26.09

## What's Changed

### Security Fixes

**⚠️ This update contains important security fixes. Please upgrade as soon as possible**.

- Notes had the ability to read local files when viewed in the editor. (Thanks to @caleblee789 for the report)
- The "Open image" context menu action in the editor did not validate the file's extension, which allowed decks to execute dangerous files on some systems. (Thanks to @lappas-m for the report)

### Add-on Compatibility Note

The following legacy modules have been removed: `anki.importing` and `anki.exporting`. See the [docs](https://anki.mintlify.app/addons/the-anki-module) for alternatives.

_Some compatibility wrappers were added but they were only tested with AnkiConnect add-on and will be removed in the future._

### Notable Changes

- Fix audio playback in macOS 27 by @abdnh in https://github.com/ankitects/anki/pull/5363
- Fix audio not being played automatically when attached in the editor by @JaksonSouza in https://github.com/ankitects/anki/pull/5320
- Recompute FSRS data after changing deck by @user1823 in https://github.com/ankitects/anki/pull/5339
- Update FSRS to [6.6.2](https://github.com/open-spaced-repetition/fsrs-rs/releases/tag/v6.6.2) by @asukaminato0721 in https://github.com/ankitects/anki/pull/5494
- Improve performance of reviewer initialization by lazy-loading MathJax by @BrayanDSO and @iamllama in https://github.com/ankitects/anki/pull/5171
- Remove Python-based legacy importing/exporting handling by @chrislongros in https://github.com/ankitects/anki/pull/5153

### Other Fixes

- Fix HTML dropdowns/datepickers growing indefinitely with scaled UI on Windows by @abdnh in https://github.com/ankitects/anki/pull/5396
- Fix macOS/Linux crashes when the SIGPIPE signal is triggered (reported in some add-ons) by @abdnh in https://github.com/ankitects/anki/pull/5545
- Fix the deck selector in the Stats screen not refreshing graphs in some cases by @iamllama in https://github.com/ankitects/anki/pull/5486
- Disallow future dates in "Ignore cards reviewed before" by @Luc-Mcgrady in https://github.com/ankitects/anki/pull/5294
- Fix font size in the FSRS simulator graph by @Luc-Mcgrady in https://github.com/ankitects/anki/pull/5099
- Improve display of error messages in the CSV import screen by @MendezCarl in https://github.com/ankitects/anki/pull/5484
- Hide FSRS-only sort orders in filtered deck dialog when FSRS is disabled by @zaveshaa in https://github.com/ankitects/anki/pull/5407
- Refresh the reviewer toolbar's background after theme changes by @jamesliuai in https://github.com/ankitects/anki/pull/5241
- Add wrappers for the AnkiPackageImporter/AnkiPackageExporter APIs for compatibility with the AnkiConnect add-on by @abdnh in https://github.com/ankitects/anki/pull/5547
- Relax CSP restrictions to allow iframes in decks to load CSS styles by @twwn in https://github.com/ankitects/anki/pull/5525
- Update to Qt 6.11.2 by @abdnh in https://github.com/ankitects/anki/pull/5539
- Write logs to crash.log in the base Anki folder after crashes by @abdnh in https://github.com/ankitects/anki/pull/5546
