Wagtail 6.0.6 release notes

July 11, 2024

---
local:
depth: 1
---

What's new

CVE-2024-39317: Regular expression denial-of-service via search query parsing

This release addresses a denial-of-service vulnerability in Wagtail. A bug in Wagtail's parse_query_string would result in it taking a long time to process suitably crafted inputs. When used to parse sufficiently long strings of characters without a space, parse_query_string would take an unexpectedly large amount of time to process, resulting in a denial of service.

In an initial Wagtail installation, the vulnerability can be exploited by any Wagtail admin user. It cannot be exploited by end users. If your Wagtail site has a custom search implementation which uses parse_query_string, it may be exploitable by other users (e.g. unauthenticated users).

Many thanks to Jake Howard for reporting and fixing this issue. For further details, please see the CVE-2024-39317 security advisory.

Wagtail 6.0.5 release notes

May 30, 2024

---
local:
depth: 1
---

What's new

CVE-2024-35228: Improper handling of insufficient permissions in wagtail.contrib.settings

This release addresses a permission vulnerability in the Wagtail admin interface. Due to an improperly applied permission check in the wagtail.contrib.settings module, a user with access to the Wagtail admin and knowledge of the URL of the edit view for a settings model can access and update that setting, even when they have not been granted permission over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Many thanks to Victor Miti for reporting this issue, and Matt Westcott and Jake Howard for the fix. For further details, please see the CVE-2024-35228 security advisory.

Wagtail 6.0.4 release notes

May 21, 2024

---
local:
depth: 1
---

What's new

Bug fixes

• Fix snippet copy view not prefilling form data (Sage Abdullah)

Wagtail 6.0.3 release notes

May 1, 2024

---
local:
depth: 1
---

What's new

CVE-2024-32882: Permission check bypass when editing a model with per-field restrictions through wagtail.contrib.settings or ModelViewSet

This release addresses a permission vulnerability in the Wagtail admin interface. If a model has been made available for editing through the wagtail.contrib.settings module or ModelViewSet, and the permission argument on FieldPanel has been used to further restrict access to one or more fields of the model, a user with edit permission over the model but not the specific field can craft an HTTP POST request that bypasses the permission check on the individual field, allowing them to update its value.

The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, or by a user who has not been granted edit access to the model in question. The editing interfaces for pages and snippets are also unaffected.

Many thanks to Ben Morse and Joshua Munn for reporting this issue, and Jake Howard and Sage Abdullah for the fix. For further details, please see the CVE-2024-32882 security advisory.

Bug fixes

• Respect WAGTAIL_ALLOW_UNICODE_SLUGS setting when auto-generating slugs (LB (Ben) Johnston)
• Use correct URL when redirecting back to page search results after an AJAX search (Sage Abdullah)
• Reinstate missing static files in style guide (Sage Abdullah)
• Provide convert_mariadb_uuids management command to assist with upgrading to Django 5.0+ on MariaDB (Matt Westcott)
• Fix generic CopyView for models with primary keys that need to be quoted (Sage Abdullah)

Upgrade considerations

Changes to UUID fields on MariaDB when upgrading to Django 5.0

Django 5.0 introduces support for MariaDB's native UUID type on MariaDB 10.7 and above. This breaks backwards compatibility with CHAR-based UUIDs created on earlier versions of Django and MariaDB, and so upgrading a site to Django 5.0+ and MariaDB 10.7+ is liable to result in errors such as Data too long for column 'translation_key' at row 1 or Data too long for column 'uuid' at row 1 when creating or editing pages. To fix this, it is necessary to run the convert_mariadb_uuids management command (available as of Wagtail 6.0.3) after upgrading:

./manage.py convert_mariadb_uuids

This will convert all existing UUID fields used by Wagtail to the new format. New sites created under Django 5.0+ and MariaDB 10.7+ are unaffected.

Wagtail 6.0.2 release notes

April 3, 2024

---
local:
depth: 1
---

What's new

Bug fixes

• Ensure that modal tabs width are not impacted by side panel opening (LB (Ben) Johnston)
• Resolve issue local development of docs when running make livehtml (Sage Abdullah)
• Resolve issue with unwanted padding in chooser modal listings (Sage Abdullah)
• Ensure get_add_url() is always used to re-render the add button when the listing is refreshed in viewsets (Sage Abdullah)
• Move modal-workflow.js script usage to base admin template instead of ad-hoc imports so that choosers work in ModelViewSets (Elhussein Almasri)
• Ensure JavaScript for common widgets such as InlinePanel is included by default in ModelViewSet's create and edit views (Sage Abdullah)
• Reinstate styles for customizations of extra_footer_actions block in page create/edit templates (LB (Ben) Johnston, Sage Abdullah)
• Prevent crash when loading an empty table block in the editor (Sage Abdullah)

Documentation

• Update Sphinx theme to 6.3.0 with a fix for the missing favicon (Sage Abdullah)

Wagtail 6.0.1 release notes

February 15, 2024

---
local:
depth: 1
---

What's new

Bug fixes

• Ensure BooleanRadioSelect uses the same styles as RadioSelect (Thibaud Colas)
• Prevent failure on collectstatic when ManifestStaticFilesStorage is in use (Matt Westcott)
• Prevent error on submitting an empty search in the admin under Elasticsearch (Maikel Martens)

4.2, 5.0

3.8, 3.9, 3.10, 3.11, 3.12

5.2 LTS

3.2, 4.1, 4.2, 5.0 [ 1 ]

3.8, 3.9, 3.10, 3.11, 3.12

Wagtail 6.0 release notes

February 7, 2024

---
local:
depth: 1
---

What's new

Django 5.0 support

This release adds support for Django 5.0. The support has also been backported to Wagtail 5.2 LTS.

New developer tutorial

A new developer tutorial series has been added to the documentation. This series builds upon the pre-existing , going through the creation and deployment of a portfolio website.

This tutorial series was created by Damilola Oladele as part of the Google Season of Docs program, with support from Meagen Voss, and Thibaud Colas. We also thank Storm Heg, Kalob Taulien, Kátia Nakamura, Mariusz Felisiak, and Rachel Smith for their support and feedback as part of the project.

Universal listings

Following design improvements to the page listing view, Wagtail now provides a unified search and filtering interface for all listings. This will improve navigation capabilities, particularly for sites with a large number of pages or where content tends to use a flat structure.

In this release, the universal listing interface is available for Pages, Snippets, and Forms. For pages, the UI includes the following filters out of the box:

• Page type
• Date updated
• Owner
• Edited by
• Site
• Has child pages
• Locale

This feature was developed by Ben Enright, Matt Westcott, Nick Lee, Thibaud Colas, and Sage Abdullah.

Right-to-left language support

The admin interface now supports right-to-left languages, such as Persian, Arabic, and Hebrew. Though there are still some areas that need improvement, all admin views will now be displayed in the correct direction. Review our UI guidelines for guidance on supporting right-to-left languages in admin interface customizations.

Thank you to Thibaud Colas, Badr Fourane, and Sage Abdullah for their work on this long-requested improvement.

Accessibility checker in page editor

The built-in accessibility checker now displays as a side panel within page and snippet editors supporting preview. The new "Checks" side panel only shows accessibility-related issues for pages with the userbar enabled in this release, but will be updated to support any content checks in the future.

This feature was implemented by Nick Lee, Thibaud Colas, and Sage Abdullah.

Page types usage report

The new Page types report provides a breakdown of the number of pages for each type. It helps answer questions such as:

• Which page types do we have on our CMS?
• How many pages of that page type do we have?
• When was a page of that type last edited? By whom? Which page was that?

This feature was developed by Jhonatan Lopes, as part of a sponsorship by the Mozilla Foundation.

Accessibility improvements

This release comes with a high number of accessibility improvements across the admin interface.

