2026.07.23

This week's push hero is @willdurand

Previous Release: 2026.07.13

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

Addons-Frontend Changelog:

mozilla/addons-frontend@2026.07.16...2026.07.23

Addons Server Changelog:

What's Changed

Notable things shipping

• rewrite auto_reject to bypass ReviewHelper by @eviljeff in #25091
• Do not raise when generating previews of themes with gradients by @willdurand in #25120
• Expose more relevant information for developer appeals by @eviljeff in #25128
• Remove the enable-mv3-submissions waffle switch by @willdurand in #25153
• Exclude theme review from anything policy-review-selection related by @eviljeff in #25147
• drop obsolete tested on fields in review form by @eviljeff in #25149
• Validate scanner results that are PATCH'ed by @willdurand in #25154
• Avoid reviewer privilege escalation vulnerability by @chrstinalin in #25101
• Make public no longer require comments; refactor to need require_comments by @eviljeff in #25146
• split expose_in_reviewer_tools to extensions and themes by @eviljeff in #25148
• Remove the check on the license in call_webhooks_on_source_code_uploaded() by @willdurand in #25173
• AMOENG-2677 - Allow JWT authentication on the account retrieve endpoint by @bakulf in #25174
• fix bug with admin filters and ScannerRule fk referencing an callable iterable by @eviljeff in #25175

Dependendabots

• Bump addons-linter from 10.7.0 to 10.8.0 by @dependabot[bot] in #25129
• Bump addons-linter from 10.8.0 to 10.8.1 by @dependabot[bot] in #25133
• Bump mozilla/addons-frontend from 2026.06.25 to 2026.07.09 by @dependabot[bot] in #25122
• Bump prettier from 3.8.4 to 3.9.4 by @dependabot[bot] in #25116
• Bump eslint from 10.5.0 to 10.6.0 by @dependabot[bot] in #25107
• Bump ruff from 0.15.18 to 0.15.20 by @dependabot[bot] in #25104
• Bump less from 4.6.4 to 4.6.7 by @dependabot[bot] in #25089
• Bump drf-spectacular-sidecar from 2026.6.1 to 2026.7.1 by @dependabot[bot] in #25126
• Bump regex from 2026.5.9 to 2026.6.28 by @dependabot[bot] in #25114
• Bump django-debug-toolbar from 6.3.0 to 7.0.0 by @dependabot[bot] in #25080
• Bump django-environ from 0.13.0 to 0.14.0 by @dependabot[bot] in #25078
• Bump addons-linter from 10.8.1 to 10.9.0 by @dependabot[bot] in #25138
• Bump django from 5.2.15 to 5.2.16 by @dependabot[bot] in #25144
• Bump wrapt from 2.2.1 to 2.2.2 by @dependabot[bot] in #25084
• Bump globals from 17.6.0 to 17.7.0 by @dependabot[bot] in #25086
• Bump stylelint from 17.13.0 to 17.14.0 by @dependabot[bot] in #25102
• Bump ipython from 9.13.0 to 9.15.0 by @dependabot[bot] in #25105
• Bump tzlocal from 5.4.3 to 5.4.4 by @dependabot[bot] in #25113
• Bump typing-extensions from 4.15.0 to 4.16.0 by @dependabot[bot] in #25125
• Bump vitest from 4.1.9 to 4.1.10 by @dependabot[bot] in #25132
• Bump setuptools from 82.0.1 to 83.0.0 by @dependabot[bot] in #25136
• Bump drf-spectacular from 0.29.0 to 0.30.0 by @dependabot[bot] in #25140
• Bump wcwidth from 0.8.1 to 0.8.2 by @dependabot[bot] in #25117
• Bump responses from 0.26.1 to 0.26.2 by @dependabot[bot] in #25134
• Bump elasticsearch from 8.19.16 to 8.19.18 by @dependabot[bot] in #25094
• Bump nginx from 1.31.2 to 1.31.2 by @dependabot[bot] in #25111
• Bump ruff from 0.15.20 to 0.15.21 by @dependabot[bot] in #25158
• Bump prettier from 3.9.4 to 3.9.5 by @dependabot[bot] in #25155
• Bump mysql from 8.4.10 to 8.4.10 by @dependabot[bot] in #25110
• Bump pillow from 12.2.0 to 12.3.0 by @dependabot[bot] in #25127
• Bump redis from 6.2.22 to 6.2.22 by @dependabot[bot] in #25112

Full Changelog: 2026.07.09...2026.07.23