Wagtail

Latest version: v6.4.1

Safety actively analyzes 723685 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 14 of 34

2.14.1

Not secure
~~~~~~~~~~~~~~~~~~~

* Fix: Prevent failure on Twitter embeds and others which return cache_age as a string (Matt Westcott)
* Fix: Fix Uncaught ReferenceError when editing links in Hallo (Cynthia Kiser)

2.14

Not secure
~~~~~~~~~~~~~~~~~

* Removed support for Django 2.2
* Added `ancestor_of` API filter (Jaap Roes)
* Added support for customizing group management views (Jan Seifert)
* Added `full_url` property to image renditions (Shreyash Srivastava)
* Added locale selector when choosing translatable snippets (Karl Hobley)
* Added `WAGTAIL_WORKFLOW_ENABLED` setting for enabling / disabling moderation workflows globally (Matt Westcott)
* Allow specifying `max_width` and `max_height` on EmbedBlock (Petr Dlouhý)
* Add warning when StreamField is used without a StreamFieldPanel (Naomi Morduch Toubman)
* Added keyboard and screen reader support to Wagtail user bar (LB Johnston, Storm Heg)
* Add Google Data Studio to the list of oEmbed providers (Petr Dlouhý)
* Added instructions on copying and aliasing pages to the editor's guide in documentation (Vlad Podgurschi)
* Allow ListBlock to raise validation errors that are not attached to an individual child block (Matt Westcott)
* Use `DATETIME_FORMAT` for localization in templates (Andrew Stone)
* Added documentation on multi-site, multi-instance and multi-tenancy setups (Coen Van Der Kamp)
* Updated Facebook / Instagram oEmbed endpoints to v11.0 (Thomas Kremmel)
* Performance improvements for admin listing pages (Jake Howard, Dan Braghis, Tom Usher)
* Fix: Invalid filter values for foreign key fields in the API now give an error instead of crashing (Tidiane Dia)
* Fix: Ordering specified in `construct_explorer_page_queryset` hook is now taken into account again by the page explorer API (Andre Fonseca)
* Fix: Deleting a page from its listing view no longer results in a 404 error (Tidiane Dia)
* Fix: The Wagtail admin urls will now respect the `APPEND_SLASH` setting (Tidiane Dia)
* Fix: Prevent “Forgotten password” link from overlapping with field on mobile devices (Helen Chapman)
* Fix: Snippet admin urls are now namespaced to avoid ambiguity with the primary key component of the url (Matt Westcott)
* Fix: Save order of promoted search results (Hardcodd)
* Fix: Prevent error on copying pages with ClusterTaggableManager relations and multi-level inheritance (Chris Pollard)
* Fix: Prevent failure on root page when registering the Page model with ModelAdmin (Jake Howard)
* Fix: Prevent error when filtering page search results with a malformed content_type (Chris Pollard)
* Fix: Prevent multiple submissions of "update" form when uploading images / documents (Mike Brown)
* Fix: Ensure HTML title is populated on project template 404 page (Matt Westcott)
* Fix: Respect cache_age parameters on embeds (Gordon Pendleton)
* Fix: Page comparison view now reflects request-level customizations to edit handlers (Matt Westcott)
* Fix: Add `block.super` to remaining `extra_js` & `extra_css` blocks (Andrew Stone)
* Fix: Ensure that `editor` and `features` arguments on RichTextField are preserved by `clone()` (Daniel Fairhead)
* Fix: Rename 'spin' CSS animation to avoid clashes with other libraries (Kevin Gutiérrez)
* Fix: Prevent crash when copying a page from a section where the user has no publish permission (Karl Hobley)
* Fix: Ensure that rich text conversion correctly handles images / embeds inside links or inline styles (Matt Westcott)

2.13.5

Not secure
~~~~~~~~~~~~~~~~~~~

* Fix: Allow relation name used for admin commenting to be overridden to avoid conflicts with third-party commenting apps (Matt Westcott)
* Fix: Corrected badly-formed format strings in translations (Matt Westcott)
* Fix: Correctly handle non-numeric user IDs for deleted users in reports (Dan Braghis)

2.13.4

Not secure
~~~~~~~~~~~~~~~~~~~

* Fix: Prevent embed thumbnail_url migration from failing on URLs longer than 200 characters (Matt Westcott)

2.13.3

Not secure
~~~~~~~~~~~~~~~~~~~

* Fix: Prevent error when using rich text on views where commenting is unavailable (Jacob Topp-Mugglestone)
* Fix: Include form media on account settings page (Matt Westcott)
* Fix: Avoid error when rendering validation error messages on ListBlock children (Matt Westcott)
* Fix: Prevent comments CSS from overriding admin UI color customizations (Matt Westcott)
* Fix: Avoid validation error when editing rich text content preceding a comment (Jacob Topp-Mugglestone)

2.13.2

Not secure
~~~~~~~~~~~~~~~~~~~

* Fix: CVE-2021-32681 - fix improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks (Karen Tracey, Matt Westcott)

Page 14 of 34

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.