• Improve layout and accessibility of the image URL generator page, reduce reliance on JavaScript (Temidayo Azeez)
• Remove overly verbose image captions in image listings for screen readers (Sage Abdullah)
• Ensure screen readers and dictation tools can more easily navigate bulk actions in images, documents and page listings by streamlining labels and descriptions (Sage Abdullah)
• Add optional caption field to TypedTableBlock (Tommaso Amici, Cynthia Kiser)
• Switch the TableBlock header controls to a field that requires user input (Bhuvnesh Sharma, Aman Pandey, Cynthia Kiser)
• Add support for caption on admin UI Table component (Aman Pandey)
• Replace legacy dropdown component with new Tippy dropdown-button (Thibaud Colas)
• Ensure the sidebar account toggle has no duplicate accessible labels (Nandini Arora)
• Ensure that page listing re-ordering messages and accessible labels can be translated (Aman Pandey, LB (Ben) Johnston)
• Resolve multiple issues with page listing re-ordering using keyboard and screen readers (Aman Pandey)
• When using an empty table header (th) for visual spacing, ensure this is ignored by accessibility tooling (V Rohitansh)
• Ensure that TableBlock cells are accessible when using keyboard control only (Elhussein Almasri)

Other features

• Added search_index option to StreamField blocks to control whether the block is indexed for searching (Vedant Pandey)
• Remember previous location on returning from page add/edit actions (Robert Rollins)
• Update settings file in project settings to address Django 4.2 deprecations (Sage Abdullah)
• Allow UniqueConstraint in place of unique_together for {class}~wagtail.models.TranslatableMixin's system check (Temidayo Azeez, Sage Abdullah)
• Make use of IndexView.get_add_url() in snippets index view template (Christer Jensen, Sage Abdullah)
• Allow Page.permissions_for_user() to be overridden by specific page types (Sébastien Corbin)
• Improve visual alignment of explore icon in Page listings for longer content (Krzysztof Jeziorny)
• Add extra_actions blocks to Snippets and generic index templates (Bhuvnesh Sharma)
• Add support for defining panels / edit_handler on ModelViewSet (Sage Abdullah)
• Use a single instance of PagePermissionPolicy in wagtail.permissions module (Sage Abdullah)
• Add max tag length validation for multiple uploads (documents/images) (Temidayo Azeez)
• Ensure expanded side panel does not overlap form content for most viewports (Chiemezuo Akujobi)
• Add ability to modify the default ordering for the page explorer view (Shlomo Markowitz)
• Remove support for Safari 14 (Thibaud Colas)
• Add ability to click to copy the URL in the image URL generator page (Sai Srikar Dumpeti)
• Show edit as a main action in generic history and usage views (Sage Abdullah)
• Make styles for header buttons consistent (Sage Abdullah)
• Improve styles of slim header's search and filters (Sage Abdullah)
• Change page listing's add button to icon-only (Sage Abdullah)
• Add sublabel to breadcrumbs, including history, usage, and inspect views (Sage Abdullah)
• Standardise search form placeholder to 'Search…' (Sage Abdullah)
• Use SlugInput on all SlugFields by default (LB (Ben) Johnston)
• Show character counts on RichTextBlock with max_length (Elhussein Almasri)
• Move locale selector in generic IndexView to a filter (Sage Abdullah)
• Add ability to customize a page's copy form including an auto-incrementing slug example (Neeraj Yetheendran)
• Add WAGTAILADMIN_LOGIN_URL setting to allow customizing the login URL (Neeraj Yetheendran)
• Polish dark theme styles and update color tokens (Thibaud Colas, Rohit Sharma)
• Keep database state of pages and snippets updated while in draft state (Stefan Hammer)
• Add DrilldownController and w-drilldown component to support drilldown menus (Thibaud Colas)
• Add API support for a redirects (contrib) endpoint (Rohit Sharma, Jaap Roes, Andreas Donig)
• Add the default ability for all SnippetViewSet & ModelViewSet to support being copied, this can be disabled by copy_view_enabled = False (Shlomo Markowitz)
• Support dynamic Wagtail guide links in the admin that are based on the running version of Wagtail (Tidiane Dia)

Bug fixes

• Update system check for overwriting storage backends to recognize the STORAGES setting introduced in Django 4.2 (phijma-leukeleu)
• Prevent password change form from raising a validation error when browser autocomplete fills in the "Old password" field (Chiemezuo Akujobi)
• Ensure that the legacy dropdown options, when closed, do not get accidentally clicked by other interactions on wide viewports (CheesyPhoenix, Christer Jensen)
• Add a fallback background for the editing preview iframe for sites without a background (Ian Price)
• Preserve whitespace in rendered comments (Elhussein Almasri)
• Remove search logging from project template so that new projects without the search promotions module will not error (Matt Westcott)
• Ensure text only email notifications for updated comments do not escape HTML characters (Rohit Sharma)
• Use the latest draft when copying an unpublished page for translation (Andrey Nehaychik)
• Make Workflow and Aging Pages reports only available to users with page-related permissions (Rohit Sharma)
• Make searching on specific fields work correctly on Elasticsearch when boost is in use (Matt Westcott)
• Use a visible border and background color to highlight active formatting in the rich text toolbar (Cassidy Pittman)
• Ensure image focal point box can be removed (Gunnar Scherf)
• Ensure that Snippets search results correctly use the index_results.html or index_results_template_name override on initial load (Stefan Hammer)
• Avoid error when attempting to moderate a page drafted by a now deleted user (Dan Braghis)
• Do not show multiple error messages when editing a Site to use existing hostname and port (Rohit Sharma)
• Avoid error when exporting Aging Pages report where a page has an empty last_published_by_user (Chiemezuo Akujobi)
• Ensure Page querysets support using alias and specific (Tomasz Knapik)
• Ensure workflow dashboard panels work when the page/snippet is missing (Sage Abdullah)
• Ensure ActionController explicitly checks for elements that allow select functionality (Nandini Arora)
• Prevent a ValueError with FormSubmissionsPanel on Django 5.0 when creating a new form page (Matt Westcott)
• Avoid duplicate entries in "Recent edits" panel when copying pages (Matt Westcott)
• Prevent TitleFieldPanel from raising an error when the slug field is missing or read-only (Rohit Sharma)
• Ensure that the close button on the new dialog designs is visible in the non-message variant (Nandini Arora)
• Avoid text overflow issues in comment replies and scroll position issues for long comments (Rohit Sharma)
• Remove 'Page' from page types filter on aging pages report (Matt Westcott)
• Prevent page types filter from showing other non-Page models that match by name (Matt Westcott)
• Ensure MultipleChooserPanel modal works correctly when USE_THOUSAND_SEPARATOR is True for pages with ids over 1,000 (Sankalp, Rohit Sharma)
• Ensure the panel anchor button sizes meet accessibility guidelines for minimum dimensions (Nandini Arora)
• Raise a 404 for bulk actions for models which don't exist instead of throwing a 500 error (Alex Tomkins)
• Raise a SiteSetting.DoesNotExist error when retrieving settings for an unrecognized site (Nick Smith)
• Ensure that defaulted or unique values declared in exclude_fields_in_copy are correctly excluded in new copies, resolving to the default value (Elhussein Almasri)
• Ensure that default_ordering set on IndexView is preserved if ModelViewSet does not specify an explicit ordering (Cynthia Kiser)
• Resolve issue where clicking Publish for a Page that was in workflow in Safari would block publishing and not trigger the workflow confirmation modal (Alex Morega)
• Fix pagination links on model history and usage views (Matt Westcott)
• Fix crash when accessing workflow reports with a deleted snippet (Sage Abdullah)

Documentation

• Document, for contributors, the use of translate string literals passed as arguments to tags and filters using _() within templates (Chiemezuo Akujobi)
• Document all features for the Documents app in one location, see (Neeraj Yetheendran)
• Add section to testing docs about creating pages and working with page content (Mariana Bedran Lesche)
• Add more nuance to the database recommendations in (Jadesola Kareem)
• Add clarity that MultipleChooserPanel may require a chooser viewset and how the functionality is expected to work (Andy Chosak)
• Clarify where documentation build commands should be run (Nikhil S Kalburgi)
• Add missing import to tutorial BlogPage example (Salvo Polizzi)
• Update contributing guide documentation and GitHub templates to better support new contributors (Thibaud Colas)
• Add more CSS authoring guidelines (Thibaud Colas)
• Update MyST documentation parser library to 2.0.0 (Neeraj Yetheendran)
• Add documentation writing guidelines for intersphinx / external links (LB (Ben) Johnston)
• Add Page model reference get_children documentation (Salvo Polizzi)
• Enforce CI build checks for documentation so that malformed links or missing images will not be allowed (Neeraj Yetheendran)
• Update spelling on customizing admin template and page model section from British to American English (Victoria Poromon)
• Add documentation for how to override the file locations for custom image models (Osaf AliSayed, Dharmik Gangani)
• Update documentation theme (Sphinx Wagtail Theme) to 6.2.0, fixing the incorrect favicon (LB (Ben) Johnston, Sahil Jangra)
• Refactor promotion banner without jQuery and use sameSite cookies when storing if cleared (LB (Ben) Johnston)
• Use cross-reference for compatible Python versions in tutorial instead of the out of date listing (mirusu400)

Maintenance

Generic class-based views adoption

As part of ongoing refactorings, we have migrated several views to use generic class-based views. This allows for easier extensibility and better code reuse.

