directory with 5 updates by @dependabot in #23598
• Bump sentry-sdk from 2.23.1 to 2.30.0 in /requirements by @dependabot in #23571
• Bump eslint-config-prettier from 9.1.0 to 10.1.5 by @dependabot in #23436
• Bump referencing from 0.35.1 to 0.36.2 in /requirements by @dependabot in #23203
• Bump exceptiongroup from 1.2.2 to 1.3.0 in /requirements by @dependabot in #23447
• Bump pluggy from 1.5.0 to 1.6.0 in /requirements by @dependabot in #23463
• Bump elasticsearch/elasticsearch from 8.17.4 to 8.18.2 by @dependabot in #23531

Full Changelog: 2025.06.12...2025.06.26

2025.06.12

This week's push hero is @diox

Previous Release: 2025.05.29

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

Addons-Frontend Changelog:

mozilla/addons-frontend@2025.05.29...2025.06.12

Addons Server Changelog:

What's Changed

Notable things shipping

• Send requires_payment field to Cinder by @diox in #23515
• auto-resolve incoming reports where the addon version has been reviewed by @eviljeff in #23465
• Push delayed rejection date forward after second level approval by @diox in #23537
• Auto resolve forwarded jobs where all content has already been reviewed by @eviljeff in #23527
• Parse and store data collection permissions, behind a waffle switch by @diox in #23545
• Fix intermittent test failure TestRankingScenarios::test_scenario_promoted by @diox in #23551
• Expose new current_version after rejection in stakeholder email by @eviljeff in #23534
• Use specific, non-admin permission for 2nd level approval queue by @diox in #23538

Dependendabots

• Bump pytest from 8.3.5 to 8.4.0 in /requirements by @dependabot in #23536
• Bump ruff from 0.11.2 to 0.11.12 in /requirements by @dependabot in #23522
• Bump eslint from 9.23.0 to 9.28.0 by @dependabot in #23526
• Bump mozilla/addons-frontend from 2025.05.01 to 2025.05.29 by @dependabot in #23530
• Bump django-vite from 3.0.5 to 3.1.0 in /requirements by @dependabot in #23104
• Bump djangorestframework from 3.15.2 to 3.16.0 in /requirements by @dependabot in #23245
• Bump django-recaptcha from 4.0.0 to 4.1.0 in /requirements by @dependabot in #23246
• Bump django-extensions from 3.2.3 to 4.1 in /requirements by @dependabot in #23303
• Bump jsonschema-specifications from 2023.12.1 to 2025.4.1 in /requirements by @dependabot in #23368
• Bump python from 8582432 to 31a416d by @dependabot in #23467
• Bump drf-nested-routers from 0.94.1 to 0.94.2 in /requirements by @dependabot in #23455
• Bump django from 4.2.21 to 4.2.22 in /requirements by @dependabot in #23544
• Bump ruff from 0.11.12 to 0.11.13 in /requirements by @dependabot in #23549
• Bump requests from 2.32.3 to 2.32.4 in /requirements by @dependabot in #23555
• Bump addons-linter from 7.13.0 to 7.14.0 by @dependabot in #23539
• Bump django from 4.2.22 to 4.2.23 in /requirements by @dependabot in #23556

Full Changelog: 2025.05.29...2025.06.12

2025.05.29

This week's push hero is @KevinMind

Previous Release: 2025.05.15-1

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

Addons-Frontend Changelog:

mozilla/addons-frontend@2025.05.15...2025.05.29

Addons Server Changelog:

