Wagtail

Latest version: v6.4.1

Safety actively analyzes 723200 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 18 of 34

2.11

Not secure
~~~~~~~~~~~~~~~~~~~~~

* Add support for multi-lingual content (Karl Hobley)
* Add support for aliased pages (Karl Hobley)
* Add support for hierarchical/nested Collections (Robert Rollins)
* Extend treebeard's `fix_tree` method with the ability to non-destructively fix path issues and add a --full option to apply path fixes (Matt Westcott)
* Add `before_edit_snippet`, `before_create_snippet` and `before_delete_snippet` hooks and documentation (Karl Hobley. Sponsored by the Mozilla Foundation)
* Add `register_snippet_listing_buttons` and `construct_snippet_listing_buttons` hooks and documentation (Karl Hobley. Sponsored by the Mozilla Foundation)
* Add `wagtail --version` to available Wagtail CLI commands (Kalob Taulien)
* Add `hooks.register_temporarily` utility function for testing hooks (Karl Hobley. Sponsored by the Mozilla Foundation)
* Remove `unidecode` and use `anyascii` in for Unicode to ASCII conversion (Robbie Mackay)
* Add `render` helper to `RoutablePageMixin` to support serving template responses according to Wagtail conventions (Andy Babic)
* Specify minimum Python version in setup.py (Vince Salvino)
* Show user's full name in report views (Matt Westcott)
* Improve Wagtail admin page load performance by caching SVG icons sprite in localStorage (Coen van der Kamp)
* Support SVG icons in ModelAdmin menu items (Scott Cranfill)
* Support SVG icons in admin breadcrumbs (Coen van der Kamp)
* Serve PDFs inline in the browser (Matt Westcott)
* Make document `content-type` and `content-disposition` configurable via `WAGTAILDOCS_CONTENT_TYPES` and `WAGTAILDOCS_INLINE_CONTENT_TYPES` (Matt Westcott)
* Slug generation no longer removes stopwords (Andy Chosak, Scott Cranfill)
* Add check to disallow StreamField block names that do not match Python variable syntax (François Poulain)
* The `BASE_URL` setting is now converted to a string, if it isn't already, when constructing API URLs (thenewguy)
* Preview from 'pages awaiting moderation' now opens in a new window (Cynthia Kiser)
* Add document extension validation if `WAGTAIL_DOCS_EXTENSIONS` is set (Meghana Bhange)
* Use `django-admin` command in place of `django-admin.py` (minusf)
* Add `register_snippet_action_menu_item` and `construct_snippet_action_menu` hooks to modify the actions available when creating / editing a snippet (Karl Hobley)
* Moved `generate_signature` and `verify_signature` functions into `wagtail.images.utils` (Noah H)
* Implement `bulk_to_python` on all structural StreamField block types (Matt Westcott)
* Add natural key support to `GroupCollectionPermission` (Jim Jazwiecki)
* Implement `prepopulated_fields` for `wagtail.contrib.modeladmin` (David Bramwell)
* Change `classname` keyword argument on basic StreamField blocks to `form_classname` (Meghana Bhange)
* Replace page explorer pushPage/popPage with gotoPage for more flexible explorer navigation (Karl Hobley)
* Fix: Make page-level actions accessible to keyboard users in page listing tables (Jesse Menn)
* Fix: `WAGTAILFRONTENDCACHE_LANGUAGES` was being interpreted incorrectly. It now accepts a list of strings, as documented (Karl Hobley)
* Fix: Update oEmbed endpoints to use https where available (Matt Westcott)
* Fix: Revise `edit_handler` bind order in ModelAdmin views and fix duplicate form instance creation (Jérôme Lebleu)
* Fix: Properly distinguish child blocks when comparing revisions with nested StreamBlocks (Martin Mena)
* Fix: Correctly handle Turkish 'İ' characters in client-side slug generation (Matt Westcott)
* Fix: Page chooser widgets now reflect custom ``get_admin_display_title`` methods (Saptak Sengupta)
* Fix: `Page.copy()` now raises an error if the page being copied is unsaved (Anton Zhyltsou)
* Fix: `Page.copy()` now triggers a `page_published` if the copied page is live (Anton Zhyltsou)
* Fix: The Elasticsearch `URLS` setting can now take a string on its own instead of a list (Sævar Öfjörð Magnússon)
* Fix: Avoid retranslating month / weekday names that Django already provides (Matt Westcott)
* Fix: Fixed padding around checkbox and radio inputs (Cole Maclean)
* Fix: Fix spacing around the privacy indicator panel (Sævar Öfjörð Magnússon, Dan Braghis)
* Fix: Consistently redirect to admin home on permission denied (Matt Westcott, Anton Zhyltsou)

2.10.2

Not secure
~~~~~~~~~~~~~~~~~~~

