Wagtail

Latest version: v6.4.1

Safety actively analyzes 723882 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 15 of 34

2.13.1

Not secure
~~~~~~~~~~~~~~~~~~~

* Fix: Ensure comment notification checkbox is fully hidden when commenting is disabled (Karl Hobley)
* Fix: Prevent commenting from failing for user models with UUID primary keys (Jacob Topp-Mugglestone)
* Fix: Fix incorrect link in comment notification HTML email (Matt Westcott)

2.13

Not secure
~~~~~~~~~~~~~~~~~

* New StreamField implementation with performance and functionality improvements (Matt Westcott, Karl Hobley)
* Added a simple translation module into `wagtail.contrib.simple_translation` (Coen van der Kamp)
* Combined account settings into a single form (Karl Hobley)
* Add support for exporting redirects (Martin Sandström)
* The documentation now uses Sphinx Wagtail Theme https://github.com/wagtail/sphinx_wagtail_theme (Storm Heg, Tibor Leupold, Thibaud Colas and Coen van der Kamp).
* Add support for Django 3.2
* Support passing `min_num`, `max_num` and `block_counts` arguments directly to `StreamField` (Haydn Greatnews, Matt Westcott)
* Add the option to set rich text images as decorative, without alt text (Helen Chapman, Thibaud Colas)
* Add support for `__year` lookup in Elasticsearch queries (Seb Brown)
* Support passing multiple models as arguments to `type()`, `not_type()`, `exact_type()` and `not_exact_type()` methods on `PageQuerySet` (Andy Babic)
* Update default attribute copying behaviour of `Page.get_specific()` and added the `copy_attrs_exclude` option (Andy Babic)
* Update `PageQueryset.specific(defer=True)` to only perform a single database query (Andy Babic)
* Add `PageQueryset.defer_streamfields()` (Andy Babic)
* Utilize `PageQuerySet.defer_streamfields()` to improve efficiency in a few key places (Andy Babic)
* Switch ``register_setting``, ``register_settings_menu_item`` to use SVG icons (Thibaud Colas)
* Add support to SVG icons for ``SearchArea`` subclasses in ``register_admin_search_area`` (Thibaud Colas)
* Add `wagtail.reorder` page audit log action (Storm Heg)
* `get_settings` template tag now supports specifying the variable name with `{% get_settings as var %}` (Samir Shah)
* Reinstate submitter's name on moderation notification email (Matt Westcott)
* Add a new switch input widget as an alternative to checkboxes (Karl Hobley)
* Allow `{% pageurl %}` fallback to be a direct URL or an object with a `get_absolute_url` method (Andy Babic)
* Support slicing on StreamField / StreamBlock values (Matt Westcott)
* Switch Wagtail choosers to use SVG icons instead of font icon (Storm Heg)
* Save revision when restart workflow (Ihor Marhitych)
* Add a visible indicator of unsaved changes to the page editor (Jacob Topp-Mugglestone)
* Fix: StreamField required status is now consistently handled by the `blank` keyword argument (Matt Westcott)
* Fix: Show 'required' asterisks for blocks inside required StreamFields (Matt Westcott)
* Fix: Make image chooser "Select format" fields translatable (Helen Chapman, Thibaud Colas)
* Fix: Move labels above the form field in the image format chooser, to avoid styling issues at tablet size (Helen Chapman)
* Fix: `{% include_block with context %}` now passes local variables into the block template (Jonny Scholes)
* Fix: Fix pagination on 'view users in a group' (Sagar Agarwal)
* Fix: Prevent page privacy menu from being triggered by pressing enter on a char field (Sagar Agarwal)
* Fix: Validate host/scheme of return URLs on password authentication forms (Susan Dreher)
* Fix: Reordering a page now includes the correct user in the audit log (Storm Heg)
* Fix: Reverse migration errors in images and documents (Mike Brown)
* Fix: Apply enough chevron padding to all applicable select elements (Scott Cranfill)
* Fix: Reduce database queries in the page edit view (Ihor Marhitych)

2.12.6

Not secure
~~~~~~~~~~~~~~~~~~~

* Fix: Prevent embed thumbnail_url migration from failing on URLs longer than 200 characters (Matt Westcott)

2.12.5

Not secure
~~~~~~~~~~~~~~~~~~~

* Fix: CVE-2021-32681 - fix improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks (Karen Tracey, Matt Westcott)

2.12.4

Not secure
~~~~~~~~~~~~~~~~~~~

* Fix: CVE-2021-29434 - fix improper validation of URLs ('Cross-site Scripting') in rich text fields (Kevin Breen, Matt Westcott)
* Fix: Reverse migration errors in images and documents (Mike Brown)
* Fix: Avoid wagtailembeds migration failure on MySQL 8.0.13+ (Matt Westcott)

2.12.3

Not secure
~~~~~~~~~~~~~~~~~~~

* Fix: Un-pin django-treebeard following upstream fix for migration issue (Matt Westcott)
* Fix: Prevent crash when copying an alias page (Karl Hobley)
* Fix: Prevent errors on page editing after changing LANGUAGE_CODE (Matt Westcott)
* Fix: Correctly handle model inheritance and `ClusterableModel` on `copy_for_translation` (Karl Hobley)

Page 15 of 34

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.