• Migrate the contrib styleguide index view to a class-based view (Chiemezuo Akujobi)
• Migrate the contrib settings edit view to a class-based view (Chiemezuo Akujobi, Sage Abdullah)
• Migrate account editing view to a class-based view (Kehinde Bobade)
• Refactor page explorer index template to extend generic index template (Sage Abdullah)
• Refactor snippets index view and template to make better use of generic IndexView (Sage Abdullah)
• Refactor documents listing view to use generic IndexView (Sage Abdullah)
• Refactor images listing view to use generic IndexView (Sage Abdullah)
• Refactor form pages listing view to use generic IndexView (Sage Abdullah)
• Reduce gap between snippets and generic views/templates (Sage Abdullah)

Other maintenance

• Update BeautifulSoup upper bound to 4.12.x (scott-8)
• Migrate initialization of classes (such as body.ready) from multiple JavaScript implementations to one Stimulus controller w-init (Chiemezuo Akujobi)
• Adopt the usage of translate string literals using arg=_('...') in all wagtailadmin module templates (Chiemezuo Akujobi)
• Update djhtml to 3.0.6 (Matt Westcott)
• Remove django-pattern-library upper bound in testing dependencies (Sage Abdullah)
• Split up functions in Elasticsearch backend for easier extensibility (Marcel Kornblum, Cameron Lamb, Sam Dudley)
• Relax draftjs_exporter dependency to allow using version 5.x (Sylvain Fankhauser)
• Refine styling of listings, account settings panels and the block chooser (Meli Imelda)
• Remove icon font support (Matt Westcott)
• Remove deprecated SVG icons (Matt Westcott)
• Remove icon font styles (Thibaud Colas)
• Upgrade frontend tooling to use Node 20 (LB (Ben) Johnston)
• Upgrade ruff and replace black with ruff format (John-Scott Atlakson)
• Update Willow upper bound to 2.x (Dan Braghis)
• Removed support for Django < 4.2 (Dan Braghis)
• Replace template components implementation with standalone laces library (Tibor Leupold)
• Introduce an internal {% formattedfield %} tag to replace direct use of wagtailadmin/shared/field.html (Matt Westcott)
• Update Telepath dependency to 0.3.1 (Matt Westcott)
• Allow ActionController to have a noop method to more easily leverage standalone Stimulus action options (Nandini Arora)
• Upgrade to latest TypeScript and Storybook (Thibaud Colas, Sage Abdullah)
• Turn on skipLibCheck for TypeScript (LB (Ben) Johnston)
• Support for the Stimulus CloneController to auto clear the added content after a set duration (LB (Ben) Johnston)
• Update Stylelint, our linting configuration, Sass, and related code changes (LB (Ben) Johnston)
• Simplify browserslist and browser support documentation for maintainers (Thibaud Colas)
• Relax django-taggit dependency to allow 5.0 (Sylvain Fankhauser)
• Fix various warnings when building docs (Cynthia Kiser)
• Upgrade sphinxcontrib-spelling to 7.x for Python 3.12 compatibility (Matt Westcott)
• Move logic for django-filters filtering into BaseListingView (Matt Westcott)
• Remove or replace legacy CSS classes: visuallyhidden, visuallyvisible, divider-after, divider-before, inline, inline-block, block, u-hidden, clearfix, reordering, overflow (Thibaud Colas)
• Prevent future issues with icon.html end-of-file newlines (Thibaud Colas)
• Rewrite styles using legacy c-, o-, u-, t-, is- prefixes (Thibaud Colas)
• Remove invalid CSS styles / Sass selector concatenation (Thibaud Colas)
• Refactor listing views to share more queryset ordering logic (Matt Westcott)
• Remove initTooltips in favor of Stimulus controller (LB (Ben) Johnston)
• Enhance the Stimulus InitController to allow for custom event dispatching when ready (Aditya, LB (Ben) Johnston)
• Remove inline script usage for comment initialization and adopt an event listener/dispatch approach for better CSP compliance (Aditya, LB (Ben) Johnston)
• Migrate styleguide ad-hoc JavaScript to use styles only to avoid CSP issues (LB (Ben) Johnston)
• Update Jest version - frontend tooling (Nandini Arora)
• Remove non-functional and inaccessible auto-focus on first field in page create forms (LB (Ben) Johnston)
• Migrate the unsaved form checks & confirmation trigger to Stimulus UnsavedController (Sai Srikar Dumpeti, LB (Ben) Johnston)
• Migrate page listing menu re-ordering (drag & drop) from jQuery inline scripts to OrderableController with a more accessible solution (Aman Pandey, LB (Ben) Johnston)
• Clean up scss variable usage, remove unused variables and mixins, adopt more core token variables (Jai Vignesh J, Nandini Arora, LB (Ben) Johnston)
• Migrate Image URL generator views to class-based views (Rohit Sharma)
• Use Django's FileResponse when serving files such as Images or Documents (Jake Howard)
• Deprecated WidgetWithScript base widget class (LB (Ben) Johnston)
• Remove support for Django 4.1 and below (Sage Abdullah)

Upgrade considerations - removal of deprecated features from Wagtail 4.2 - 5.1

Features previously deprecated in Wagtail 4.2, 5.0 and 5.1 have been fully removed. For additional details on these changes, see:

• Wagtail 4.2 release notes
• Wagtail 5.0 release notes
• Wagtail 5.1 release notes

The most significant changes are highlighted below.

Removal of ModelAdmin app

The wagtail.contrib.modeladmin app has been removed. If you wish to continue using it, it is available as the external package wagtail-modeladmin.

Query model moved to wagtail.contrib.search_promotions

The Query model (used to log search queries performed by users, to identify commonly searched terms) is no longer part of the wagtail.search module; it can now be found in the optional wagtail.contrib.search_promotions app. When updating code to import the model from the new location, ensure that you have added wagtail.contrib.search_promotions to your INSTALLED_APPS setting - failing to do this may result in a spurious migration being created within the core wagtail app.

Support for Elasticsearch 5 and 6 dropped

The Elasticsearch 5 and 6 backends have been removed. If you are using one of these backends, you will need to upgrade to Elasticsearch 7 or 8 before upgrading to Wagtail 6.0.

StreamField no longer requires use_json_field=True

The use_json_field argument to StreamField is no longer required, and can be removed. StreamField now consistently uses JSONField for its database representation, and Wagtail 5.0 required older TextField-based streams to be migrated. As such, use_json_field no longer has any effect.

Other removals

• The WAGTAILADMIN_GLOBAL_PAGE_EDIT_LOCK setting is no longer recognized and should be replaced with WAGTAILADMIN_GLOBAL_EDIT_LOCK.
• The wagtail.models.UserPagePermissionsProxy class and get_pages_with_direct_explore_permission, get_explorable_root_page and users_with_page_permission functions have been removed; equivalent functionality exists in the wagtail.permission_policies.pages.PagePermissionPolicy class.
• The permission_type field of the GroupPagePermission model has been removed; the permission field (a foreign key to Django's Permission model) should be used instead.
• The legacy moderation system used before the introduction of workflows in Wagtail 2.10 has been removed. Any moderation requests still in the queue from before this time will be lost.
• The Wagtail icon font has been removed; any direct usage of this needs to be converted to SVG icons.
• Various unused icons deprecated in Wagtail 5.0 have been removed.
• The partial_match argument on SearchField and on search methods has been removed. AutocompleteField and the autocomplete method should be used instead.
• The insert_editor_css hook has been removed; the insert_global_admin_css hook should be used instead.
• The wagtail.contrib.frontend_cache module now supports azure-mgmt-cdn version 10 and azure-mgmt-frontdoor version 1 as its minimum supported versions.
• The Task.page_locked_for_user method has been removed; Task.locked_for_user should be used instead.
• The {% icon %} template tag no longer accepts class_name as an argument; classname should be used instead.
• The wagtail.tests.utils module has been removed and can now be found at wagtail.test.utils.
• The template wagtailadmin/shared/field_as_li.html has been removed, and should be replaced with wagtailadmin/shared/field.html enclosed in an <li> tag.
• The custom client-side events wagtail:show and wagtail:hide on showing and hiding dialogs have been removed; w-dialog:show and w-dialog:hide should be used instead.
• The global Javascript definitions headerSearch, initTagField, cancelSpinner and unicodeSlugsEnabled have been removed; these should be replaced with Stimulus controllers.

Upgrade considerations - changes affecting all projects

Changes to UUID fields on MariaDB when upgrading to Django 5.0

Django 5.0 introduces support for MariaDB's native UUID type on MariaDB 10.7 and above. This breaks backwards compatibility with CHAR-based UUIDs created on earlier versions of Django and MariaDB, and so upgrading a site to Django 5.0+ and MariaDB 10.7+ is liable to result in errors such as Data too long for column 'translation_key' at row 1 or Data too long for column 'uuid' at row 1 when creating or editing pages. To fix this, it is necessary to run the convert_mariadb_uuids management command (available as of Wagtail 6.0.3) after upgrading:

./manage.py convert_mariadb_uuids

This will convert all existing UUID fields used by Wagtail to the new format. New sites created under Django 5.0+ and MariaDB 10.7+ are unaffected.