What's Changed

Notable things shipping

• drop support for AMO_ESCALATE and forwarded jobs by @eviljeff in #23338
• Drop Legacy Promoted Models by @chrstinalin in #23425
• Fix including policies text in emails of decisions coming from Cinder with notes by @diox in #23451
• Improvements to Discovery Addon Admin by @chrstinalin in #23457
• Add retry mechanism to health check and notification of recovery by @KevinMind in #23453
• Allow policies to be selected directly for reviewer tools actions by @eviljeff in #23437
• Display banned column in user admin changelist page by @diox in #23464
• Add auto generated model documentation to AMO docs by @KevinMind in #22483
• update ContentActionTargetAppealRemovalAffirmation template by @eviljeff in #23466
• Add distinct to search by promoted in discovery addons by @chrstinalin in #23477
• When resolving multiple jobs in a reviewer action, record activity & notify owners once by @diox in #23459
• Squash migrations the right way by @KevinMind in #23458
• Fix urlparams() when a query has multiple values for a given key by @diox in #23478
• Expose when jobs were created / forwarded / requeued in review page by @diox in #23485
• Docker compose: Add 'start_period' to healthcheck for web and worker by @wagnerand in #23500
• Make add-ons in PromotedClass Partner pre-review by @wagnerand in #23497
• Handle version rejection appeals forwarded to legal by @eviljeff in #23484
• Remove 'dsa-appeals-review' waffle switch by @diox in #23506

Dependendabots

• Bump packaging from 24.2 to 25.0 in /requirements by @dependabot in #23351
• Bump pyparsing from 3.2.1 to 3.2.3 in /requirements by @dependabot in #23222
• Bump addons-linter from 7.11.0 to 7.13.0 by @dependabot in #23494
• Bump nginx from 1.27-bookworm@sha256:124b44bfc9ccd1f3cedf4b592d4d1e8bddb78b51ec2ed5056c52d3692baebc19 to sha256:5ed8fcc66f4ed123c1b2560ed708dc148755b6e4cbd8b943fab094f2c6bfa91e by @dependabot in #23354
• Bump pyuwsgi from 2.0.28.post1 to 2.0.29 in /requirements by @dependabot in #23375
• Bump setuptools from 75.8.0 to 78.1.1 in /requirements by @dependabot in #23481
• Bump pip from 25.0.1 to 25.1.1 in /requirements by @dependabot in #23418
• Bump memcached from 1.5.16 to 1.5.16 by @dependabot in #23384
• Bump typing-extensions from 4.12.2 to 4.13.2 in /requirements by @dependabot in #23302
• Bump yara-python from 4.5.1 to 4.5.2 in /requirements by @dependabot in #23416
• Bump stylelint from 16.17.0 to 16.19.1 by @dependabot in #23385
• Bump @eslint/compat from 1.2.8 to 1.2.9 by @dependabot in #23406
• Bump charset-normalizer from 3.4.1 to 3.4.2 in /requirements by @dependabot in #23403
• Bump mypy-extensions from 1.0.0 to 1.1.0 in /requirements by @dependabot in #23360
• Bump certifi from 2025.1.31 to 2025.4.26 in /requirements by @dependabot in #23376

Full Changelog: 2025.05.15...2025.05.29

2025.05.15-1

This week's push hero is @diox

Previous Release: 2025.05.01-1

Blockers:

Cherry-picks:

• 497b4db

Before we push:

Before we start:

Before we promote:

After we're done:

Addons-Frontend Changelog:

mozilla/addons-frontend@2025.05.01...2025.05.15

Addons Server Changelog:

What's Changed

Notable things shipping

• Ignore all decisions that originated from the api by @eviljeff in #23386
• Enable Partner Group for High Profile Rating by @chrstinalin in #23390
• prevent empty job_id values - null should be the only empty value by @eviljeff in #23396
• Only consider active NHR when filtering for due date reasons by @diox in #23421
• Remove locales below 80% threshold by @diox in #23395
• Prepare Drop of Old Promotion Models by @chrstinalin in #23315
• Only Show Badged Promoted Groups in Devhub by @chrstinalin in #23372
• Expose the policy text for decisions in version|important-changes history by @eviljeff in #23401
• Re-order needs human review reasons, display them in the review queue for each add-on by @diox in #23426
• associate deny appeal version logs with original versions by @eviljeff in #23449
• Record reasoning and private_notes separately in Content Decisions by @diox in #23419
• Add runbooks with examples for localdev/dev/statistics by @KevinMind in #23286

