2026.05.14

This week's push hero is @eviljeff

Previous Release: 2026.04.30

Blockers:

Cherry-picks:

• mozilla/addons-frontend@a927a3b

Before we push:

Before we start:

Before we promote:

After we're done:

• sync cinder policies with ./manage.py sync_cinder_policies - not executed - the sync command has a bug

Addons-Frontend Changelog:

mozilla/addons-frontend@2026.04.30...2026.05.14-1

Addons Server Changelog:

What's Changed

Notable things shipping

• Add logic to find actions that can be automatically executed from a list of policies by @diox in #24807
• Fix some pip packages names by @diox in #24818
• Keep continue-on-error in _test_check.yml for now by @diox in #24820
• Implement policy-based scanner actions by @diox in #24796
• Limit content review triggers to extensions and dictionaries by @eviljeff in #24823
• AMOENG-2480 - Use a FxA secret instead of the access-token for the support API endpoint by @bakulf in #24813
• Update contact form by @bacharakis in #24819
• Always record Promoted Approval when approving add-on versions by @diox in #24824
• Cope with blank enforcement_actions field in cinder policy admin by @diox in #24831
• Allow admins to include a soft-blocked version in their add/change blocklistsubmission by @diox in #24830
• drop ReviewActionReasons support in reviewer tools, and cinder_policy_review_reasons switch by @eviljeff in #24825
• Refactor ReviewBase.set_promoted() to avoid calling promoted_groups() twice by @diox in #24833
• AMOENG-2486 throttling for the contact form submission + input fields max length by @bakulf in #24832
• Make policy selection in scanner rule admin optional by @diox in #24836
• Replace placeholders with empty string in policy text by @diox in #24835
• Remove useless colon character in pull request template by @diox in #24838
• Instruct dependabot to search for requirements starting at the root by @diox in #24843
• drop CinderJob.decision property by @eviljeff in #24864
• When syncing policies disable unpublished in reviewer tools by @eviljeff in #24842
• cache existing Blocks so reversing delayed block actions doesn't fail by @eviljeff in #24863
• update CheckConstraint to use condition kwarg over check by @eviljeff in #24866
• Move auto_approval prevention in rejection code to the ContentAction by @diox in #24871
• Don't allow appeals if content review has been requested already and vice-versa by @diox in #24837

Dependendabots

• Bump nginx from 1.29.8 to 1.29.8 by @dependabot[bot] in #24794
• Bump redis from 6.2.21 to 6.2.21 by @dependabot[bot] in #24795
• Bump mysql from 8.4.8 to 8.4.8 by @dependabot[bot] in #24787
• Bump django-dbbackup from 5.2.0 to 5.3.0 in /requirements by @dependabot[bot] in #24776
• Bump django-tables2 from 2.8.0 to 3.0.0 in /requirements by @dependabot[bot] in #24781
• Bump rich from 14.3.3 to 15.0.0 in /requirements by @dependabot[bot] in #24784
• Bump addons-linter from 10.3.0 to 10.4.0 by @dependabot[bot] in #24814
• Bump nginx from 1.29.8 to 1.29.8 by @dependabot[bot] in #24816
• Bump redis from 6.2.21 to 6.2.21 by @dependabot[bot] in #24817
• Bump stylelint from 17.8.0 to 17.9.1 by @dependabot[bot] in #24828
• Bump vitest from 4.1.4 to 4.1.5 by @dependabot[bot] in #24811
• Bump pip from 26.0.1 to 26.1 by @dependabot[bot] in #24857
• Bump certifi from 2026.2.25 to 2026.4.22 by @dependabot[bot] in #24854
• Bump pathspec from 0.12.1 to 1.1.1 by @dependabot[bot] in #24860
• Bump django from 5.2.13 to 5.2.14 in /requirements by @dependabot[bot] in #24868
• Bump fast-uri from 3.0.1 to 3.1.2 by @dependabot[bot] in #24867
• Bump @babel/plugin-transform-modules-systemjs from 7.29.0 to 7.29.4 by @dependabot[bot] in #24869
• Bump urllib3 from 2.6.3 to 2.7.0 in /requirements by @dependabot[bot] in #24884
• Bump @babel/preset-env from 7.29.2 to 7.29.3 by @dependabot[bot] in #24865
• Bump eslint from 10.2.1 to 10.3.0 by @dependabot[bot] in #24872
• Bump stylelint from 17.9.1 to 17.10.0 by @dependabot[bot] in #24876
• Bump ruff from 0.15.10 to 0.15.12 by @dependabot[bot] in #24859

New Contributors

• @bacharakis made their first contribution in #24819

Full Changelog: 2026.04.30...2026.05.14