What's Changed

User Facing Changes

• MPP-4592 - fix(welcome-email): update welcome email strings by @vpremamozilla in #6468

Other Changes

• build(github): update deploy-actions reference for moved repo by @joeherm in #6488

Full Changelog: 2026.04.16...2026.04.22

What's Changed

User-facing changes

• MPP-4592 - fix(welcome-email): update welcome email design by @vpremamozilla in #6465

Other changes

• Mpp 4633/fix reply issue by @joeherm in #6467
• fix(blender): 3 fixes for the "fix dependabot" workflow by @groovecoder in #6457

Dependancy updates

• fix(deps): bump Django from 5.2.12 to 5.2.13 to address security advisories by @vpremamozilla in #6466
• build(deps-dev): bump next from 16.2.2 to 16.2.3 by @dependabot[bot] in #6442

Full Changelog: 2026.04.15...2026.04.16

What's Changed

User-facing changes

None

Other changes

• feat(blender): add auto-merge workflow for safe Dependabot PRs by @groovecoder in #6437

Dependancy updates

• build(deps): bump cryptography from 46.0.6 to 46.0.7 by @dependabot[bot] in #6436
• build(deps): bump django-allauth from 65.15.0 to 65.15.1 by @dependabot[bot] in #6455
• build(deps): bump requests from 2.33.0 to 2.33.1 by @dependabot[bot] in #6453
• build(deps): bump sentry-sdk from 2.56.0 to 2.57.0 by @dependabot[bot] in #6454
• build(deps): bump ruff from 0.15.8 to 0.15.9 by @dependabot[bot] in #6452
• build(deps): bump django-debug-toolbar from 6.2.0 to 6.3.0 by @dependabot[bot] in #6451
• build(deps): bump drf-spectacular-sidecar from 2026.3.1 to 2026.4.1 by @dependabot[bot] in #6450
• build(deps): bump djangorestframework from 3.17.0 to 3.17.1 by @dependabot[bot] in #6449
• build(deps-dev): bump dotenv from 17.3.1 to 17.4.0 by @dependabot[bot] in #6448
• build(deps): bump @stripe/stripe-js from 9.0.0 to 9.0.1 by @dependabot[bot] in #6447
• build(deps): bump phonenumbers from 9.0.26 to 9.0.27 by @dependabot[bot] in #6444
• build(deps): bump the typing-stubs group with 3 updates by @dependabot[bot] in #6443
• build(deps): bump pyyaml from 6.0.2 to 6.0.3 in /.github/blender by @dependabot[bot] in #6438
• build(deps): bump actions/setup-node from 4.4.0 to 6.3.0 by @dependabot[bot] in #6440
• build(deps): bump packaging from 24.2 to 26.0 in /.github/blender by @dependabot[bot] in #6439
• build(deps): bump the boto group with 3 updates by @dependabot[bot] in #6441
• build(deps-dev): bump @playwright/test from 1.58.2 to 1.59.1 by @dependabot[bot] in #6446
• build(deps): bump mypy from 1.19.1 to 1.20.0 by @dependabot[bot] in #6464
• build(deps): bump jwcrypto from 1.5.6 to 1.5.7 by @dependabot[bot] in #6463
• build(deps-dev): bump sass from 1.98.0 to 1.99.0 by @dependabot[bot] in #6462
• build(deps): bump @stripe/stripe-js from 9.0.1 to 9.1.0 by @dependabot[bot] in #6461
• build(deps): bump msw from 2.12.14 to 2.13.0 by @dependabot[bot] in #6460
• build(deps-dev): bump dotenv from 17.4.0 to 17.4.1 by @dependabot[bot] in #6458
• build(deps): bump the boto group with 2 updates by @dependabot[bot] in #6459
• build(deps): bump the nextjs group with 4 updates by @dependabot[bot] in #6445

Full Changelog: 2026.04.08...2026.04.15

What's Changed

User-facing changes

None

Other changes

• MPP-4626: feat(blender): add CI auto-fix for Dependabot PRs by @groovecoder in #6421
• fix(blender): separate commit step, verified commits, and commit messages by @groovecoder in #6435