SnippetViewSet & ModelViewSet copy view enabled by default

The newly introduced copy view will be enabled by default for all ModelViewSet and SnippetViewSet classes.

This can be disabled by setting copy_view_enabled = False, for example.

class PersonViewSet(SnippetViewSet):
    model = Person
    # ...
    copy_view_enabled = False


class PersonViewSet(ModelViewSet):
    model = Person
    # ...
    copy_view_enabled = False

See for additional details about this feature.

Upgrade considerations - deprecation of old functionality

Removed support for Django < 4.2

Django versions before 4.2 are no longer supported as of this release; please upgrade to Django 4.2 or above before upgrading Wagtail.

Upgrade considerations - changes affecting Wagtail customizations

SlugInput widget is now the default for SlugField fields

In Wagtail 5.0 a new SlugInput admin widget was added to support slug behavior in Page and Page copy forms. This widget was included by default if the promote_panels fields layout was customized, causing confusion.

As of this release, any forms that inherit from WagtailAdminModelForm (includes page and snippet model editing) will now use the SlugInput by default on all models with SlugField fields.

Previously, the widget had to be explicitly added.

from wagtail.admin.widgets.slug import SlugInput
# ... other imports


class MyPage(Page):
    promote_panels = [
        FieldPanel("slug", widget=SlugInput),
        # ... other panels
    ]

Keeping the widget as above is fine, but will no longer be required. The JavaScript field behavior will be included by default.

# ... imports


class MyPage(Page):
    promote_panels = [
        FieldPanel("slug"),
        # ... other panels
    ]

If you do not want this for some reason, you will now need to declare a different widget.

from django.forms.widgets import TextInput
# ... other imports


class MyPage(Page):
    promote_panels = [
        FieldPanel("slug", widget=TextInput),  # use a plain text field
        # ... other panels
    ]

Changed handling of database updates of non-live Page objects or subclasses of DraftStateMixin

Before this release, the database record of a Page or any subclass of DraftStateMixin either contained the live data (if published), the state of the last published version (if unpublished), or the state of the first revision (if never published). Subsequent draft edits would create new Revision records, but the main database record would not be updated. As a result, the database record could lag substantially behind the current state of the object, causing unexpected behavior particularly when unique constraints are in use.

As of this release, the database record of a non-live object will be updated to reflect the draft state of the object. This is unlikely to have a visible effect on existing sites, since the admin backend works with the Revision records while the site front-end typically filters out non-live objects. However, any code that relies on the database record being untouched by draft edits (for example, using it to store a specific approved / archived state of the page) may need to be updated.

Upgrade considerations - changes to undocumented internals

filter_queryset and get_filtered_queryset methods no longer return filters

The undocumented internal methods filter_queryset(queryset) on wagtail.admin.views.generic.IndexView, and get_filtered_queryset() on wagtail.admin.views.reports.ReportView, now return just the filtered queryset; previously they returned a tuple of (filters, queryset). The filterset instance is always available as the cached property self.filters.

Deprecation of the undocumented window.enableDirtyFormCheck function

The admin frontend window.enableDirtyFormCheck will be removed in a future release and as of this release only supports the basic initialization.

The previous approach was to call a window global function as follows.

window.enableDirtyFormCheck('.my-form', { alwaysDirty: true, confirmationMessage: 'You have unsaved changes'});

The new approach will be data attribute driven as follows.

<form
  method="POST"
  data-controller="w-unsaved"
  data-action="w-unsaved#submit beforeunload@window->w-unsaved#confirm change->w-unsaved#check keyup->w-unsaved#check"
  data-w-unsaved-confirm-value="This page has unsaved changes." // equivalent to `confirmationMessage`.
  data-w-unsaved-force-value="true" // equivalent to `alwaysDirty`.
  data-w-unsaved-watch-value="edits comments" // can add 'comments' if comments is enabled, defaults to only 'edits'.
  >
  ... form contents
</form>

data-tippy-content attribute support will be removed

The implementation of the JS tooltips have been fully migrated to the Stimulus w-tooltip/TooltipController implementation.

Dynamic support for any data-tippy-content="..." usage will be removed this release, for example, within chooser modals or dynamic html response data.

Some minimal backwards compatibility support for data-tippy-content will work until a future release, but only in the initial HTML response on a page.

Data attributes

These HTML data attributes were not documented, but if any custom code implemented custom tooltips, these will need to be changed.

Old	New	Notes
	data-controller="w-tooltip"	Required, new addition for any usage
data-tippy-content="{% trans 'History' %}"	data-w-tooltip-content-value="{% trans 'History' %}"	Required
data-tippy-offset="[12, 24]"	data-w-tooltip-offset-value="[12, 24]"	Optional, default is no offset
data-tippy-placement="top"	data-w-tooltip-placement-value="top"	Optional, default is 'bottom'

Deprecated WidgetWithScript base widget class

The undocumented WidgetWithScript class that used inline scripts to attach JavaScript to widgets will be removed in a future release.

This approach creates security risks and will not be compliant with CSP support. Instead, it's recommended that all similar requirements migrate to use the recommended Stimulus JS integration approach.

A full example of how to build this has been documented on extending client-side behavior, a basic example is below.

Old

from django.forms import Media, widgets


class CustomRichTextArea(WidgetWithScript, widgets.Textarea):
    def render_js_init(self, id_, name, value):
        return f"window.customEditorInitScript({json.dumps(id_)});"

    @property
    def media(self):
        return Media(js=["vendor/custom-editor.js"])

New

from django.forms import Media, widgets


class CustomRichTextArea(widgets.Textarea):
    def build_attrs(self, *args, **kwargs):
        attrs = super().build_attrs(*args, **kwargs)
        attrs["data-controller"] = "custom-editor"

    @property
    def media(self):
        return Media(js=["vendor/custom-editor.js", "js/custom-editor-controller.js"])

// myapp/static/js/custom-editor-controller.js

class CustomEditorController extends window.StimulusModule.Controller {
    connect() {
        window.customEditorInitScript(this.element.id);
    }
}

window.wagtail.app.register('custom-editor', CustomEditorController);

Wagtail 5.2.8 release notes

February 3, 2025

---
local:
depth: 1
---

What's new

Bug fixes

• Prevent database error when calling permission_order.register on app ready (Daniel Kirkham, Matt Westcott)
• Handle StreamField migrations where the field value is null (Joshua Munn)
• Prevent StreamChildrenToListBlockOperation from duplicating data across multiple StreamField instances (Joshua Munn)
• Prevent error on lazily loading StreamField blocks after the stream has been modified (Stefan Hammer)
• Prevent syntax error on MySQL search when query includes symbols (Matt Westcott)

Wagtail 5.2.7 release notes

November 1, 2024

---
local:
depth: 1
---

What's new

Bug fixes

• Prevent multiple URLs from being combined into one when pasting links into a rich text input (Thibaud Colas)
• Fix error on workflow settings view with multiple snippet types assigned to the same workflow on Postgres (Sage Abdullah)

Wagtail 5.2.6 release notes

July 11, 2024

---
local:
depth: 1
---

What's new

CVE-2024-39317: Regular expression denial-of-service via search query parsing

This release addresses a denial-of-service vulnerability in Wagtail. A bug in Wagtail's parse_query_string would result in it taking a long time to process suitably crafted inputs. When used to parse sufficiently long strings of characters without a space, parse_query_string would take an unexpectedly large amount of time to process, resulting in a denial of service.

In an initial Wagtail installation, the vulnerability can be exploited by any Wagtail admin user. It cannot be exploited by end users. If your Wagtail site has a custom search implementation which uses parse_query_string, it may be exploitable by other users (e.g. unauthenticated users).

Many thanks to Jake Howard for reporting and fixing this issue. For further details, please see the CVE-2024-39317 security advisory.

