2026.10.01

This week's push hero is @diox

Previous Release: 2026.09.17

Addons Server Changelog:

What's Changed

Notable things shipping

• Store auth_at when authenticating through fake FxA by @diox in #25439
• Add Activity Feed API by @chrstinalin in #25414
• Record force-disable decision when disabling an add-on as part of a block by @diox in #25438
• Retry scanner webhook deliveries instead of a fixed grace period by @willdurand in #25377
• Add management command to re-run scanners on versions stuck by @willdurand in #25435
• urls should always reverse to /firefox/, regardless of UA or ?app= param by @eviljeff in #25463
• fix more ruff rule exclusions; ignore BLE001 intentionally by @eviljeff in #25462
• feat: pinguino foundation by @nothingrandom in #25424
• Version Filtering only Applies to List by @chrstinalin in #25454
• Call all scanners in call_webhooks() by @willdurand in #25464
• Add Developer Agreement API by @chrstinalin in #25418
• Log request id when calling the webhook scanners by @willdurand in #25469
• Add CODEOWNERS file by @diox in #25468
• drop apps from sitemap - only generate /firefox/ urls by @eviljeff in #25470
• enable Persian (fa) locale for stage/prod by @eviljeff in #25477
• Remove old CODEOWNERS file in .github/ by @diox in #25479
• Reduce session expiry time: 14 days normal users, 1 day privileged users by @diox in #25485
• Fix intermittent test failure by @willdurand in #25487
• Change restriction type for DISABLE_AND_BLOCK by @chrstinalin in #25449
• Pin our own mozilla/addons actions to a specific tag by @diox in #25480
• Show link to the service account sheet on ScannerWebhook creation by @eviljeff in #25453
• Print file/version/upload PKs in the logs when creating a new file by @willdurand in #25478
• Extract is_waiting_on_scanner_webhook_events() by @willdurand in #25489
• docs: add some things worth knowing about the scanner pipeline by @willdurand in #25502
• Pass the events to wait for to wait_for_scanner_results by @willdurand in #25490
• Hold restrictions set by scanners for disable&block until the decision is executed by @diox in #25496
• docs: proofread the scanner pipeline page by @willdurand in #25505
• Remove unused run_scanner() function by @willdurand in #25503
• Remove the use-yara-x waffle switch and old yara by @willdurand in #25504
• Truncate descriptions from XPI using summary max-length when scanning with NARC by @diox in #25506

Dependendabots

• Bump addons-linter from 10.12.0 to 10.13.0 by @dependabot[bot] in #25458
• Bump mozilla/addons-frontend from 2026.09.03 to 2026.09.17 by @dependabot[bot] in #25447
• Bump pytest-env from 1.7.0 to 1.7.1 by @dependabot[bot] in #25445
• Bump pip-api from 0.0.34 to 0.0.35 by @dependabot[bot] in #25443
• Bump time-machine from 3.5.0 to 3.5.1 by @dependabot[bot] in #25442
• Bump the google group across 1 directory with 6 updates by @dependabot[bot] in #25467
• Bump django-dbbackup from 5.3.0 to 5.3.1 by @dependabot[bot] in #25451
• Bump stylelint from 17.14.1 to 17.15.0 by @dependabot[bot] in #25434
• Bump zod from 4.4.3 to 4.6.5 by @dependabot[bot] in #25465
• Bump lxml from 6.1.1 to 6.1.3 by @dependabot[bot] in #25422
• Bump elasticsearch from 8.19.21 to 8.19.21 by @dependabot[bot] in #25427
• Bump @eslint/compat from 2.1.0 to 2.1.1 by @dependabot[bot] in #25425
• Bump pure-eval from 0.2.3 to 0.2.4 by @dependabot[bot] in #25460
• Bump vitest from 4.1.11 to 5.0.0 by @dependabot[bot] in #25426
• Bump mysql from 8.4.11 to 8.4.11 by @dependabot[bot] in #25408
• Bump pyjwt from 2.13.0 to 2.14.0 by @dependabot[bot] in #25466
• Bump ruff from 0.16.5 to 0.16.7 by @dependabot[bot] in #25459
• Bump wrapt from 2.3.0 to 2.4.1 by @dependabot[bot] in #25461
• Bump esbuild from 0.28.1 to 0.28.2 by @dependabot[bot] in #25304
• Bump less from 4.9.0 to 4.9.1 by @dependabot[bot] in #25421
• Bump djangorestframework from 3.18.0 to 3.18.1 by @dependabot[bot] in #25437
• Bump jszip from 3.10.1 to 3.10.2 by @dependabot[bot] in #25440
• Bump vitest from 5.0.0 to 5.0.1 by @dependabot[bot] in #25471
• Bump vite from 8.2.2 to 8.3.0 by @dependabot[bot] in #25455
• Bump the ssdlc-actions group across 1 directory with 2 updates by @dependabot[bot] in #25482
• Bump the google group across 1 directory with 2 updates by @dependabot[bot] in #25473
• Bump urllib3 from 2.7.0 to 2.8.0 by @dependabot[bot] in #25484
• Bump elasticsearch from 8.19.21 to 8.19.21 by @dependabot[bot] in #25486
• Bump sentry-sdk from 2.68.1 to 2.69.2 by @dependabot[bot] in #25483
• Bump the google group with 2 updates by @dependabot[bot] in #25499
• Bump wcwidth from 0.8.3 to 0.8.4 by @dependabot[bot] in #25501
• Bump eslint from 10.9.1 to 10.10.0 by @dependabot[bot] in #25432
• Bump knip from 6.15.0 to 6.36.0 by @dependabot[bot] in #25492
• Bump ruff from 0.16.7 to 0.16.8 by @dependabot[bot] in #25494
• Bump regex from 2026.9.3 to 2026.9.10 by @dependabot[bot] in #25452
• Bump click-repl from 0.3.0 to 0.4.0 by @dependabot[bot] in #25495
• Bump django-vite from 3.1.0 to 3.2.0 by @dependabot[bot] in #25475
• Bump idna from 3.19 to 3.20 by @dependabot[bot] in #25500
• Bump redis from 6.2.24 to 6.2.24 by @dependabot[bot] in #25511
• Bump prettier from 3.9.6 to 3.9.8 by @dependabot[bot] in #25498
• Bump amqp from 5.3.1 to 5.4.0 by @dependabot[bot] in #25513
• Bump nginx from 1.31.5 to 1.31.5 by @dependabot[bot] in #25448
• Bump dotenv from 17.4.2 to 18.0.1 by @dependabot[bot] in #25509
• Bump pyparsing from 3.3.2 to 3.3.3 by @dependabot[bot] in #25512
• Bump knip from 6.36.0 to 6.37.0 by @dependabot[bot] in #25508
• Bump justhtml from 2.2.0 to 3.11.2 by @dependabot[bot] in #25388
• Bump undici by @dependabot[bot] in #25515
• Bump dotenv from 18.0.1 to 18.0.2 by @dependabot[bot] in #25516

New Contributors

• @nothingrandom made their first contribution in #25424

Full Changelog: 2026.09.17...2026.10.01