Dependendabots

• Bump django from 4.2.20 to 4.2.21 in /requirements by @dependabot in #23433
• Bump vitest from 3.1.1 to 3.1.3 by @dependabot in #23422
• Bump vite from 6.2.6 to 6.3.5 by @dependabot in #23410
• Bump jsdom from 26.0.0 to 26.1.0 by @dependabot in #23310
• Bump pillow from 11.1.0 to 11.2.1 in /requirements by @dependabot in #23313
• Bump less from 4.2.2 to 4.3.0 by @dependabot in #23278
• Bump pytz from 2025.1 to 2025.2 in /requirements by @dependabot in #23221
• Bump mozilla/addons-frontend from 2025.04.17 to 2025.05.01 by @dependabot in #23413
• Bump drf-yasg from 1.21.8 to 1.21.10 in /requirements by @dependabot in #23152
• Bump drf-spectacular from 0.27.2 to 0.28.0 in /requirements by @dependabot in #23201
• Bump glob from 11.0.1 to 11.0.2 by @dependabot in #23364
• Bump iniconfig from 2.0.0 to 2.1.0 in /requirements by @dependabot in #23196
• Bump attrs from 25.1.0 to 25.3.0 in /requirements by @dependabot in #23167
• Bump proto-plus from 1.25.0 to 1.26.1 in /requirements by @dependabot in #23156
• Bump python from a866731 to 8582432 by @dependabot in #23382

Full Changelog: 2025.05.01...2025.05.15-1

2025.05.15

This week's push hero is @diox

Previous Release: 2025.05.01-1

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

Addons-Frontend Changelog:

mozilla/addons-frontend@2025.05.01...2025.05.15

Addons Server Changelog:

What's Changed

Notable things shipping

• Ignore all decisions that originated from the api by @eviljeff in #23386
• Enable Partner Group for High Profile Rating by @chrstinalin in #23390
• prevent empty job_id values - null should be the only empty value by @eviljeff in #23396
• Only consider active NHR when filtering for due date reasons by @diox in #23421
• Remove locales below 80% threshold by @diox in #23395
• Prepare Drop of Old Promotion Models by @chrstinalin in #23315
• Only Show Badged Promoted Groups in Devhub by @chrstinalin in #23372
• Expose the policy text for decisions in version|important-changes history by @eviljeff in #23401
• Re-order needs human review reasons, display them in the review queue for each add-on by @diox in #23426
• associate deny appeal version logs with original versions by @eviljeff in #23449
• Record reasoning and private_notes separately in Content Decisions by @diox in #23419
• Add runbooks with examples for localdev/dev/statistics by @KevinMind in #23286

Dependendabots

• Bump django from 4.2.20 to 4.2.21 in /requirements by @dependabot in #23433
• Bump vitest from 3.1.1 to 3.1.3 by @dependabot in #23422
• Bump vite from 6.2.6 to 6.3.5 by @dependabot in #23410
• Bump jsdom from 26.0.0 to 26.1.0 by @dependabot in #23310
• Bump pillow from 11.1.0 to 11.2.1 in /requirements by @dependabot in #23313
• Bump less from 4.2.2 to 4.3.0 by @dependabot in #23278
• Bump pytz from 2025.1 to 2025.2 in /requirements by @dependabot in #23221
• Bump mozilla/addons-frontend from 2025.04.17 to 2025.05.01 by @dependabot in #23413
• Bump drf-yasg from 1.21.8 to 1.21.10 in /requirements by @dependabot in #23152
• Bump drf-spectacular from 0.27.2 to 0.28.0 in /requirements by @dependabot in #23201
• Bump glob from 11.0.1 to 11.0.2 by @dependabot in #23364
• Bump iniconfig from 2.0.0 to 2.1.0 in /requirements by @dependabot in #23196
• Bump attrs from 25.1.0 to 25.3.0 in /requirements by @dependabot in #23167
• Bump proto-plus from 1.25.0 to 1.26.1 in /requirements by @dependabot in #23156
• Bump python from a866731 to 8582432 by @dependabot in #23382