Bug fixes

• Fix image preview when Willow optimizers are enabled (Alex Tomkins)

Maintenance

• Remove django-pattern-library upper bound in testing dependencies (Sage Abdullah)

Wagtail 5.2.5 release notes

May 1, 2024

---
local:
depth: 1
---

What's new

Bug fixes

• Respect WAGTAIL_ALLOW_UNICODE_SLUGS setting when auto-generating slugs (LB (Ben) Johnston)
• Use correct URL when redirecting back to page search results after an AJAX search (Sage Abdullah)
• Provide convert_mariadb_uuids management command to assist with upgrading to Django 5.0+ on MariaDB (Matt Westcott)

Upgrade considerations

Changes to UUID fields on MariaDB when upgrading to Django 5.0

Django 5.0 introduces support for MariaDB's native UUID type on MariaDB 10.7 and above. This breaks backwards compatibility with CHAR-based UUIDs created on earlier versions of Django and MariaDB, and so upgrading a site to Django 5.0+ and MariaDB 10.7+ is liable to result in errors such as Data too long for column 'translation_key' at row 1 or Data too long for column 'uuid' at row 1 when creating or editing pages. To fix this, it is necessary to run the convert_mariadb_uuids management command (available as of Wagtail 5.2.5) after upgrading:

./manage.py convert_mariadb_uuids

This will convert all existing UUID fields used by Wagtail to the new format. New sites created under Django 5.0+ and MariaDB 10.7+ are unaffected.

Wagtail 5.2.4 release notes

April 3, 2024

---
local:
depth: 1
---

What's new

Bug fixes

• Prevent TitleFieldPanel from raising an error when the slug field is missing or read-only (Rohit Sharma)
• Fix pagination links on model history and usage views (Matt Westcott)
• Fix crash when accessing workflow reports with a deleted snippet (Sage Abdullah)
• Prevent error on submitting an empty search in the admin under Elasticsearch (Maikel Martens)

Wagtail 5.2.3 release notes

January 23, 2024

---
local:
depth: 1
---

What's new

Bug fixes

• Prevent a ValueError with FormSubmissionsPanel on Django 5.0 when creating a new form page (Matt Westcott)
• Specify telepath 0.3.1 as the minimum supported version, for Django 5.0 compatibility (Matt Westcott)

Wagtail 5.2.2 release notes

December 6, 2023

---
local:
depth: 1
---

What's new

Django 5.0 support

This release adds support for Django 5.0.

Bug fixes

• Use a visible border and background color to highlight active formatting in the rich text toolbar (Cassidy Pittman)
• Ensure image focal point box can be removed (Gunnar Scherf)
• Ensure that Snippets search results correctly use the index_results.html or index_results_template_name override on initial load (Stefan Hammer)
• Avoid error when attempting to moderate a page drafted by a now deleted user (Dan Braghis)
• Ensure workflow dashboard panels work when the page/snippet is missing (Sage Abdullah)
• Prevent custom controls from stacking on top of the comment button in Draftail toolbar (Ben Morse)

Wagtail 5.2.1 release notes

November 16, 2023

---
local:
depth: 1
---

What's new

Bug fixes

• Add a fallback background for the editing preview iframe for sites without a background (Ian Price)
• Remove search logging from project template so that new projects without the search promotions module will not error (Matt Westcott)
• Ensure text only email notifications for updated comments do not escape HTML characters (Rohit Sharma)
• Use logical OR operator to combine search fields for Django ORM in generic IndexView (Varun Kumar)
• Ensure that explorer_results views fill in the correct next_url parameter on action URLs (Matt Westcott)
• Fix crash when accessing the history view for a translatable snippet (Sage Abdullah)
• Prevent upload of SVG images from failing when image feature detection is enabled (Joshua Munn)
• Fix crash when using the locale switcher on the snippets create view (Sage Abdullah)
• Fix performance regression on reports from calling decorate_paginated_queryset before pagination / filtering (Alex Tomkins)
• Make searching on specific fields work correctly on Elasticsearch when boost is in use (Matt Westcott)
• Prevent snippet permission post-migrate hook from failing on multiple database configurations (Joe Tsoi)
• Reinstate ability to filter on page type when searching on an empty query (Sage Abdullah)
• Prevent error on locked pages report when a user has locked multiple pages (Matt Westcott)

Documentation

• Fix code example for {% picture ... as ... %} template tag (Rezyapkin)

Wagtail 5.2 (LTS) release notes

November 1, 2023

---
local:
depth: 1
---

Wagtail 5.2 is designated a Long Term Support (LTS) release. Long Term Support releases will continue to receive maintenance updates as necessary to address security and data-loss related issues, up until the next LTS release (typically a period of 12 months).

What's new

Redesigned page listing view

The page explorer listing view has been redesigned to allow improved navigation and searching. This feature was developed by Ben Enright, Matt Westcott, Thibaud Colas and Sage Abdullah.

OpenSearch support

OpenSearch is now formally supported as an alternative to Elasticsearch. For configuration details, see OpenSearch configuration. This feature was developed by Matt Westcott.

Responsive & multi-format images with the picture tag

Wagtail has new template tags to reduce the loading time and environmental footprint of images:

• The picture tag generates images in multiple formats and-or sizes in one batch, creating an HTML <picture> tag.
• The srcset_image tag generates images in multiple sizes, creating an <img> tag with a srcset attribute.

As an example, the picture tag allows generating six variants of an image in one go:

{% picture page.photo format-{avif,webp,jpeg} width-{400,800} sizes="80vw" %}

This outputs:

<picture>
    <source sizes="80vw" srcset="/media/images/pied-wagtail.width-400.avif 400w, /media/images/pied-wagtail.width-800.avif 800w" type="image/avif">
    <source sizes="80vw" srcset="/media/images/pied-wagtail.width-400.webp 400w, /media/images/pied-wagtail.width-800.webp 800w" type="image/webp">
    <img sizes="80vw" srcset="/media/images/pied-wagtail.width-400.jpg 400w, /media/images/pied-wagtail.width-800.jpg 800w" src="/media/images/pied-wagtail.width-400.jpg" alt="A pied Wagtail" width="400" height="300">
</picture>

We expect those changes to greatly reduce the weight of images for all Wagtail sites. We encourage all site implementers to consider using them to improve the performance of the sites and reduce their carbon footprint. For further details, For more details, see and . Those new template tags are also supported in Jinja templates, see for the Jinja API.

This feature was developed by Paarth Agarwal and Thibaud Colas as part of the Google Summer of Code program and a partnership with the Green Web Foundation and Green Coding Berlin, with support from Dan Braghiș, Thibaud Colas, Sage Abdullah, Arne Tarara (Green Coding Berlin), and Chris Adams (Green Web Foundation). We also thank Aman Pandey for introducing AVIF support in Wagtail 5.1, Andy Babic for creating AbstractImage.get_renditions() in the same release; and Storm Heg, Mitchel Cabuloy, Coen van der Kamp, Tom Dyson, and Chris Lawton for their feedback on RFC 71.

Support extending Wagtail client-side with Stimulus

Wagtail now officially supports client-side admin customizations with Stimulus. The developer documentation has a dedicated page about . This covers fundamental topics of client-side extensibility, such as:

• Adding custom JavaScript
• Extending with DOM events and Wagtail's custom DOM events
• Extending with Stimulus
• Extending with React

Thank you to core contributor LB (Ben) Johnston for writing this documentation.

ModelViewSet improvements

Several features from {class}~wagtail.snippets.views.snippets.SnippetViewSet have been implemented in {class}~wagtail.admin.viewsets.model.ModelViewSet, allowing you to use them without registering your models as snippets. For more details on using ModelViewSet, refer to .

• Move SnippetViewSet menu registration mechanism to base ViewSet class (Sage Abdullah)
• Move SnippetViewSet template override mechanism to ModelViewSet (Sage Abdullah)
• Move SnippetViewSet.list_display to ModelViewSet (Sage Abdullah)
• Move list_filter, filterset_class, search_fields, search_backend_name, list_export, export_filename, list_per_page, and ordering from SnippetViewSet to ModelViewSet (Sage Abdullah, Cynthia Kiser)
• Add default header titles to generic IndexView and CreateView (Sage Abdullah)
• Add the ability to use filters and to export listings in generic IndexView (Sage Abdullah)
• Add generic UsageView to ModelViewSet (Sage Abdullah)
• Add generic InspectView to ModelViewSet (Sage Abdullah)
• Extract generic HistoryView from snippets and add it to ModelViewSet (Sage Abdullah)
• Extract generic breadcrumbs functionality from page breadcrumbs (Sage Abdullah)
• Add breadcrumbs support to custom ModelViewSet views (Sage Abdullah)
• Allow ModelViewSet to be used with models that have non-integer primary keys (Sage Abdullah)
• Enable reference index tracking for models registered with ModelViewSet (Sage Abdullah)

In addition, the following new features have been added to the generic admin views as part of ModelViewSet, which can also be used with SnippetViewSet.

• Allow overriding IndexView.export_headings via ModelViewSet (Christer Jensen, Sage Abdullah)
• Add the ability to define listing buttons on generic IndexView (Sage Abdullah)

User interface refinements

Several tweaks have been made to the admin user interface which we hope will make it easier to use.

