2026.06.03

What's Changed

User-facing changes

• fix(emails) MPP-4684: remove Feedback-ID as promotional email signal by @groovecoder in #6598
• fix(phones): fix MPP-4680: validate relay number country before Twilio purchase by @groovecoder in #6596

Other changes

• Quality: Typo in mockNextRouter: 'pathmame' instead of 'pathname' by @tomaioo in #6595
• Migrate subplat api mpp 4658 by @groovecoder in #6580

Dependency updates

• chore(deps): bump postcss to 8.5.10 by @mozilla-blender[bot] in #6579
• build(deps): bump phonenumbers from 9.0.29 to 9.0.30 by @dependabot[bot] in #6576
• build(deps): bump mypy from 1.20.2 to 2.1.0 by @dependabot[bot] in #6575
• build(deps): bump black from 26.3.1 to 26.5.1 by @dependabot[bot] in #6593
• build(deps): bump requests from 2.34.0 to 2.34.2 by @dependabot[bot] in #6594
• build(deps): bump github/codeql-action from 4.35.4 to 4.35.5 by @dependabot[bot] in #6591
• build(deps): bump sentry-sdk from 2.59.0 to 2.60.0 by @dependabot[bot] in #6589
• build(deps): bump the typing-stubs group with 2 updates by @dependabot[bot] in #6588
• build(deps-dev): bump stylelint from 17.11.0 to 17.11.1 by @dependabot[bot] in #6586
• build(deps): bump @stripe/stripe-js from 9.4.0 to 9.6.0 by @dependabot[bot] in #6587
• build(deps): bump the boto group with 2 updates by @dependabot[bot] in #6585
• build(deps): bump docker/build-push-action from 7 to 7.1.0 by @dependabot[bot] in #6584
• build(deps-dev): bump lint-staged from 17.0.4 to 17.0.5 by @dependabot[bot] in #6583
• build(deps): bump mozilla/deploy-actions/.github/workflows/build-and-push.yml from 6.2.3 to 6.5.4 by @dependabot[bot] in #6582
• build(deps): bump ruby/setup-ruby from 1.307.0 to 1.308.0 by @dependabot[bot] in #6581
• build(deps): bump ruff from 0.15.12 to 0.15.13 by @dependabot[bot] in #6592
• build(deps): bump glean-parser from 19.0.0 to 19.1.0 by @dependabot[bot] in #6590
• build(deps-dev): bump the eslint group across 1 directory with 2 updates by @dependabot[bot] in #6326
• build(deps): bump the react group across 1 directory with 2 updates by @dependabot[bot] in #6476

New Contributors

• @tomaioo made their first contribution in #6595

Full Changelog: 2026.05.20...2026.06.03

2026.05.20

What's Changed

User-facing changes

None

Other changes

• refactor(api): hollow out /metrics-event endpoint by @groovecoder in #6548

Dependency updates

• build(deps): bump cryptography from 47.0.0 to 48.0.0 by @dependabot[bot] in #6543
• build(deps): bump the boto group across 1 directory with 6 updates by @dependabot[bot] in #6537
• Bump Django to 5.2.14 (security) by @mozilla-blender[bot] in #6554
• build(deps): bump twilio from 9.10.5 to 9.10.9 by @dependabot[bot] in #6577
• build(deps): bump requests from 2.33.1 to 2.34.0 by @dependabot[bot] in #6574
• build(deps-dev): bump stylelint-scss from 7.0.0 to 7.1.1 by @dependabot[bot] in #6573
• build(deps): bump msw from 2.14.3 to 2.14.6 by @dependabot[bot] in #6571
• build(deps-dev): bump @playwright/test from 1.59.1 to 1.60.0 by @dependabot[bot] in #6569
• build(deps): bump github/codeql-action from 4.35.2 to 4.35.4 by @dependabot[bot] in #6568
• build(deps-dev): bump stylelint from 17.10.0 to 17.11.0 by @dependabot[bot] in #6566
• build(deps): bump the nextjs group with 3 updates by @dependabot[bot] in #6565
• build(deps): bump the typing-stubs group with 2 updates by @dependabot[bot] in #6564
• build(deps): bump coverage from 7.13.5 to 7.14.0 in the testing-libraries group by @dependabot[bot] in #6563
• build(deps-dev): bump the jest group with 3 updates by @dependabot[bot] in #6562
• build(deps): bump ruby/setup-ruby from 1.306.0 to 1.307.0 by @dependabot[bot] in #6559
• build(deps): bump slackapi/slack-github-action from 3.0.2 to 3.0.3 by @dependabot[bot] in #6558
• build(deps): bump actions/checkout from 4 to 6 by @dependabot[bot] in #6572
• build(deps): bump gunicorn from 25.3.0 to 26.0.0 by @dependabot[bot] in #6570
• build(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #6560
• build(deps-dev): bump lint-staged from 16.4.0 to 17.0.4 by @dependabot[bot] in #6567
• build(deps): bump the boto group across 1 directory with 3 updates by @dependabot[bot] in #6561

