2026.06.25

This week's push hero is @diox

Previous Release: 2026.06.11

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

Addons-Frontend Changelog:

mozilla/addons-frontend@2026.06.11...2026.06.25

Addons Server Changelog:

What's Changed

Notable things shipping

• Show the Yara meta data in reviewer tools by @willdurand in #25003
• Use storage classes to manipulate image uploads by @diox in #25007
• Replace Bleach with JustHTML by @chrstinalin in #24986
• Allow appeals to be accepted with override by @eviljeff in #25004
• Update Devhub footer to match Firefox.com by @chrstinalin in #25014
• Correctly capitalize 'YouTube' in DevHub footer by @chrstinalin in #25021
• expose followup actions with policies in emails by @eviljeff in #24981
• versions should be required even where there are no addon versions by @eviljeff in #25008
• Ensure RunPython data migrations always run on primary database by default by @diox in #25020
• add cinder runbook by @eviljeff in #25013
• Explicitly require esbuild as a dev dependency, it's needed in our vite config by @diox in #25031
• Bump yara-x version to 2026.06.16 by @willdurand in #25039
• Use existing X-AMO-Request-ID when set by @willdurand in #25033
• Store ASN with IP addresses ; add ability to restrict based on ASN by @diox in #25030
• Update draft_release.yml choices for responsible person by @eviljeff in #25046
• Pass a X-AMO-Request-ID header to the webhook scanners by @willdurand in #25034
• Remove escape_all and linkify_with_outgoing by @chrstinalin in #25040
• Enable Serbian locale on addons-server, add doc by @chrstinalin in #25049
• Vendor enmerkar string extraction code by @diox in #25048
• Allow reviewers to select policies with different negative enforcement actions by @diox in #25053

Dependendabots

• Bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #25005
• Bump sentry-sdk from 2.60.0 to 2.61.1 by @dependabot[bot] in #25001
• Bump pip from 26.1.1 to 26.1.2 by @dependabot[bot] in #25000
• Bump drf-spectacular-sidecar from 2026.4.14 to 2026.6.1 by @dependabot[bot] in #25006
• Bump eslint from 10.4.0 to 10.4.1 by @dependabot[bot] in #24996
• Bump shell-quote from 1.8.2 to 1.8.4 by @dependabot[bot] in #25009
• Bump rpds-py from 0.30.0 to 2026.5.1 by @dependabot[bot] in #24990
• Bump knip from 6.14.2 to 6.15.0 by @dependabot[bot] in #24993
• Bump @rollup/plugin-babel from 7.0.0 to 7.1.0 by @dependabot[bot] in #24992
• Bump @vitest/eslint-plugin from 1.6.17 to 1.6.19 by @dependabot[bot] in #24997
• Bump pyjwt from 2.12.1 to 2.13.0 by @dependabot[bot] in #24972
• Bump mozilla/addons-frontend from 2026.05.28 to 2026.06.11 by @dependabot[bot] in #25010
• Bump wrapt from 2.2.0 to 2.2.1 by @dependabot[bot] in #24978
• Bump django from 5.2.14 to 5.2.15 by @dependabot[bot] in #25017
• Bump traitlets from 5.15.0 to 5.15.1 by @dependabot[bot] in #25018
• Bump addons-linter from 10.6.0 to 10.7.0 by @dependabot[bot] in #25027
• Bump stylelint from 17.12.0 to 17.13.0 by @dependabot[bot] in #25025
• Bump click from 8.3.3 to 8.4.1 by @dependabot[bot] in #24971
• Bump ruff from 0.15.15 to 0.15.16 by @dependabot[bot] in #25022
• Bump prettier from 3.8.3 to 3.8.4 by @dependabot[bot] in #25041
• Bump esbuild and vite by @dependabot[bot] in #25038
• Bump cryptography from 48.0.0 to 48.0.1 in /requirements by @dependabot[bot] in #25036
• Bump js-yaml from 4.1.1 to 4.2.0 by @dependabot[bot] in #25037
• Bump justhtml from 2.0.0 to 2.2.0 by @dependabot[bot] in #25029
• Bump elasticsearch from 8.19.16 to 8.19.16 by @dependabot[bot] in #24982
• Bump nginx from 1.31.1 to 1.31.1 by @dependabot[bot] in #25015
• Bump sentry-sdk from 2.61.1 to 2.62.0 by @dependabot[bot] in #25035
• Bump idna from 3.17 to 3.18 by @dependabot[bot] in #25011
• Bump undici from 7.25.0 to 7.28.0 by @dependabot[bot] in #25050
• Bump snowballstemmer from 3.1.0 to 3.1.1 by @dependabot[bot] in #25012
• Bump wcwidth from 0.7.0 to 0.8.1 by @dependabot[bot] in #25028
• Bump ruff from 0.15.16 to 0.15.17 by @dependabot[bot] in #25051
• Bump @vitest/eslint-plugin from 1.6.19 to 1.6.20 by @dependabot[bot] in #25042
• Bump pytest from 9.0.3 to 9.1.0 by @dependabot[bot] in #25060

Full Changelog: 2026.06.11...2026.06.25