* Fix: Avoid use of `icon` class name on userbar icon to prevent clashes with front-end styles (Karran Besen)
* Fix: Prevent focused button labels from displaying as white on white (Karran Bessen)
* Fix: Avoid showing preview button on moderation dashboard for page types with preview disabled (Dino Perovic)
* Fix: Prevent oversized buttons in moderation dashboard panel (Dan Braghis)
* Fix: `create_log_entries_from_revisions` now handles revisions that cannot be restored due to foreign key constraints (Matt Westcott)

2.10.1

Not secure
~~~~~~~~~~~~~~~~~~~

* Fix: Prevent `create_log_entries_from_revisions` command from failing when page model classes are missing (Dan Braghis)
* Fix: Prevent page audit log views from failing for user models without a `username` field (Vyacheslav Matyukhin)
* Fix: Fix icon alignment on menu items (Coen van der Kamp)
* Fix: Page editor header bar now correctly shows 'Published' or 'Draft' status when no revisions exist (Matt Westcott)
* Fix: Prevent page editor from failing when `USE_TZ` is false (Matt Westcott)
* Fix: Ensure whitespace between block-level elements is preserved when stripping tags from rich text for search indexing (Matt Westcott)

2.10

Not secure
~~~~~~~~~~~~~~~~~

* Added Django 3.1 support (Matt Westcott, Karl Hobley)
* Removed support for Python 3.5
* Implemented configurable moderation workflow (Jacob Topp-Mugglestone, Karl Hobley, Matt Westcott, Dan Braghis)
* Implemented phrase searching and structured search query expressions (Karl Hobley)
* Add ability to import redirects from an uploaded file (CSV, TSV, XLS, and XLSX) (Martin Sandström)
* Added `webpquality` and `format-webp-lossless` image filters and `WAGTAILIMAGES_WEBP_QUALITY` setting (Nikolay Lukyanov)
* Reorganised Dockerfile in project template to follow best practices (Tomasz Knapik, Jannik Wempe)
* Added filtering to locked pages report (Karl Hobley)
* Adds ability to view a group's users via standalone admin URL and a link to this on the group edit view (Karran Besen)
* Redirect to previous url when deleting/copying/unpublish a page and modify this url via the relevant hooks (Ascani Carlo)
* Added `next_url` keyword argument on `register_page_listing_buttons` and `register_page_listing_more_buttons` hooks (Ascani Carlo, Matt Westcott, LB (Ben Johnston))
* `AbstractEmailForm` will use `SHORT_DATETIME_FORMAT` and `SHORT_DATE_FORMAT` Django settings to format date/time values in email (Haydn Greatnews)
* `AbstractEmailForm` now has a separate method (`render_email`) to build up email content on submission emails (Haydn Greatnews)
* Add `pre_page_move` and `post_page_move` signals (Andy Babic)
* Add ability to sort search promotions on listing page (Chris Ranjana, LB (Ben Johnston))
* Upgrade internal JS tooling; Node v10, Gulp v4 & Jest v23 (Jim Jazwiecki, Kim LaRocca, Thibaud Colas)
* Add `after_publish_page`, `before_publish_page`, `after_unpublish_page` & `before_unpublish_page` hooks (Jonatas Baldin, Coen van der Kamp)
* Add convenience `page_url` shortcut to improve how page URLs can be accessed from site settings in Django templates (Andy Babic)
* Show more granular error messages from Pillow when uploading images (Rick van Hattem)
* Add ordering to `Site` object, so that index page and `Site` switcher will be sorted consistently (Coen van der Kamp, Tim Leguijt)
* Add Reddit to oEmbed provider list (Luke Hardwick)
* Add ability to replace the default Wagtail logo in the userbar, via `branding_logo` block (Meteor0id)
* Remove sticky footer on small devices, so that content is not blocked and more easily editable (Saeed Tahmasebi)
* Add `alt` property to `ImageRenditionField` api representation (Liam Mullens)
* Add `purge_revisions` management command to purge old page revisions (Jacob Topp-Mugglestone, Tom Dyson)
* Render the Wagtail User Bar on non `Page` views (Caitlin White, Coen van der Kamp)
* Add ability to define `form_classname` on `ListBlock` & `StreamBlock` (LB (Ben Johnston))
* Add documentation about how to use `Rustface` for image feature detection (Neal Todd)
* Improve performance of public/not_public queries in `PageQuerySet` (Timothy Bautista)
* Add `add_redirect` static method to `Redirect` class for programmatic redirect creation (Brylie Christopher Oxley, Lacey Williams Henschel)
* Add reference documentation for `wagtail.contrib.redirects` (LB (Ben Johnston))
* `bulk_delete` page permission is no longer required to move pages, even if those pages have children (Robert Rollins, LB (Ben Johnston))
* Add `after_edit_snippet`, `after_create_snippet` and `after_delete_snippet` hooks and documentation (Kalob Taulien)
