Wagtail

Latest version: v6.4.1

Safety actively analyzes 723217 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 20 of 34

2.7.3

Not secure
~~~~~~~~~~~~~~~~~~

* Fix: CVE-2020-11037 - avoid potential timing attack on password-protected private pages (Thibaud Colas)

2.7.2

Not secure
~~~~~~~~~~~~~~~~~~

* Fix: CVE-2020-11001 - prevent XSS attack via page revision comparison view (Vlad Gerasimenko, Matt Westcott)

2.7.1

Not secure
~~~~~~~~~~~~~~~~~~

* Fix: Management command startup checks under `ManifestStaticFilesStorage` no longer fail if `collectstatic` has not been run first (Alex Tomkins)

2.7

Not secure
~~~~~~~~~~~~~~~~~~~~

* Improved StreamField design (Bertrand Bordage)
* Added WebP image support (frmdstryr, Karl Hobley, Matt Westcott)
* Added Elasticsearch 7 support (pySilver)
* Added Python 3.8 support (John Carter, Matt Westcott)
* Added `construct_page_listing_buttons` hook (Michael van Tellingen)
* Added more detailed documentation and troubleshooting for installing OpenCV for feature detection (Daniele Procida)
* Added Table Block caption for accessibility (Rahmi Pruitt)
* Move and refactor upgrade notification JS (Jonny Scholes)
* Add ability to insert internal anchor links/links with fragment identifiers in Draftail (rich text) fields (Iman Syed)
* Remove need for Elasticsearch `update_all_types` workaround, upgrade minimum release to 6.4.0 or above (Jonathan Liuti)
* Add ability for users to change their own name via the account settings page (Kevin Howbrook)
* Add ability to insert telephone numbers as links in Draftail (rich text) fields (Mikael Engström and Liam Brenner)
* Increase delay before search in the snippet chooser, to prevent redundant search request round trips (Robert Rollins)
* Add `WAGTAIL_EMAIL_MANAGEMENT_ENABLED` setting to determine whether users can change their email address (Janne Alatalo)
* Recognise Soundcloud artist URLs as embeddable (Kiril Staikov)
* Add `WAGTAILDOCS_SERVE_METHOD` setting to determine how document downloads will be linked to and served (Tobias McNulty, Matt Westcott)
* Add `WAGTAIL_MODERATION_ENABLED` setting to enable / disable the 'Submit for Moderation' option (Jacob Topp-Mugglestone)
* Added settings to customize pagination page size for the Images admin area (Brian Whitton)
* Added ARIA role to TableBlock output (Matt Westcott)
* Added cache-busting query parameters to static files within the Wagtail admin (Matt Westcott)
* Allow `register_page_action_menu_item` and `construct_page_action_menu` hooks to override the default menu action (Rahmi Pruitt, Matt Westcott)
* `WAGTAILIMAGES_MAX_IMAGE_PIXELS` limit now takes the number of animation frames into account (Karl Hobley)
* Fix: Added line breaks to long filenames on multiple image / document uploader (Kevin Howbrook)
* Fix: Added https support for Scribd oEmbed provider (Rodrigo)
* Fix: Changed StreamField group labels color so labels are visible (Catherine Farman)
* Fix: Prevented images with a very wide aspect ratio from being displayed distorted in the rich text editor (Iman Syed)
* Fix: Prevent exception when deleting a model with a protected One-to-one relationship (Neal Todd)
* Fix: Added labels to snippet bulk edit checkboxes for screen reader users (Martey Dodoo)
* Fix: Middleware responses during page preview are now properly returned to the user (Matt Westcott)
* Fix: Default text of page links in rich text uses the public page title rather than the admin display title (Andy Chosak)
* Fix: Specific page permission checks are now enforced when viewing a page revision (Andy Chosak)
* Fix: `pageurl` and `slugurl` tags no longer fail when `request.site` is `None` (Samir Shah)
* Fix: Output form media on add/edit image forms with custom models (Matt Westcott)
* Fix: Output form media on add/edit document forms with custom models (Sergey Fedoseev)
* Fix: Layout for the clear checkbox in default FileField widget (Mikalai Radchuk)
* Fix: Remove ASCII conversion from Postgres search backend, to support stemming in non-Latin alphabets (Pavel Denisov)
* Fix: Prevent tab labels on page edit view from being cut off on very narrow screens (Kevin Howbrook)
* Fix: Very long words in page listings are now broken where necessary (Kevin Howbrook)
* Fix: Language chosen in user preferences no longer persists on subsequent requests (Bojan Mihelac)
* Fix: Prevent new block IDs from being assigned on repeated calls to `StreamBlock.get_prep_value` (Colin Klein)
* Fix: Prevent broken images in notification emails when static files are hosted on a remote domain (Eduard Luca)
* Fix: Replace styleguide example avatar with default image to avoid issues when custom user model is used (Matt Westcott)
* Fix: `DraftailRichTextArea` is no longer treated as a hidden field by Django's form logic (Sergey Fedoseev)
* Fix: Replace format() placeholders in translatable strings with % formatting (Matt Westcott)
* Fix: Altering Django REST Framework's `DEFAULT_AUTHENTICATION_CLASSES` setting no longer breaks the page explorer menu and admin API (Matt Westcott)
* Fix: Regression - missing label for external link URL field in link chooser (Stefani Castellanos)

2.6.3

Not secure
~~~~~~~~~~~~~~~~~~

* Fix: Altering Django REST Framework's `DEFAULT_AUTHENTICATION_CLASSES` setting no longer breaks the page explorer menu and admin API (Matt Westcott)

2.6.2

Not secure
~~~~~~~~~~~~~~~~~~

* Fix: Prevent search indexing failures on Postgres 9.4 and Django >= 2.2.1 (Matt Westcott)

Page 20 of 34

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.