• Show the full first published at date within a tooltip on the Page status sidebar on the relative date (Rohit Sharma)
• Do not render minimap if there are no panel anchors (Sage Abdullah)
• Use dropdown buttons on listings in dashboard panels (Sage Abdullah)
• Implement breadcrumbs design refinements (Thibaud Colas)
• Add support for Shift + Click behavior in form submissions and simple translations submissions (LB (Ben) Johnston)
• Improve filtering of audit logging based on the user's permissions (Stefan Hammer)

External links in promoted search results

Promoted search result entries can now use an external URL along with custom link text, instead of linking to a page within Wagtail. This makes it easier to manage promoted content across multiple websites. Thank you to TopDevPros, and Brad Busenius from University of Chicago Library.

Other features

• Add support for Python 3.12 (Matt Westcott)
• Add wagtailcache and wagtailpagecache template tags to ensure previewing Pages or Snippets will not be cached (Jake Howard)
• Always set help text element ID for form fields with help text in field.html template (Sage Abdullah)
• When copying a page or creating an alias, copy its view restrictions to the destination (Sandeep Choudhary, Suyash Singh)
• Support pickling of StreamField values (pySilver)
• Remove wagtail.publish log action on aliases when they are created from live source pages or the source page is published (Dan Braghis)
• Remove wagtail.unpublish log action on aliases when source page is unpublished (Dan Braghis)
• Add compare buttons to workflow dashboard panel (Matt Westcott)
• Support specifying a get_object_list method on ChooserViewSet (Matt Westcott)
• Add linked_fields mechanism on chooser widgets to allow choices to be limited by fields on the calling page (Matt Westcott)
• Add support for merging cells within TableBlock with the mergedCells option (Gareth Palmer)
• When adding a panel within InlinePanel, focus will now shift to that content similar to StreamField (Faishal Manzar)
• Add support for placement in human_readable_date the tooltip template tag (Rohit Sharma)
• Support passing extra context variables via the {% component %} tag (Matt Westcott)
• Allow subclasses of PagesAPIViewSet override default Page model via the model attribute (Neeraj Yetheendran, Herbert Poul)
• Add support for subject and body in the Email link chooser form (TopDevPros, Alexandre Joly)
• Add a visual progress bar to the output of the wagtail_update_image_renditions management command (Faishal Manzar)
• Increase the read buffer size to improve efficiency and performance when generating file hashes for document or image uploads, use hashlib.file_digest if available (Python 3.11+) (Jake Howard)
• API ordering now supports multiple fields (Rohit Sharma, Jake Howard)
• Pass block value to Block.get_template to allow varying template based on value (Florian Delizy)
• Add InlinePanel DOM events for when ready and when items added or removed (Faishal Manzar)
• Support Filter instances as input for AbstractImage.get_renditions() (Thibaud Colas)
• Improve error messages for image template tags (Thibaud Colas)
• The purge_revisions management command now respects revisions that have an on_delete=PROTECT foreign key relation and won't delete them (Neeraj P Yetheendran, Meghana Reddy, Sage Abdullah, Storm Heg)

Bug fixes

• Ensure that StreamField's FieldBlocks correctly set the required and aria-describedby attributes (Storm Heg)
• Avoid an error when the moderation panel (admin dashboard) contains both snippets and private pages (Matt Westcott)
• When deleting collections, ensure the collection name is correctly shown in the success message (LB (Ben) Johnston)
• Filter out comments on Page editing counts that do not correspond to a valid field / block path on the page such as when a field has been removed (Matt Westcott)
• Allow PublishMenuItem to more easily support overriding its label via construct_page_action_menu (Sébastien Corbin)
• Allow locale selection when creating a page at the root level (Sage Abdullah)
• Ensure the admin login template correctly displays all non_fields_errors for any custom form validation (Sébastien Corbin)
• Ensure 'mark as active' label in workflow bulk action set active form can be translated (Rohit Sharma)
• Ensure the panel title for a user's settings correctly reflects the WAGTAIL_EMAIL_MANAGEMENT_ENABLED setting by not showing 'email' if disabled (Omkar Jadhav)
• Update Spotify oEmbed provider URL parsing to resolve correctly (Dhrűv)
• Update link colors within help blocks to meet accessible contrast requirements (Rohit Sharma)
• Ensure the search promotions popular search terms picker correctly refers to the correct model (LB (Ben) Johnston)
• Correctly quote non-numeric primary keys on snippet inspect view (Sage Abdullah)
• Prevent crash on snippet inspect view when displaying a null foreign key to an image (Sage Abdullah)
• Ensure that pages in moderation show as "Live + In Moderation" in the page explorer rather than "Live + Draft" (Sage Abdullah)
• Prevent error when updating reference index for objects with a lazy ParentalKey-related object (Chris Shaw)
• Ignore conflicts when inserting reference index entries to prevent race conditions causing uniqueness errors (Chris Shaw)
• Populate the correct return value when creating a new snippet within the snippet chooser (claudobahn)
• Reinstate missing filter by page type on page search (Matt Westcott)
• Ensure very long words can wrap when viewing saved comments (Chiemezuo Akujobi)
• Avoid forgotten password link text conflicting with the supplied aria-label (Thibaud Colas)
• Fix log message to record the correct restriction type when removing a page view restriction (Rohit Sharma, Hazh. M. Adam)
• Avoid potential race condition with new Page subscriptions on the edit view (Alex Tomkins)
• Use the correct action log when creating a redirect (Thibaud Colas)
• Ensure that all password fields consistently allow leading & trailing whitespace (Neeraj P Yetheendran)

Documentation

• Expand documentation on using ViewSet and ModelViewSet (Sage Abdullah)
• Document WAGTAILADMIN_BASE_URL on "Integrating Wagtail into a Django project" page (Shreshth Srivastava)
• Replace incorrect screenshot for authors listing on tutorial (Shreshth Srivastava)
• Add documentation for building non-model-based choosers using the queryish library (Matt Westcott)
• Fix incorrect tag library import on focal points example (Hatim Makki Hoho)
• Add reminder about including your custom Draftail feature in any overridden WAGTAILADMIN_RICH_TEXT_EDITORS setting (Charlie Sue)
• Mention the need to install python3-venv on Ubuntu (Brian Mugo)
• Document the use of the Google developer documentation style guide in documentation (Damilola Oladele)
• Fix Inconsistent URL Format in Getting Started tutorial (Olumide Micheal)
• Add more extensive documentation for the permission kwarg support in Panels (LB (Ben) Johnston)
• Update all FieldPanel('title') examples to use the recommended TitleFieldPanel('title') panel (Chinedu Ihedioha)

Maintenance

Stimulus adoption

As part of our adoption of Stimulus, in addition to the new documentation, we have migrated several existing components to the framework. Thank you to our core contributor LB who oversees this project, and to all contributors who refactored specific components.

• Migrate form submission listing checkbox toggling to the shared w-bulk Stimulus implementation (LB (Ben) Johnston)
• Migrate the editor unsaved messages popup to be driven by Stimulus using the shared w-message controller (LB (Ben) Johnston, Hussain Saherwala)
• Migrate all other data-tippy HTML attribute usage to the Stimulus data-*-value attributes for w-tooltip & w-dropdown (Subhajit Ghosh, LB (Ben) Johnston)
• Migrate select all on focus/click behavior to Stimulus, used on the image URL generator (Chiemezuo Akujobi)
• Add support for a reset method to support Stimulus driven dynamic field resets via the w-action controller (Chiemezuo Akujobi)
• Add support for a notify target on the Stimulus dialog for dispatching events internally (Chiemezuo Akujobi)
• Migrate publishing schedule dialog field resets to Stimulus (Chiemezuo Akujobi)

