# What changed in wlc

> 24 changes in wlc 1 to 3 from its official release notes, upgrade guides and advisories: 8 breaking, 8 security. Each one cited. Sources checked 2026-10-29. HTML: https://unstale.sh/pypi/wlc/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## wlc 3

### Breaking changes

- Object paths are constrained to the selected API collection, and traversal and URL syntax are rejected. (3.1.0) — [release notes](https://github.com/WeblateOrg/wlc/releases/tag/3.1.0)
- API model objects now inherit from UserDict rather than being dict instances; use get_data() or dict(obj.items()) when a plain dictionary is required. (3.0.0) — [release notes](https://github.com/WeblateOrg/wlc/releases/tag/3.0.0)
- Cyclic category hierarchies and category nesting deeper than three levels are now rejected. (3.0.0) — [release notes](https://github.com/WeblateOrg/wlc/releases/tag/3.0.0)
- Client construction, request options, project and language creation, source string creation, upload and download options, throttling error construction, and CLI entry point options now require keyword arguments. (3.0.0) — [release notes](https://github.com/WeblateOrg/wlc/releases/tag/3.0.0)
- Minimum dependency versions were raised to exclude vulnerable releases. (3.0.0) — [release notes](https://github.com/WeblateOrg/wlc/releases/tag/3.0.0)
- Returns a pathlib.Path instead of a string when a file is found. (3.0.0) — [release notes](https://github.com/WeblateOrg/wlc/releases/tag/3.0.0)
- Returns a pathlib.Path instead of a string when a file is found. (3.0.0) — [release notes](https://github.com/WeblateOrg/wlc/releases/tag/3.0.0)

### Security

- The CA certificate bundle was updated. (3.1.0) — [release notes](https://github.com/WeblateOrg/wlc/releases/tag/3.1.0)
- CSV formula prefixes hidden behind leading vertical tabs or form feeds are neutralized. (3.1.0) — [release notes](https://github.com/WeblateOrg/wlc/releases/tag/3.1.0)
- Configured API keys are masked in handled CLI errors. (3.1.0) — [release notes](https://github.com/WeblateOrg/wlc/releases/tag/3.1.0)

### Performance

- Listings stream in all output formats to reduce memory use; later failures can leave partial output, so check the command's exit status before treating it as complete. (3.1.0) — [release notes](https://github.com/WeblateOrg/wlc/releases/tag/3.1.0)

### Fixes and other changes

- Missing or empty pagination links are handled, and malformed link values are rejected. (3.1.0) — [release notes](https://github.com/WeblateOrg/wlc/releases/tag/3.1.0)
- Malformed server timestamps are reported safely. (3.1.0) — [release notes](https://github.com/WeblateOrg/wlc/releases/tag/3.1.0)
- Unicode display controls are escaped on terminals. (3.1.0) — [release notes](https://github.com/WeblateOrg/wlc/releases/tag/3.1.0)

## wlc 2

### Breaking changes

- CLI request errors no longer expose API keys, and API keys containing line breaks are rejected. (2.2.1) — [release notes](https://github.com/WeblateOrg/wlc/releases/tag/2.2.1)

### Security

- wlc may disclose API tokens to project-configured URLs (2.0.1) — [security advisory](https://github.com/advisories/GHSA-3MQQ-HV9C-85HC)
- wlc: print_html outputs API data without HTML escaping (2.0.0) — [security advisory](https://github.com/advisories/GHSA-GX2M-MCC2-R4P3)

### Fixes and other changes

- Component download output paths are validated before data is fetched. (2.2.1) — [release notes](https://github.com/WeblateOrg/wlc/releases/tag/2.2.1)
- Fixed component downloads when a slug contains repository. (2.2.1) — [release notes](https://github.com/WeblateOrg/wlc/releases/tag/2.2.1)
- Local filesystem failures are reported as CLI errors. (2.2.1) — [release notes](https://github.com/WeblateOrg/wlc/releases/tag/2.2.1)
- An already resolved component is no longer relisted. (2.2.1) — [release notes](https://github.com/WeblateOrg/wlc/releases/tag/2.2.1)

## wlc 1

### Security

- Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command (1.17.2) — [security advisory](https://github.com/advisories/GHSA-MMWX-79F6-67JG)
- Weblate command-line client susceptible to SSL verification skip (1.17.0) — [security advisory](https://github.com/advisories/GHSA-2MMV-7RRP-G8XH)
- Weblate wlc has insecure API key configuration (1.17.0) — [security advisory](https://github.com/advisories/GHSA-9RP8-H4G8-8766)