Full Changelog: 2026.05.14...2026.05.20

2026.05.14

What's Changed

User-facing changes

None

Other changes

• feat(claude): add BLE skill and project sandbox settings by @groovecoder in #6517

Dependency updates

• build(deps-dev): bump fast-uri from 3.1.0 to 3.1.2 by @dependabot[bot] in #6530
• build(deps-dev): bump next from 16.2.4 to 16.2.6 by @dependabot[bot] in #6532
• build(deps): bump drf-spectacular-sidecar from 2026.4.14 to 2026.5.1 by @dependabot[bot] in #6546
• build(deps): bump sentry-sdk from 2.58.0 to 2.59.0 by @dependabot[bot] in #6544
• build(deps): bump psycopg from 3.3.3 to 3.3.4 by @dependabot[bot] in #6545
• build(deps): bump @stripe/stripe-js from 9.3.1 to 9.4.0 by @dependabot[bot] in #6542
• build(deps): bump types-requests from 2.33.0.20260408 to 2.33.0.20260503 in the typing-stubs group by @dependabot[bot] in #6541
• build(deps): bump msw from 2.13.6 to 2.14.3 by @dependabot[bot] in #6539
• build(deps-dev): bump stylelint from 17.9.1 to 17.10.0 by @dependabot[bot] in #6535
• build(deps): bump ruby/setup-ruby from 1 to 1.306.0 by @dependabot[bot] in #6536
• build(deps): bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #6533
• build(deps): bump actions/download-artifact from 4 to 8 by @dependabot[bot] in #6540
• build(deps): bump actions/setup-python from 5 to 6 by @dependabot[bot] in #6534
• build(deps): bump docker/build-push-action from 6 to 7 by @dependabot[bot] in #6538

Full Changelog: 2026.05.07...2026.05.14

2026.05.07

What's Changed

User-facing changes

None

Other changes

• refactor(api)!: remove stale waffle flags and flag management UI by @groovecoder in #6516
• build(GHA): Move CircleCI jobs to Github Actions by @joeherm in #6494
• build(gha): add merge_group to ci.yml by @joeherm in #6529
• fix(ci): prevent secret leaks in Playwright artifacts by @groovecoder in #6528

Dependency updates

• build(deps): bump @stripe/stripe-js from 9.2.0 to 9.3.1 by @dependabot[bot] in #6525
• build(deps): bump mypy from 1.20.1 to 1.20.2 by @dependabot[bot] in #6524
• build(deps): bump ruff from 0.15.11 to 0.15.12 by @dependabot[bot] in #6523
• build(deps-dev): bump stylelint from 17.8.0 to 17.9.1 by @dependabot[bot] in #6522
• build(deps): bump phonenumbers from 9.0.28 to 9.0.29 by @dependabot[bot] in #6521
• build(deps): bump msw from 2.13.4 to 2.13.6 by @dependabot[bot] in #6520
• build(deps): bump the boto group with 3 updates by @dependabot[bot] in #6518
• build(deps-dev): bump jest-junit from 16.0.0 to 17.0.0 by @dependabot[bot] in #6519
• build(deps): bump cryptography from 46.0.7 to 47.0.0 by @dependabot[bot] in #6526
• build(deps): bump slackapi/slack-github-action from 3.0.1 to 3.0.2 by @dependabot[bot] in #6527

Full Changelog: 2026.05.04...2026.05.07

2026.05.04

What's Changed

User-facing changes

None

Other changes

• fix(e2e): bypass Fastly CAPTCHA on FxA stage with fxa-ci header by @groovecoder in #6496