Other maintenance

• Fix snippet search test to work on non-fallback database backends (Matt Westcott)
• Update ESLint, Prettier & Jest npm packages (LB (Ben) Johnston)
• Add npm scripts for TypeScript checks and formatting SCSS files (LB (Ben) Johnston)
• Run tests in parallel in some of the CI setup (Sage Abdullah)
• Remove unused WorkflowStatus view, urlpattern, and workflow-status.js (Storm Heg)
• Add support for options/attrs in Telepath widgets so that attrs render on the created DOM (Storm Heg)
• Update pre-commit hooks to be in sync with latest changes to ESLint & Prettier for client-side changes (Storm Heg)
• Add WagtailTestUtils.get_soup() method for testing HTML content (Storm Heg, Sage Abdullah)
• Allow ViewSet subclasses to customize url_prefix and url_namespace logic (Matt Westcott)
• Simplify SnippetViewSet registration code (Sage Abdullah)
• Rename groups IndexView.results_template_name to results.html (Sage Abdullah)
• Allow viewsets to define a common set of view kwargs (Matt Westcott)
• Do not use jest inside stubs.js to prevent Storybook from crashing (LB (Ben) Johnston)
• Refactor snippets templates to reuse the shared slim_header.html template (Sage Abdullah)
• Refactor slim_header.html template to reduce code duplication (Sage Abdullah)
• Upgrade Willow to v1.6.2 to support MIME type data without reliance on imghdr (Jake Howard)
• Replace imghdr with Willow's built-in MIME type detection (Jake Howard)
• Replace @total_ordering usage with comparison functions implementation (Virag Jain)
• Replace <script type="text/django-form-template"><-/script> template approach with HTML template elements in InlinePanel and expanding formset (Mansi Gundre, Subhajit Ghosh, LB (Ben) Johnston)
• Refactor side panels code for better reuse in pages and snippets (Sage Abdullah)
• Deprecate legacy URL redirects in ModelViewSet and SnippetViewSet (Sage Abdullah)
• Simplify code for registering page listing action buttons (Matt Westcott)
• Removed the unused, legacy, Wagtail userbar views set up for an old iframe approach (Sage Abdullah)
• Optimize lru_cache usage (Jake Howard)
• Implement date_since in get_most_popular inside search_promotions.models.Query (TopDevPros)
• Refactor generic view subclasses to better reuse the generic templates and breadcrumbs (Sage Abdullah)
• Adopt consistent classname (not classnames) attributes for all MenuItem usage, including deprecation warnings (LB (Ben) Johnston)
• Adopt consistent classname (not classnames) attribute within the wagtail.images.formats.Format instance, including deprecation warnings (LB (Ben) Johnston)
• Deprecate context argument of construct_snippet_listing_buttons hook (Sage Abdullah)
• Deprecate legacy moderation system (Sage Abdullah)
• Update CI database versions (Jake Howard)
• Add changelog and issue tracker links to the PyPI project page (Panagiotis H.M. Issaris)
• Add better deprecation warnings to the search.Query & search.QueryDailyHits model, move final set of templates from the admin search module to the search promotions contrib module (LB (Ben) Johnston)

Upgrade considerations - changes affecting all projects

Changes to UUID fields on MariaDB when upgrading to Django 5.0

Django 5.0 introduces support for MariaDB's native UUID type on MariaDB 10.7 and above. This breaks backwards compatibility with CHAR-based UUIDs created on earlier versions of Django and MariaDB, and so upgrading a site to Django 5.0+ and MariaDB 10.7+ is liable to result in errors such as Data too long for column 'translation_key' at row 1 or Data too long for column 'uuid' at row 1 when creating or editing pages. To fix this, it is necessary to run the convert_mariadb_uuids management command (available as of Wagtail 5.2.5) after upgrading:

./manage.py convert_mariadb_uuids

This will convert all existing UUID fields used by Wagtail to the new format. New sites created under Django 5.0+ and MariaDB 10.7+ are unaffected.

Upgrade considerations - deprecation of old functionality

Legacy moderation system is deprecated

The legacy moderation system, which was replaced by the new workflow system in Wagtail 2.10, is now deprecated. Since Wagtail 2.10, submitting a page for moderation will use the new workflow system. However, the legacy moderation system is still in place for approving and rejecting pages that were submitted for moderation before Wagtail 2.10.

To view all pages that are still in the legacy moderation system backlog, you can sign in as a superuser and see if there is a "Pages awaiting moderation" section in the admin dashboard. You can approve or reject the pages from there. You can also do this programmatically by querying for Revision.objects.filter(submitted_for_moderation=True) and calling revision.approve_moderation() or revision.reject_moderation() on each revision.

The legacy moderation system will be removed in a future release. If you still have pages in the moderation queue that were submitted for moderation before Wagtail 2.10, you should approve or reject them before upgrading. See for more details.

As a result, the following features are now deprecated:

• wagtail.models.Revision.submitted_for_moderation
• wagtail.models.Revision.submitted_revisions
• wagtail.models.Revision.approve_moderation
• wagtail.models.Revision.reject_moderation
• The submitted_for_moderation argument in {meth}wagtail.models.RevisionMixin.save_revision
• WAGTAIL_MODERATION_ENABLED
• wagtail.admin.userbar.ModeratePageItem
• wagtail.admin.userbar.ApproveModerationEditPageItem
• wagtail.admin.userbar.RejectModerationEditPageItem
• wagtail.admin.views.home.PagesForModerationPanel
• wagtail.admin.views.pages.moderation
• wagtail.permission_policies.pages.PagePermissionPolicy.revisions_for_moderation

If you use any of the above features, remove them or replace them with the equivalent features from the new workflow system. The above features will be removed in a future release.

Upgrade considerations - changes affecting Wagtail customizations

Adoption of classname convention for MenuItem related classes and hooks

Wagtail MenuItem and menu hooks have been updated to use the more consistent naming of classname (singular) instead of classnames (plural), a convention that started in Wagtail 4.2.

The current classnames keyword argument naming will be supported, but will trigger a deprecation warning. Support for this variant will be removed in a future release.

The following classes will adopt this new convention.

• admin.menu.MenuItem
• admin.ui.sidebar.ActionMenuItem
• admin.ui.sidebar.LinkMenuItem
• admin.ui.sidebar.PageExplorerMenuItem
• contrib.settings.registry.SettingMenuItem

The following hooks usage may be impacted if classnames were used when generating menu items.

• register_admin_menu_item
• register_settings_menu_item

Example

from django.urls import reverse

from wagtail import hooks
from wagtail.admin.menu import MenuItem


@hooks.register("register_admin_menu_item")
def register_frank_menu_item():
    return MenuItem(
        "Frank",
        reverse("frank"),
        icon_name="folder-inverse",
        order=10000,
        classname="highlight-menu",  # not classnames=...
    )

Edit and delete URLs in ModelViewSet changed to allow non-integer primary keys

To accommodate models with non-integer primary keys, the URL patterns for the edit and delete views in {class}~wagtail.admin.viewsets.model.ModelViewSet have been changed.

Relative to the viewset's {attr}~wagtail.admin.viewsets.base.ViewSet.url_prefix, the following changes have been made:

• The edit URL pattern has been changed from <int:pk>/ to edit/<str:pk>/
• The delete URL pattern has been changed from <int:pk>/delete/ to delete/<str:pk>/

If you use {func}~django.urls.reverse with {meth}~wagtail.admin.viewsets.base.ViewSet.get_url_name to generate the URLs for these views, no changes are needed. However, if you have hard-coded these URLs in your code, you will need to update them to match the new patterns.

Redirects for the legacy URLs are in place for backwards compatibility, but will be removed in a future release.

The URLs for snippets underwent similar changes in Wagtail 2.14. The redirects for the legacy URLs in {class}~wagtail.snippets.views.snippets.SnippetViewSet have now been marked for removal in a future release.

ModelViewSet automatically registers the model to the reference index

Models that are registered with a ModelViewSet now have reference index tracking enabled by default. This means that you no longer need to call ReferenceIndex.register_model() in your app's ready() method for such models. If this is undesired, you can disable it by setting {attr}~wagtail.admin.viewsets.model.ModelViewSet.add_to_reference_index to False on the ModelViewSet subclass. For more details, see .

Groups IndexView.results_template_name renamed from results.html to index_results.html

The IndexView's results_template_name attribute in the GroupViewSet has been renamed from wagtailusers/groups/results.html to wagtailusers/groups/index_results.html for consistency with the other viewsets. If you have customized or extended the template, e.g. for , you will need to rename it to match the new name.

construct_snippet_listing_buttons hook no longer accepts a context argument

The construct_snippet_listing_buttons hook no longer accepts a context argument. If you have implemented this hook, you will need to remove the context argument from your implementation. If you need to access values computed by the view, you'll need to override the {attr}~wagtail.snippets.views.snippets.SnippetViewSet.index_view_class with a custom IndexView subclass. The get_list_buttons and get_list_more_buttons methods in particular may be overridden to customize the buttons on the listing.

Defining a function for this hook that accepts the context argument will raise a warning, and the function will receive an empty dictionary ({}) as the context. Support for defining the context argument will be completely removed in a future Wagtail release.

Hooks for page listing and page header buttons no longer accept a page_perms argument

The arguments passed to the hooks register_page_header_buttons, register_page_listing_buttons, construct_page_listing_buttons and register_page_listing_more_buttons have changed. For all of these hooks, the page_perms argument has been replaced by user; in addition, register_page_header_buttons is now passed a view_name argument, which is either 'edit' or 'index', depending on whether the button is being generated for the page listing or edit view. In summary, the changes are:

• register_page_header_buttons: Previously func(page, page_perms, next_url), now func(page, user, next_url, view_name).
• register_page_listing_buttons: Previously func(page, page_perms, next_url), now func(page, user, next_url).
• construct_page_listing_buttons: Previously func(buttons, page, page_perms, context), now fn(buttons, page, user, context).
• register_page_listing_more_buttons: Previously func(page, page_perms, next_url), now func(page, user, next_url).