Dependency updates

• build(deps): bump twilio from 9.10.3 to 9.10.4 by @dependabot[bot] in #6434
• build(deps): bump gunicorn from 25.1.0 to 25.3.0 by @dependabot[bot] in #6433
• build(deps): bump sentry-sdk from 2.55.0 to 2.56.0 by @dependabot[bot] in #6432
• build(deps): bump ruff from 0.15.7 to 0.15.8 by @dependabot[bot] in #6431
• build(deps): bump actions/deploy-pages from 4.0.5 to 5.0.0 by @dependabot[bot] in #6430
• build(deps): bump dependabot/fetch-metadata from 2.5.0 to 3.0.0 by @dependabot[bot] in #6429
• build(deps): bump github/codeql-action from 4.32.5 to 4.35.1 by @dependabot[bot] in #6428
• build(deps-dev): bump stylelint from 17.5.0 to 17.6.0 by @dependabot[bot] in #6427
• build(deps): bump types-requests from 2.32.4.20260107 to 2.33.0.20260327 in the typing-stubs group by @dependabot[bot] in #6425
• build(deps): bump model-bakery from 1.23.3 to 1.23.4 in the testing-libraries group by @dependabot[bot] in #6424
• build(deps): bump @stripe/stripe-js from 8.11.0 to 9.0.0 by @dependabot[bot] in #6423
• build(deps): bump the boto group with 2 updates by @dependabot[bot] in #6422
• build(deps-dev): bump typescript from 5.9.3 to 6.0.2 by @dependabot[bot] in #6426
• build(deps): bump djangorestframework from 3.16.1 to 3.17.0 by @dependabot[bot] in #6418

Full Changelog: 2026.04.01...2026.04.08

What's Changed

User-facing changes

None

Other changes

None

Dependency updates

• build(deps): bump cryptography from 46.0.5 to 46.0.6 by @dependabot[bot] in #6407
• build(deps): bump sentry-sdk from 2.54.0 to 2.55.0 by @dependabot[bot] in #6419
• build(deps): bump ruff from 0.15.6 to 0.15.7 by @dependabot[bot] in #6417
• build(deps-dev): bump stylelint from 17.4.0 to 17.5.0 by @dependabot[bot] in #6416
• build(deps): bump msw from 2.12.10 to 2.12.14 by @dependabot[bot] in #6415
• build(deps): bump @stripe/stripe-js from 8.9.0 to 8.11.0 by @dependabot[bot] in #6414
• build(deps): bump django-stubs from 5.2.9 to 6.0.1 in the typing-stubs group by @dependabot[bot] in #6412
• build(deps): bump the testing-libraries group with 2 updates by @dependabot[bot] in #6411
• build(deps): bump the boto group with 2 updates by @dependabot[bot] in #6410
• build(deps): bump actions/setup-node from 6.2.0 to 6.3.0 by @dependabot[bot] in #6409
• build(deps): bump the nextjs group across 1 directory with 4 updates by @dependabot[bot] in #6413

Full Changelog: 2026.03.25.3...2026.04.01

What's Changed

User-facing changes

• fix MPP-4613: feat(emails): update free user welcome email copy with dynamic mask limit by @groovecoder in #6400
• fix MPP-4615: fix(news): remove mask expansion CTA by @groovecoder in #6405

Other changes

• fix(e2e): replace recursive UI mask cleanup with parallel API deletes by @groovecoder in #6387
• Zizmor auto fixes by @groovecoder in #6364
• MPP-4613: fix(emails): bust template cache for updated welcome email by @groovecoder in #6402
• MPP-4622: fix(l10n): rename welcome email HTML string IDs to end with -html by @groovecoder in #6406