Dependency updates

• build(deps): bump msw from 2.13.2 to 2.13.4 by @dependabot[bot] in #6514
• build(deps-dev): bump stylelint from 17.7.0 to 17.8.0 by @dependabot[bot] in #6513
• build(deps-dev): bump typescript from 6.0.2 to 6.0.3 by @dependabot[bot] in #6511
• build(deps): bump react-toastify from 11.0.5 to 11.1.0 by @dependabot[bot] in #6512
• build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by @dependabot[bot] in #6508
• build(deps): bump drf-spectacular-sidecar from 2026.4.1 to 2026.4.14 by @dependabot[bot] in #6507
• build(deps-dev): bump prettier from 3.8.2 to 3.8.3 by @dependabot[bot] in #6506
• build(deps): bump ruff from 0.15.10 to 0.15.11 by @dependabot[bot] in #6501
• build(deps): bump django-allauth from 65.16.0 to 65.16.1 by @dependabot[bot] in #6504
• build(deps): bump twilio from 9.10.4 to 9.10.5 by @dependabot[bot] in #6505
• build(deps): bump django-stubs from 6.0.2 to 6.0.3 in the typing-stubs group by @dependabot[bot] in #6500
• build(deps): bump the boto group with 2 updates by @dependabot[bot] in #6499
• build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 by @dependabot[bot] in #6497
• build(deps): bump dependabot/fetch-metadata from 3.0.0 to 3.1.0 by @dependabot[bot] in #6498
• build(deps): bump react-stately from 3.45.0 to 3.46.0 by @dependabot[bot] in #6509
• build(deps): bump the nextjs group across 1 directory with 4 updates by @dependabot[bot] in #6503
• build(deps): bump python-ipware from 2.0.3 to 3.0.0 by @dependabot[bot] in #6502
• build(deps): bump react-aria from 3.47.0 to 3.48.0 by @dependabot[bot] in #6510

Full Changelog: 2026.04.28...2026.05.04

2026.04.29

What's Changed

User-facing changes

Other changes

• fix(e2e): bypass Fastly CAPTCHA on FxA stage with fxa-ci header by @groovecoder in #6496

Dependency updates

• build(deps): bump msw from 2.13.2 to 2.13.4 by @dependabot[bot] in #6514
• build(deps-dev): bump stylelint from 17.7.0 to 17.8.0 by @dependabot[bot] in #6513
• build(deps-dev): bump typescript from 6.0.2 to 6.0.3 by @dependabot[bot] in #6511
• build(deps): bump react-toastify from 11.0.5 to 11.1.0 by @dependabot[bot] in #6512
• build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by @dependabot[bot] in #6508
• build(deps): bump drf-spectacular-sidecar from 2026.4.1 to 2026.4.14 by @dependabot[bot] in #6507
• build(deps-dev): bump prettier from 3.8.2 to 3.8.3 by @dependabot[bot] in #6506
• build(deps): bump ruff from 0.15.10 to 0.15.11 by @dependabot[bot] in #6501
• build(deps): bump django-allauth from 65.16.0 to 65.16.1 by @dependabot[bot] in #6504
• build(deps): bump twilio from 9.10.4 to 9.10.5 by @dependabot[bot] in #6505
• build(deps): bump django-stubs from 6.0.2 to 6.0.3 in the typing-stubs group by @dependabot[bot] in #6500
• build(deps): bump the boto group with 2 updates by @dependabot[bot] in #6499
• build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 by @dependabot[bot] in #6497
• build(deps): bump dependabot/fetch-metadata from 3.0.0 to 3.1.0 by @dependabot[bot] in #6498
• build(deps): bump react-stately from 3.45.0 to 3.46.0 by @dependabot[bot] in #6509
• build(deps): bump the nextjs group across 1 directory with 4 updates by @dependabot[bot] in #6503

Full Changelog: 2026.04.28...2026.04.29

2026.04.28

What's Changed

User-facing changes

• MPP-4647 - fix(relay): return sorted masks from API by @vpremamozilla in #6493
• MPP-4654: bug(news) update expiration date on news for mask expansion by @vpremamozilla in #6495

Other changes

• MPP-4645: fix(e2e) workout fastly captcha by @vpremamozilla in #6469
• Add BLEnder config by @mozilla-blender[bot] in #6490
• refactor: remove BLEnder config and workflows by @groovecoder in #6491

Dependency updates

• build(deps): bump phonenumbers from 9.0.27 to 9.0.28 by @dependabot[bot] in #6487
• build(deps): bump mypy from 1.20.0 to 1.20.1 by @dependabot[bot] in #6486
• build(deps): bump ruff from 0.15.9 to 0.15.10 by @dependabot[bot] in #6484
• build(deps): bump django-allauth from 65.15.1 to 65.16.0 by @dependabot[bot] in #6485
• build(deps-dev): bump stylelint from 17.6.0 to 17.7.0 by @dependabot[bot] in #6483
• build(deps-dev): bump dotenv from 17.4.1 to 17.4.2 by @dependabot[bot] in #6482
• build(deps): bump @stripe/stripe-js from 9.1.0 to 9.2.0 by @dependabot[bot] in #6480
• build(deps): bump msw from 2.13.0 to 2.13.2 by @dependabot[bot] in #6479
• build(deps-dev): bump prettier from 3.8.1 to 3.8.2 by @dependabot[bot] in #6478
• build(deps): bump sentry-sdk from 2.57.0 to 2.58.0 by @dependabot[bot] in #6477
• build(deps): bump the boto group with 3 updates by @dependabot[bot] in #6472
• build(deps): bump types-requests from 2.33.0.20260402 to 2.33.0.20260408 in the typing-stubs group across 1 directory by @dependabot[bot] in #6474
• build(deps): bump the nextjs group across 1 directory with 3 updates by @dependabot[bot] in #6473
• build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in #6471
• build(deps-dev): bump stylelint-config-recommended-scss from 17.0.0 to 17.0.1 by @dependabot[bot] in #6481
• build(deps): bump actions/upload-pages-artifact from 4.0.0 to 5.0.0 by @dependabot[bot] in #6475