Full Changelog: 2025.05.01...2025.05.15

2025.05.01-1

Off-band release

This week's push hero is @eviljeff

Previous Release: 2025.05.01

Cherry-picks:

• 6993746 mozilla/addons#15591

Before we push:

Before we start:

Before we promote:

After we're done:

2025.05.01

This week's push hero is @eviljeff

Previous Release: 2025.04.17-2

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

Addons-Frontend Changelog:

mozilla/addons-frontend@2025.04.17...2025.05.01

Addons Server Changelog:

What's Changed

Notable things shipping

• Record which versions were affected when force disabling/enabling add-ons by @diox in #23308
• Enable swagger on dev by @KevinMind in #23332
• migrate PrimaryHero model to use addon instead of promoted_addon in a migration safe way by @KevinMind in #23333
• allow multiple ContentDecision to link to CinderJob; etc by @eviljeff in #23301
• Update 0055_fill_cinderjob_fk_on_decision.py by @eviljeff in #23339
• Correct approved_applications_for() by @chrstinalin in #23337
• fix Expression injection in Actions by @odaysec in #23358
• Fix broken settings import in review_reports command by @diox in #23371
• Allow selecting "AMO_CLOSED_NO_ACTION" policies when resolving jobs in reviewer tools by @diox in #23369
• Hide Strategic and Notable groups from the API by @chrstinalin in #23373
• Update PrimaryHero to Drop promoted_addon field and Add Null Constraint by @chrstinalin in #23391
• allow null CinderJob.job_id by @eviljeff in #23387
• Don't inherit due date and/or NeedsHumanReview for ABUSE_ADDON_VIOLATION/CINDER_ESCALATION by @diox in #23343

Dependendabots

• Bump addons-linter from 7.10.0 to 7.11.0 by @dependabot in #23340
• Bump mozilla/addons-frontend from 2025.04.03@sha256:7e69b592cd2e47290c1cbf3f9251553359aed57e5b5d8c50fa6fb93145104de0 to sha256:649541aa871dda9e5befcc9b036c94e99b1fecee5ce26128d960eb2d601f0529 by @dependabot in #23353
• Bump the google group across 1 directory with 2 updates by @dependabot in #23317
• Bump asttokens from 2.4.1 to 3.0.0 in /requirements by @dependabot in #22907
• Bump executing from 2.1.0 to 2.2.0 in /requirements by @dependabot in #23017
• Bump responses from 0.25.6 to 0.25.7 in /requirements by @dependabot in #23159
• Bump decorator from 5.1.1 to 5.2.1 in /requirements by @dependabot in #23103
• Bump cryptography from 44.0.1 to 44.0.2 in /requirements by @dependabot in #23131
• Bump cssselect from 1.2.0 to 1.3.0 in /requirements by @dependabot in #23151
• Bump googleapis-common-protos from 1.69.1 to 1.70.0 in /requirements by @dependabot in #23314
• Bump @eslint/compat from 1.2.7 to 1.2.8 by @dependabot in #23257
• Bump eslint-plugin-prettier from 5.2.5 to 5.2.6 by @dependabot in #23263
• Bump pytest-django from 4.10.0 to 4.11.1 in /requirements by @dependabot in #23271
• Bump prompt-toolkit from 3.0.50 to 3.0.51 in /requirements by @dependabot in #23319
• Bump markdown from 3.7 to 3.8 in /requirements by @dependabot in #23312
• Bump lxml from 5.3.1 to 5.4.0 in /requirements by @dependabot in #23361

New Contributors

• @odaysec made their first contribution in #23358

Full Changelog: 2025.04.17...2025.05.01