Dependency updates

• build(deps): bump phonenumbers from 9.0.25 to 9.0.26 by @dependabot[bot] in #6396
• build(deps): bump ruff from 0.15.5 to 0.15.6 by @dependabot[bot] in #6397
• build(deps): bump twilio from 9.10.2 to 9.10.3 by @dependabot[bot] in #6398
• build(deps): bump pyjwt from 2.12.0 to 2.12.1 by @dependabot[bot] in #6399
• build(deps): bump the boto group with 3 updates by @dependabot[bot] in #6391
• build(deps): bump django-allauth[socialaccount] from 65.14.3 to 65.15.0 by @dependabot[bot] in #6393
• build(deps): bump slackapi/slack-github-action from 2.1.1 to 3.0.1 by @dependabot[bot] in #6390
• build(deps-dev): bump flatted from 3.3.3 to 3.4.2 by @groovecoder in #6389
• build(deps-dev): bump sass from 1.97.3 to 1.98.0 by @dependabot[bot] in #6394
• build(deps-dev): bump lint-staged from 16.3.2 to 16.4.0 by @dependabot[bot] in #6395
• build(deps-dev): bump the jest group with 3 updates by @dependabot[bot] in #6392
• chore(npm): update picomatch versions by @groovecoder in #6403
• build(deps): bump requests from 2.32.5 to 2.33.0 by @dependabot[bot] in #6404

Full Changelog: 2026.03.19...2026.03.25.3

What's Changed

User-facing changes

• fix MPP-4613: feat(emails): update free user welcome email copy with dynamic mask limit by @groovecoder in #6400
• fix MPP-4615: fix(news): remove mask expansion CTA by @groovecoder in #6405

Other changes

• fix(e2e): replace recursive UI mask cleanup with parallel API deletes by @groovecoder in #6387
• Zizmor auto fixes by @groovecoder in #6364
• MPP-4613: fix(emails): bust template cache for updated welcome email by @groovecoder in #6402

Dependency updates

• build(deps): bump phonenumbers from 9.0.25 to 9.0.26 by @dependabot[bot] in #6396
• build(deps): bump ruff from 0.15.5 to 0.15.6 by @dependabot[bot] in #6397
• build(deps): bump twilio from 9.10.2 to 9.10.3 by @dependabot[bot] in #6398
• build(deps): bump pyjwt from 2.12.0 to 2.12.1 by @dependabot[bot] in #6399
• build(deps): bump the boto group with 3 updates by @dependabot[bot] in #6391
• build(deps): bump django-allauth[socialaccount] from 65.14.3 to 65.15.0 by @dependabot[bot] in #6393
• build(deps): bump slackapi/slack-github-action from 2.1.1 to 3.0.1 by @dependabot[bot] in #6390
• build(deps-dev): bump flatted from 3.3.3 to 3.4.2 by @groovecoder in #6389
• build(deps-dev): bump sass from 1.97.3 to 1.98.0 by @dependabot[bot] in #6394
• build(deps-dev): bump lint-staged from 16.3.2 to 16.4.0 by @dependabot[bot] in #6395
• build(deps-dev): bump the jest group with 3 updates by @dependabot[bot] in #6392
• chore(npm): update picomatch versions by @groovecoder in #6403
• build(deps): bump requests from 2.32.5 to 2.33.0 by @dependabot[bot] in #6404

Full Changelog: 2026.03.19...2026.03.25.2

What's Changed

User-facing changes

• fix MPP-4613: feat(emails): update free user welcome email copy with dynamic mask limit by @groovecoder in #6400

Other changes

• fix(e2e): replace recursive UI mask cleanup with parallel API deletes by @groovecoder in #6387
• Zizmor auto fixes by @groovecoder in #6364

Dependency updates

• build(deps): bump phonenumbers from 9.0.25 to 9.0.26 by @dependabot[bot] in #6396
• build(deps): bump ruff from 0.15.5 to 0.15.6 by @dependabot[bot] in #6397
• build(deps): bump twilio from 9.10.2 to 9.10.3 by @dependabot[bot] in #6398
• build(deps): bump pyjwt from 2.12.0 to 2.12.1 by @dependabot[bot] in #6399
• build(deps): bump the boto group with 3 updates by @dependabot[bot] in #6391
• build(deps): bump django-allauth[socialaccount] from 65.14.3 to 65.15.0 by @dependabot[bot] in #6393
• build(deps): bump slackapi/slack-github-action from 2.1.1 to 3.0.1 by @dependabot[bot] in #6390
• build(deps-dev): bump flatted from 3.3.3 to 3.4.2 by @groovecoder in #6389
• build(deps-dev): bump sass from 1.97.3 to 1.98.0 by @dependabot[bot] in #6394
• build(deps-dev): bump lint-staged from 16.3.2 to 16.4.0 by @dependabot[bot] in #6395
• build(deps-dev): bump the jest group with 3 updates by @dependabot[bot] in #6392