New Contributors

• @mozilla-blender[bot] made their first contribution in #6490

Full Changelog: 2026.04.22...2026.04.28

2026.04.22

What's Changed

User Facing Changes

• MPP-4592 - fix(welcome-email): update welcome email strings by @vpremamozilla in #6468

Other Changes

• build(github): update deploy-actions reference for moved repo by @joeherm in #6488

Full Changelog: 2026.04.16...2026.04.22

2026.04.16

What's Changed

User-facing changes

• MPP-4592 - fix(welcome-email): update welcome email design by @vpremamozilla in #6465

Other changes

• Mpp 4633/fix reply issue by @joeherm in #6467
• fix(blender): 3 fixes for the "fix dependabot" workflow by @groovecoder in #6457

Dependancy updates

• fix(deps): bump Django from 5.2.12 to 5.2.13 to address security advisories by @vpremamozilla in #6466
• build(deps-dev): bump next from 16.2.2 to 16.2.3 by @dependabot[bot] in #6442

Full Changelog: 2026.04.15...2026.04.16

2026.04.15

What's Changed

User-facing changes

None

Other changes

• feat(blender): add auto-merge workflow for safe Dependabot PRs by @groovecoder in #6437

Dependancy updates

• build(deps): bump cryptography from 46.0.6 to 46.0.7 by @dependabot[bot] in #6436
• build(deps): bump django-allauth from 65.15.0 to 65.15.1 by @dependabot[bot] in #6455
• build(deps): bump requests from 2.33.0 to 2.33.1 by @dependabot[bot] in #6453
• build(deps): bump sentry-sdk from 2.56.0 to 2.57.0 by @dependabot[bot] in #6454
• build(deps): bump ruff from 0.15.8 to 0.15.9 by @dependabot[bot] in #6452
• build(deps): bump django-debug-toolbar from 6.2.0 to 6.3.0 by @dependabot[bot] in #6451
• build(deps): bump drf-spectacular-sidecar from 2026.3.1 to 2026.4.1 by @dependabot[bot] in #6450
• build(deps): bump djangorestframework from 3.17.0 to 3.17.1 by @dependabot[bot] in #6449
• build(deps-dev): bump dotenv from 17.3.1 to 17.4.0 by @dependabot[bot] in #6448
• build(deps): bump @stripe/stripe-js from 9.0.0 to 9.0.1 by @dependabot[bot] in #6447
• build(deps): bump phonenumbers from 9.0.26 to 9.0.27 by @dependabot[bot] in #6444
• build(deps): bump the typing-stubs group with 3 updates by @dependabot[bot] in #6443
• build(deps): bump pyyaml from 6.0.2 to 6.0.3 in /.github/blender by @dependabot[bot] in #6438
• build(deps): bump actions/setup-node from 4.4.0 to 6.3.0 by @dependabot[bot] in #6440
• build(deps): bump packaging from 24.2 to 26.0 in /.github/blender by @dependabot[bot] in #6439
• build(deps): bump the boto group with 3 updates by @dependabot[bot] in #6441
• build(deps-dev): bump @playwright/test from 1.58.2 to 1.59.1 by @dependabot[bot] in #6446
• build(deps): bump mypy from 1.19.1 to 1.20.0 by @dependabot[bot] in #6464
• build(deps): bump jwcrypto from 1.5.6 to 1.5.7 by @dependabot[bot] in #6463
• build(deps-dev): bump sass from 1.98.0 to 1.99.0 by @dependabot[bot] in #6462
• build(deps): bump @stripe/stripe-js from 9.0.1 to 9.1.0 by @dependabot[bot] in #6461
• build(deps): bump msw from 2.12.14 to 2.13.0 by @dependabot[bot] in #6460
• build(deps-dev): bump dotenv from 17.4.0 to 17.4.1 by @dependabot[bot] in #6458
• build(deps): bump the boto group with 2 updates by @dependabot[bot] in #6459
• build(deps): bump the nextjs group with 4 updates by @dependabot[bot] in #6445

Full Changelog: 2026.04.08...2026.04.15