- Fix audio copy & paste handling in the experimental editor by @iamllama in https://github.com/ankitects/anki/pull/5337
- Hide ease when FSRS is enabled but there is no memory state by @Luc-Mcgrady in https://github.com/ankitects/anki/pull/5277
- Improve error reporting for the Tools>Check for Updates feature by @abdnh in https://github.com/ankitects/anki/pull/5295
- Update FSRS memory state when card info opened by @Luc-Mcgrady in https://github.com/ankitects/anki/pull/5326
- Fix MSI install is blocked if uninstall.exe exists at a drive root by @abdnh in https://github.com/ankitects/anki/pull/5360
- Fix MathJax lazy loading causing flickering in some templates by @iamllama in https://github.com/ankitects/anki/pull/5254
- Fix Add/Edit screens not closing in the experimental editor on some systems by @iamllama in https://github.com/ankitects/anki/pull/5373
- Treat $ literally in non-regex find&replace replacements by @krMaynard in https://github.com/ankitects/anki/pull/5216
- Fix experimental editor not playing pasted/dropped audio by @abdnh in https://github.com/ankitects/anki/pull/5329
- Fix calendar graph year navigation buttons position in RTL layouts by @iDavi in https://github.com/ankitects/anki/pull/5103
- Mirror help icon for arabic script rtl langs by @iDavi in https://github.com/ankitects/anki/pull/5105
- Mirror toggle switches in RTL layouts by @iDavi in https://github.com/ankitects/anki/pull/5214
- Apply RTL direction for some languages such as Uyghur in webview pages by @abdnh in https://github.com/ankitects/anki/pull/5274
- Set webview font size to system font size in preferences menu by @GithubAnon0000 in https://github.com/ankitects/anki/pull/5174
- Preserve scroll position after collapsing/expanding decks by @abdnh in https://github.com/ankitects/anki/pull/5378
- Separate add-on entries in Tools menu with separator by @qais8r in https://github.com/ankitects/anki/pull/5124
- Rename Markdown deck description checkbox to be clearer by @zaveshaa in https://github.com/ankitects/anki/pull/5489
- Update redirected Browse Add-ons URL by @schmidhauser in https://github.com/ankitects/anki/pull/5290
- Add a plural form for the tags field label in the editor by @Arthur-Milchior in https://github.com/ankitects/anki/pull/5305
- Preserve pasted editor images and respect their format preference in the experimental editor by @praxish in https://github.com/ankitects/anki/pull/5568
- Prefer packaged add-on name for AnkiWeb installs by @schmidhauser in https://github.com/ankitects/anki/pull/5362
- Ensure editor is initialized before triggering browser hooks by @abdnh in https://github.com/ankitects/anki/pull/5348
- Avoid KeyError on missing Content-type header in mediasrv by @fernandolins in https://github.com/ankitects/anki/pull/5366
- Replace asserts inside except clauses with explicit error handling by @fernandolins in https://github.com/ankitects/anki/pull/5365
- Use 'Add Media' string for the title of the media file picker in the editor by @abdnh in https://github.com/ankitects/anki/pull/5402

