2026.09.17

This week's push hero is @chrstinalin

Previous Release: 2026.09.03-1

Blockers:

Cherry-picks:

Before we push:

Before we start:

Before we promote:

After we're done:

Addons-Frontend Changelog:

https://github.com/mozilla/addons-frontend/releases/tag/2026.09.17

Addons Server Changelog:

What's Changed

Notable things shipping

• Add Enterprise Option in Rollback Menu by @chrstinalin in #25343
• Move the auto-approval blocking webhook events to the scanners package by @willdurand in #25370
• order CinderPolicy instances shown in the reviewer tools form by @eviljeff in #25372
• Improve descriptions of hotness and bayesian average in api docs by @eviljeff in #25384
• Ask user for second factor again for some actions by @diox in #25376
• Extract a build_webhook_payload() helper for scanner webhooks by @willdurand in #25371
• Remove more ignored ruff rules by @eviljeff in #25389
• Clarify nominated status is not public tip in addon_details.html by @ubershmekel in #25338
• log activity log when delayed blocklistsubmission is created with ContentAction by @eviljeff in #25353
• Add unique constraint to the scanner webhook name field by @willdurand in #25383
• Record which restriction instance(s) disabled auto-approval by @jasonBirchall in #25344
• Add api/v5/developers/support endpoint by @chrstinalin in #25374
• Apply auto-fixes to UPxxx formatting rules; update ignore list by @eviljeff in #25390
• Prevent channel confusion at version creation by @chrstinalin in #25405
• Add filename to the list of yara externals by @willdurand in #25407
• Disallow control characters in filenames inside zip/tar/xpi files by @diox in #25406
• Improve ratings API performance & scalability by @diox in #25404
• Bump addons-linter to 10.11.0 by @willdurand in #25412
• Don't check auto-approval restrictions for enterprise versions by @jasonBirchall in #25413
• Auto-merge locales PR by @diox in #25415
• Remove --auto from locales pr merge, feature is not enabled on the l10n repos by @diox in #25419
• unignore more ruff rules; decide that RUF015 isn't a good change by @eviljeff in #25398
• Run actions/policies when a pushed rule matches by @willdurand in #25382
• Handle opacity in generated theme previews by @willdurand in #25431
• Show matched restriction instances on review page by @jasonBirchall in #25423

Dependendabots

• Bump imagesize from 2.0.0 to 2.0.1 by @dependabot[bot] in #25363
• Bump the google group across 1 directory with 8 updates by @dependabot[bot] in #25296
• Bump browserslist from 4.28.1 to 4.28.8 by @dependabot[bot] in #25365
• Bump fast-uri from 3.1.5 to 3.1.7 by @dependabot[bot] in #25375
• Bump @humanfs/node from 0.16.6 to 0.16.8 by @dependabot[bot] in #25373
• Bump idna from 3.18 to 3.19 by @dependabot[bot] in #25340
• Bump pytest-env from 1.6.0 to 1.7.0 by @dependabot[bot] in #25210
• Bump cssselect from 1.4.0 to 1.5.0 by @dependabot[bot] in #25233
• Bump time-machine from 3.4.0 to 3.5.0 by @dependabot[bot] in #25362
• Bump ruff from 0.16.3 to 0.16.4 by @dependabot[bot] in #25354
• Bump responses from 0.26.2 to 0.26.3 by @dependabot[bot] in #25380
• Bump python-dotenv from 1.2.2 to 1.2.3 by @dependabot[bot] in #25331
• Bump bitarray from 3.8.2 to 3.10.1 by @dependabot[bot] in #25300
• Bump ruff from 0.16.4 to 0.16.5 by @dependabot[bot] in #25387
• Bump django-tables2 from 3.0.0 to 3.0.1 by @dependabot[bot] in #25395
• Bump mozilla/addons-frontend from 2026.08.06 to 2026.09.03 by @dependabot[bot] in #25367
• Bump packaging from 26.2 to 26.3 by @dependabot[bot] in #25290
• Bump actions/deploy-pages from 5.0.0 to 5.0.1 by @dependabot[bot] in #25402
• Bump @vitest/mocker and vitest by @dependabot[bot] in #25417
• Bump js-yaml from 4.3.1 to 4.3.2 by @dependabot[bot] in #25416
• Bump smol-toml from 1.6.1 to 1.8.0 by @dependabot[bot] in #25420
• Bump django-admin-rangefilter from 0.14.0 to 0.15.0 by @dependabot[bot] in #25396
• Bump setuptools from 83.0.0 to 84.0.0 by @dependabot[bot] in #25309
• Bump nginx from 1.31.3 to 1.31.5 by @dependabot[bot] in #25379
• Bump elasticsearch from 8.19.19 to 8.19.21 by @dependabot[bot] in #25368
• Bump charset-normalizer from 3.4.9 to 3.5.1 by @dependabot[bot] in #25334
• Bump grpcio from 1.83.0 to 1.83.1 in the google group across 1 directory by @dependabot[bot] in #25385
• Bump vite from 8.2.0 to 8.2.2 by @dependabot[bot] in #25351
• Bump eslint from 10.8.1 to 10.9.1 by @dependabot[bot] in #25360
• Bump sentry-sdk from 2.66.1 to 2.68.1 by @dependabot[bot] in #25361
• Bump cryptography from 50.0.0 to 50.0.1 by @dependabot[bot] in #25369
• Bump webencodings from 0.5.1 to 0.6.1 by @dependabot[bot] in #25330
• Bump wcwidth from 0.8.2 to 0.8.3 by @dependabot[bot] in #25393
• Bump redis from 6.2.22 to 6.2.24 by @dependabot[bot] in #25358
• Bump globals from 17.9.0 to 17.12.0 by @dependabot[bot] in #25400
• Bump mmh3 from 5.2.1 to 5.3.0 by @dependabot[bot] in #25366
• Bump click from 8.4.2 to 8.5.0 by @dependabot[bot] in #25381
• Bump regex from 2026.7.19 to 2026.9.3 by @dependabot[bot] in #25403
• Bump bitarray from 3.10.1 to 3.11.0 by @dependabot[bot] in #25410
• Bump addons-linter from 10.11.0 to 10.12.0 by @dependabot[bot] in #25433

New Contributors

• @ubershmekel made their first contribution in #25338
• @jasonBirchall made their first contribution in #25344

Full Changelog: 2026.09.03...2026.09.17