* Improve performance of empty search results by avoiding downloading the entire search index in these scenarios (Lars van de Kerkhof, Coen van der Kamp)
* Replace `gulp-sass` with `gulp-dart-sass` to improve core development across different platforms (Thibaud Colas)
* Add SVG icons to resolve accessibility and customization issues and start using them in a subset of Wagtail's admin (Coen van der Kamp, Scott Cranfill, Thibaud Colas, Dan Braghis)
* Switch userbar and header H1s to use SVG icons (Coen van der Kamp)
* Remove markup around rich text rendering by default, provide a way to use old behaviour via `wagtail.contrib.legacy.richtext` (Coen van der Kamp, Dan Braghis)
* Apply title length normalization to improve ranking on PostgreSQL search (Karl Hobley)
* Add `WAGTAIL_TIME_FORMAT` setting (Jacob Topp-Mugglestone)
* Allow omitting the default editor from `WAGTAILADMIN_RICH_TEXT_EDITORS` (Gassan Gousseinov)
* Disable password auto-completion on user creation form (Samir Shah)
* Upgrade jQuery to version 3.5.1 to reduce penetration testing false positives (Matt Westcott)
* Add ability to extend `EditHandler` without a children attribute (Seb Brown)
* `Page.objects.specific` now gracefully handles pages with missing specific records (Andy Babic)
* StreamField 'add' buttons are now disabled when maximum count is reached (Max Gabrielsson)
* Use underscores for form builder field names to allow use as template variables (Ashia Zawaduk, LB (Ben Johnston))
* Deprecate use of unidecode within form builder field names (Michael van Tellingen, LB (Ben Johnston))
* Improve error feedback when editing a page with a missing model class (Andy Babic)
* Change Wagtail tabs implementation to only allow slug-formatted tab identifiers, reducing false positives from security audits (Matt Westcott)
* Add skip link for keyboard users to bypass Wagtail navigation in the admin (Martin Coote)
* Ensure errors during Postgres search indexing are left uncaught to assist troubleshooting (Karl Hobley)
* Add ability to edit images and embeds in rich text editor (Maylon Pedroso, Samuel Mendes, Gabriel Peracio)
* Fix: Support IPv6 domain (Alex Gleason, Coen van der Kamp)
* Fix: Ensure link to add a new user works when no users are visible in the users list (LB (Ben Johnston))
* Fix: `AbstractEmailForm` saved submission fields are now aligned with the email content fields, `form.cleaned_data` will be used instead of `form.fields` (Haydn Greatnews)
* Fix: Removed ARIA `role="table"` from TableBlock output (Thibaud Colas)
* Fix: Set Cache-Control header to prevent page preview responses from being cached (Tomas Walch)
* Fix: Accept unicode characters in slugs on the "copy page" form (François Poulain)
* Fix: Remove top padding when `FieldRowPanel` is used inside a `MultiFieldPanel` (Jérôme Lebleu)
* Fix: Add Wagtail User Bar back to page previews and ensure moderation actions are available (Coen van der Kamp)
* Fix: Resolve issue where queryset annotations were lost (e.g. `.annotate_score()`) when using specific models in page query (Dan Bentley)
* Fix: Prevent date/time picker from losing an hour on losing focus when 12-hour times are in use (Jacob Topp-Mugglestone)
* Fix: Strip out HTML tags from `RichTextField` & `RichTextBlock` search index content (Timothy Bautista)
* Fix: Avoid using null on string `Site.site_name` blank values to avoid different values for no name (Coen van der Kamp)
* Fix: Fix deprecation warnings on Elasticsearch 7 (Yngve Høiseth)
* Fix: Remove use of Node.forEach for IE 11 compatibility in admin menu items (Thibaud Colas)
* Fix: Fix incorrect method name in SiteMiddleware deprecation warning (LB (Ben Johnston))
* Fix: `wagtail.contrib.sitemaps` no longer depends on SiteMiddleware (Matt Westcott)
* Fix: Purge image renditions cache when renditions are deleted (Pascal Widdershoven, Matt Westcott)
* Fix: Image / document forms now display non-field errors such as `unique_together` constraints (Matt Westcott)
* Fix: Make "Site" chooser in site settings translatable (Andreas Bernacca)
* Fix: Add missing dropdown icons to image upload, document upload, and site settings screens (Andreas Bernacca)
* Fix: Prevent snippets’ bulk delete button from being present for screen reader users when it’s absent for sighted users (LB (Ben Johnston))
* Fix: Fix group permission checkboxes not being clickable in IE11 (LB (Ben Johnston))

2.9.3

Not secure
~~~~~~~~~~~~~~~~~~

* Fix: CVE-2020-15118 - prevent HTML injection through form field help text (Timothy Bautista, Matt Westcott)

2.9.2

Not secure
~~~~~~~~~~~~~~~~~~

* Fix: Prevent startup failure when `wagtail.contrib.sitemaps` is in `INSTALLED_APPS` (Matt Westcott)

Page 18 of 34

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.