### Documentation Changes

- Add a script to convert documentation in the old mdBook format for inclusion in the new Mintlify-based website by @Luc-Mcgrady in https://github.com/ankitects/anki/pull/5483
- Update Persian manual translation link by @MSadraShakouri in https://github.com/ankitects/anki/pull/5405
- Document the import_anki_package and export_anki_package APIs by @roostwp07 in https://github.com/ankitects/anki/pull/5328
- Add tip to disable "check on save" in Rust analyzer on low-end machines by @user1823 in https://github.com/ankitects/anki/pull/4489
- Clarify docs license by @abdnh in https://github.com/ankitects/anki/pull/5292
- Exclude docs contributions from BSD license check by @SzilvasiPeter in https://github.com/ankitects/anki/pull/5267
- Fix typos in https://github.com/ankitects/anki/pull/5158
- Sync post-migration manual updates by @MSadraShakouri in https://github.com/ankitects/anki/pull/5393
- Replace docs/ with symlinks by @Luc-Mcgrady in https://github.com/ankitects/anki/pull/5031
- Fix broken links in dev docs by @abdnh in https://github.com/ankitects/anki/pull/5410
- Clarify Windows x64 and ARM64 installation requirements by @praxish in https://github.com/ankitects/anki/pull/5582

### Development Changes

- Add unit testing guidelines by @fernandolins in https://github.com/ankitects/anki/pull/5522
- Reduce dependabot noise with quarterly schedule and major grouping by @fernandolins in https://github.com/ankitects/anki/pull/5280
- Document dependabot update process by @fernandolins in https://github.com/ankitects/anki/pull/5370
- Testing: Improve coverage of notes service by @abdnh in https://github.com/ankitects/anki/pull/5509
- Testing: Cover the decks service layer by @fernandolins in https://github.com/ankitects/anki/pull/5514
- Preserve FSRS unlock timeout across mounts by @caleblee789 in https://github.com/ankitects/anki/pull/5536
- Update browser compatibility database to fix CI failure by @abdnh in https://github.com/ankitects/anki/pull/5520
- Unhook AnkiWebView when destroyed by @iamllama in https://github.com/ankitects/anki/pull/5255
- Fix legacy editor's media buttons not using the legacy routines by @abdnh in https://github.com/ankitects/anki/pull/5330
- Update VS Code's settings.json by @abdnh in https://github.com/ankitects/anki/pull/5303
- Configure mypy extension for VS Code by @abdnh in https://github.com/ankitects/anki/pull/5317
- Add browse empty/error state i18n strings by @ianoff in https://github.com/ankitects/anki/pull/5263
- Set CARGO_TARGET_DIR for coverage-rust scripts by @abdnh in https://github.com/ankitects/anki/pull/5266
- Replace use of EmbarkStudios/cargo-deny-action by @iamllama in https://github.com/ankitects/anki/pull/5180
- Update Python test coverage threshold by @abdnh in https://github.com/ankitects/anki/pull/5299
- Replace prepare-release workflow with local script (closes #5273) by @roostwp07 in https://github.com/ankitects/anki/pull/5288
- Use cargo-nextest for Rust coverage tests (closes #5162) by @roostwp07 in https://github.com/ankitects/anki/pull/5169
- Add tests for FSRS simulator by @Luc-Mcgrady in https://github.com/ankitects/anki/pull/5150
- Add tests for fixing incorrect last review time entries by @Luc-Mcgrady in https://github.com/ankitects/anki/pull/5146
- Do not let ftl string copy/move land new strings in deprecated sections by @ianoff in https://github.com/ankitects/anki/pull/5332
- Add portability fixes for FreeBSD by @chrislongros in https://github.com/ankitects/anki/pull/5300
- Apply a consistent Cargo profile in CI by @abdnh in https://github.com/ankitects/anki/pull/5133
- Fix missing issue bot does not allow url in linked issues by @Luc-Mcgrady in https://github.com/ankitects/anki/pull/5287
- Move .github/scripts/*.py to tools/ by @abdnh in https://github.com/ankitects/anki/pull/5375
- Get linked issues using the GitHub API by @abdnh in https://github.com/ankitects/anki/pull/5381
- Update e2e testing docs by @abdnh in https://github.com/ankitects/anki/pull/5331
- Fix minilints exclusion for docs changes is not working by @abdnh in https://github.com/ankitects/anki/pull/5315
- Add `rust-analyzer` component to .rust-toolchain.toml by @abdnh in https://github.com/ankitects/anki/pull/5260
- Set `strict_optional = True` for editor_legacy.py by @abdnh in https://github.com/ankitects/anki/pull/5367
- Add missing dependencies to ninja's cog actions by @abdnh in https://github.com/ankitects/anki/pull/5341
- Evaluate SonarCloud as a code quality and coverage tool by @fernandolins in https://github.com/ankitects/anki/pull/4996
- Only attach handler to add-on's root logger to fix Windows permission errors by @danny900714 in https://github.com/ankitects/anki/pull/5497