Full Changelog: 2026.03.19...2026.03.25.1

What's Changed

User-facing changes

• MPP-4612: feat(pricing-matrix) update mask limit value by @vpremamozilla in #6384
• MPP-4595 - feat(desktop): add News popup for email expansion by @vpremamozilla in #6370
• chore: Merge in latest l10n strings by @mozilla-pontoon in #6368
• chore: Merge in latest l10n strings by @mozilla-pontoon in #6372
• chore: Merge in latest l10n strings by @mozilla-pontoon in #6383
• chore: Merge in latest l10n strings by @mozilla-pontoon in #6386
• chore: Merge in latest l10n strings by @mozilla-pontoon in #6388

Other changes

None

Dependency updates

• build(deps): bump drf-spectacular-sidecar from 2026.1.1 to 2026.3.1 by @dependabot[bot] in #6382
• build(deps): bump ruff from 0.15.4 to 0.15.5 by @dependabot[bot] in #6381
• docs: add kubectl instructions for running manage.py on stage/prod by @groovecoder in #6369
• build(deps): bump black from 26.1.0 to 26.3.0 by @dependabot[bot] in #6380
• build(deps): bump dockerflow from 2026.1.26 to 2026.3.4 by @dependabot[bot] in #6379
• build(deps): bump sentry-sdk from 2.53.0 to 2.54.0 by @dependabot[bot] in #6378
• build(deps): bump @stripe/stripe-js from 8.8.0 to 8.9.0 by @dependabot[bot] in #6376
• build(deps): bump react-aria from 3.46.0 to 3.47.0 by @dependabot[bot] in #6375
• build(deps-dev): bump lint-staged from 16.3.0 to 16.3.2 by @dependabot[bot] in #6377
• build(deps): bump react-stately from 3.44.0 to 3.45.0 by @dependabot[bot] in #6374
• build(deps): bump the boto group with 2 updates by @dependabot[bot] in #6373
• build(deps): bump black from 26.1.0 to 26.3.1 by @dependabot[bot] in #6366
• build(deps): bump pyjwt from 2.11.0 to 2.12.0 by @dependabot[bot] in #6371
• build(deps-dev): bump next from 16.1.6 to 16.1.7 by @dependabot[bot] in #6385

Full Changelog: 2026.03.11...2026.03.19

What's Changed

User-facing changes

• chore: Merge in latest l10n strings by @mozilla-pontoon in #6350
• chore: Merge in latest l10n strings by @mozilla-pontoon in #6362
• chore: Merge in latest l10n strings by @mozilla-pontoon in #6365
• MPP-4563: feat(dashboard): enable alias category filters for free users by @vpremamozilla in #6361
• MPP-4574 - update mask-limit strings to 50 and use config value by @vpremamozilla in #6360

Other changes

None

Dependency updates

• fix(Django): update Django to 5.2.12 by @groovecoder in #6349
• build(deps): bump swr from 2.4.0 to 2.4.1 by @dependabot[bot] in #6354
• build(deps): bump ruff from 0.15.2 to 0.15.4 by @dependabot[bot] in #6356
• build(deps): bump phonenumbers from 9.0.24 to 9.0.25 by @dependabot[bot] in #6359
• build(deps-dev): bump stylelint from 17.3.0 to 17.4.0 by @dependabot[bot] in #6352
• build(deps-dev): bump lint-staged from 16.2.7 to 16.3.0 by @dependabot[bot] in #6353
• build(deps): bump whitenoise from 6.11.0 to 6.12.0 by @dependabot[bot] in #6358
• build(deps): bump the boto group with 2 updates by @dependabot[bot] in #6351
• build(deps): bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #6355
• build(deps): bump glean-parser from 18.2.0 to 19.0.0 by @dependabot[bot] in #6357
• fix(npm): updates via npm audit fix by @groovecoder in #6363

Full Changelog: 2026.03.04...2026.03.11