- Remove RELEASE_TOKEN GHA secret by @abdnh in https://github.com/ankitects/anki/pull/5372
- Avoid setting default isLegacy in the editor by @abdnh in https://github.com/ankitects/anki/pull/5403
- Improve test coverage of notes.py and tags.py by @abdnh in https://github.com/ankitects/anki/pull/5412
- Prevent silent skip of PR coverage-regression check on evicted baseline by @fernandolins in https://github.com/ankitects/anki/pull/5480
- Correct paginate mapFn in prune-coverage-cache workflow by @fernandolins in https://github.com/ankitects/anki/pull/5504
- Document the `anki-audio` package by @abdnh in https://github.com/ankitects/anki/pull/5411
- Docs: Revert "add redirect to english for missing translations" by @Luc-Mcgrady in https://github.com/ankitects/anki/pull/5559
- Fix flaky MathJax loading test by @iamllama in https://github.com/ankitects/anki/pull/5560
- Bump rust toolchain to 1.97.1 by @iamllama in https://github.com/ankitects/anki/pull/5316
- Bump the actions group across 1 directory with 14 updates by @dependabot[bot] in https://github.com/ankitects/anki/pull/5272
- Bump vitest from 3.2.4 to 3.2.6 by @dependabot[bot] in https://github.com/ankitects/anki/pull/4973
- Bump tar from 7.5.7 to 7.5.22 by @dependabot[bot] in https://github.com/ankitects/anki/pull/5239
- Drop vulnerable h2 0.3.x, update h2 to 0.4.17 (RUSTSEC-2026-0258) by @fernandolins in https://github.com/ankitects/anki/pull/5376
- Bump the python-minor-patch group across 1 directory with 14 updates by @dependabot[bot] in https://github.com/ankitects/anki/pull/5310
- Bump the actions group with 3 updates by @dependabot[bot] in https://github.com/ankitects/anki/pull/5311
- Bump anki-audio to 0.2.3 by @abdnh in https://github.com/ankitects/anki/pull/5409
- Bump esbuild from 0.28.0 to 0.28.1 by @dependabot[bot] in https://github.com/ankitects/anki/pull/5008
- Bump vite from 6.4.2 to 6.4.3 by @dependabot[bot] in https://github.com/ankitects/anki/pull/5026
- Bump pip from 26.1 to 26.1.2 by @dependabot[bot] in https://github.com/ankitects/anki/pull/5132
- Bump brace-expansion from 1.1.12 to 1.1.16 by @dependabot[bot] in https://github.com/ankitects/anki/pull/5179
- Bump immutable from 5.1.5 to 5.1.9 by @dependabot[bot] in https://github.com/ankitects/anki/pull/5191
- Bump svgo from 3.3.3 to 3.3.4 by @dependabot[bot] in https://github.com/ankitects/anki/pull/5195
- Bump form-data from 4.0.4 to 4.0.6 by @dependabot[bot] in https://github.com/ankitects/anki/pull/5200
- Bump quinn-proto from 0.11.14 to 0.11.16 by @dependabot[bot] in https://github.com/ankitects/anki/pull/5221
- Bump ws from 8.20.1 to 8.21.0 by @dependabot[bot] in https://github.com/ankitects/anki/pull/5027
- Bump gitpython from 3.1.49 to 3.1.57 by @dependabot[bot] in https://github.com/ankitects/anki/pull/5268
- Bump postcss from 8.5.10 to 8.5.24 by @dependabot[bot] in https://github.com/ankitects/anki/pull/5271
- Bump urllib3 from 2.6.3 to 2.7.0 by @dependabot[bot] in https://github.com/ankitects/anki/pull/4989
- Bump soupsieve from 2.7 to 2.8.4 by @dependabot[bot] in https://github.com/ankitects/anki/pull/5139
- Bump starlette from 1.0.0 to 1.3.1 by @dependabot[bot] in https://github.com/ankitects/anki/pull/5194
- Bump the npm-minor-patch group across 1 directory with 13 updates by @dependabot[bot] in https://github.com/ankitects/anki/pull/5309
- Bump brace-expansion from 1.1.16 to 1.1.18 by @dependabot[bot] in https://github.com/ankitects/anki/pull/5479
- Bump browserslist from 4.24.2 to 4.28.8 by @dependabot[bot] in https://github.com/ankitects/anki/pull/5508

## New Contributors

- @qais8r made their first contribution in https://github.com/ankitects/anki/pull/5124
- @schmidhauser made their first contribution in https://github.com/ankitects/anki/pull/5290
- @SzilvasiPeter made their first contribution in https://github.com/ankitects/anki/pull/5267
- @JaksonSouza made their first contribution in https://github.com/ankitects/anki/pull/5320
- @MSadraShakouri made their first contribution in https://github.com/ankitects/anki/pull/5405
- @danny900714 made their first contribution in https://github.com/ankitects/anki/pull/5497
- @MendezCarl made their first contribution in https://github.com/ankitects/anki/pull/5484
- @zaveshaa made their first contribution in https://github.com/ankitects/anki/pull/5407
- @jamesliuai made their first contribution in https://github.com/ankitects/anki/pull/5241
- @caleblee789 made their first contribution in https://github.com/ankitects/anki/pull/5536
- @praxish made their first contribution in https://github.com/ankitects/anki/pull/5582

**Full Changelog**: https://github.com/ankitects/anki/compare/26.08.1...26.09