Additionally, the ButtonWithDropdownFromHook constructor, and the resulting hook it creates, should now be passed a user argument instead of page_perms.

Existing code that performs permission checks using page_perms can retrieve the same permission tester object using page.permissions_for_user(user).

Hook functions using the old page_perms signature will continue to work, but this is deprecated and will raise a warning. Support for the old signature will be removed in a future Wagtail release.

Upgrade considerations - changes to undocumented internals

Breadcrumbs class name has changed

If using custom styling for the breadcrumbs, this class has changed from singular to plural for a more intuitive class.

Old	New
'w-breadcrumb'	'w-breadcrumbs'

Snippets templates refactored to reuse the shared slim_header.html template

The templates for the snippets views have been refactored to reuse the shared slim_header.html template. If you have customized or extended the templates, e.g. for , you will need to update them to match the new structure. As a result, the following templates have been removed:

• wagtailsnippets/snippets/headers/_base_header.html
• wagtailsnippets/snippets/headers/create_header.html
• wagtailsnippets/snippets/headers/edit_header.html
• wagtailsnippets/snippets/headers/history_header.html
• wagtailsnippets/snippets/headers/list_header.html
• wagtailsnippets/snippets/headers/usage_header.html

In most cases, the usage of those templates can be replaced with the wagtailadmin/shared/headers/slim_header.html template. Refer to the snippets views and templates code for more details.

BaseSidePanels, PageSidePanels and SnippetSidePanels classes are removed

The BaseSidePanels, PageSidePanels and SnippetSidePanels classes that were used to combine the side panels (i.e. status, preview and comments side panels) have been removed. Each side panel is now instantiated directly in the view. The wagtail.admin.ui.components.MediaContainer class can be used to combine the Media objects for the side panels.

The BasePreviewSidePanel, PagePreviewSidePanel and SnippetPreviewSidePanel classes have been replaced with the consolidated PreviewSidePanel class.

The BaseStatusSidePanel class has been renamed to StatusSidePanel.

If you use these classes in your code, you will need to update your code to instantiate the side panels directly in the view.

For example, if you have the following code:

from wagtail.admin.ui.side_panels import PageSidePanels


def my_view(request):
    ...

    side_panels = PageSidePanels(
        request,
        page.get_latest_revision_as_object(),
        show_schedule_publishing_toggle=False,
        live_page=page,
        scheduled_page=page.get_scheduled_revision_as_object(),
        in_explorer=False,
        preview_enabled=True,
        comments_enabled=False,
    )

    return render(
        request,
        template_name,
        {"page": page, "side_panels": side_panels, "media": side_panels.media},
    )

Update it to the following:

from wagtail.admin.ui.components import MediaContainer
from wagtail.admin.ui.side_panels import PageStatusSidePanel, PreviewSidePanel


def my_view(request):
    ...

    side_panels = [
        PageStatusSidePanel(
            page,
            request,
            show_schedule_publishing_toggle=False,
            live_object=page,
            scheduled_object=page.get_scheduled_revision_as_object(),
            locale=page.locale,
            translations=translations,
        ),
        PreviewSidePanel(
            page,
            request,
            preview_url=reverse("wagtailadmin_pages:preview_on_edit", args=[page.id]),
        ),
    ]
    side_panels = MediaContainer(side_panels)

    return render(
        request,
        template_name,
        {"page": page, "side_panels": side_panels, "media": side_panels.media},
    )

Breadcrumbs now use different data attributes and events

The undocumented JavaScript implementation for the header breadcrumbs component has been migrated to a Stimulus controller and now uses different data attributes.

This may impact custom header implementations that relied on the previous approach, custom breadcrumbs that did not use breadcrumbs and require the expand/collapse behavior may be impacted.

Events

Old	New
'wagtail:breadcrumbs-expand'	'w-breadcrumbs:opened'
'wagtail:breadcrumbs-collapse'	'w-breadcrumbs:closed'

Data attributes

Old	New
data-breadcrumb-next	data-controller="w-breadcrumbs"
data-toggle-breadcrumbs	data-w-breadcrumbs-target="toggle" data-action="w-breadcrumbs#toggle mouseenter->w-breadcrumbs#peek"
data-breadcrumb-item	data-w-breadcrumbs-target="content"

Note that the root DOM element also includes a set of additional data attributes to function as the breadcrumbs:

data-controller="w-breadcrumbs"
data-action="keyup.esc@document->w-breadcrumbs#close w-breadcrumbs:open@document->w-breadcrumbs#open w-breadcrumbs:close@document->w-breadcrumbs#close"
data-w-breadcrumbs-close-icon-class="icon-cross"
data-w-breadcrumbs-closed-value="true"
data-w-breadcrumbs-open-icon-class="icon-breadcrumb-expand"
data-w-breadcrumbs-opened-content-class="w-max-w-4xl"
data-w-breadcrumbs-peek-target-value="header"

window.updateFooterSaveWarning global util removed

The undocumented global util window.updateFooterSaveWarning has been removed, this is part of the footer 'unsaved' messages toggling behavior on page forms. This behavior has now moved to a Stimulus controller and leverages DOM events instead. Calling this function will do nothing and in a future release will throw an error.

You can implement roughly the equivalent functionality with this JavaScript function, however, this will not be guaranteed to work in future releases.

window.updateFooterSaveWarning = (formDirty, commentsDirty) => {
  if (!formDirty && !commentsDirty) {
    document.dispatchEvent(new CustomEvent('w-unsaved:clear'));
  } else {
    const [type] = [
      formDirty && commentsDirty && 'all',
      commentsDirty && 'comments',
      formDirty && 'edits',
    ].filter(Boolean);
    document.dispatchEvent(new CustomEvent('w-unsaved:add', { detail: { type } }));
  }
};

dropdown template tag argument toggle_tippy_offset renamed to toggle_tooltip_offset

The naming conventions for tippy related attributes have been updated to align with the generic tooltip naming.

If you are using the undocumented dropdown template tag with the offset arg, this will need to be updated.

Old	New
{% dropdown toggle_tippy_offset="[0, -2]" %}...{% enddropdown %}	{% dropdown toggle_tooltip_offset="[0, -2]" %}...{% enddropdown %}

escapescript template tag and escape_script functions are deprecated

As of this release, the undocumented coreutils.escape_script util and escapescript template tag will no longer be supported.

This was used to provide a way for HTML template content in IE11, which is no longer supported, and was non-compliant with CSP support.

The current approach will trigger a deprecation warning and will be removed in a future release.

Old

{% load wagtailadmin_tags %}
<script type="text/django-form-template" id="id_{{ formset.prefix }}-EMPTY_FORM_TEMPLATE">
    {% escapescript %}
        <div>Widget template content</div>
        <script src="/js/my-widget.js"></script>
    {% endescapescript %}
</script>

New

Use the HTML template element to avoid content from being parsed by the browser on load.

<template id="id_{{ formset.prefix }}-EMPTY_FORM_TEMPLATE">
    <div>Widget template content</div>
    <script src="/js/my-widget.js"></script>
</template>

Adoption of classname convention within the Image Format instance

When using wagtail.images.formats.Format, the created instance set the argument for classes to the attribute classnames (plural), this has now changed to classname (singular).

For any custom code that accessed or modified this undocumented attribute, updates will need to be made as follows.

Accessing self.classnames will still work until a future release, simply returning self.classname, but this will raise a deprecation warning.

# image_formats.py
from django.utils.html import format_html
from wagtail.images.formats import Format, register_image_format


class CustomImageFormat(Format):
    def image_to_html(self, image, alt_text, extra_attributes=None):
        # contrived example - pull out the class and render on outside element
        classname = self.classname  # not self.classnames
        self.classname = ""  # not self.classnames
        inner_html = super().image_to_html(image, alt_text, extra_attributes)
        return format_html(
            "<custom-image class='{}'>{}</custom-image>", classname, inner_html
        )


custom_format = CustomImageFormat(
    "custom_example", "Custom example", "example-image object-fit", "width-750"
)

register_image_format(custom_format)

Changes to search promotions contrib module

Deprecated search_garbage_collect management command has been removed

In 5.0 the documentation advised that the search_garbage_collect command used to remove old stored search queries and daily hits has been moved to searchpromotions_garbage_collect.

The old command has now been fully removed and if called will throw an error.

Changes to URL names and templates

Some search promotions URLs and templates have now moved from the main admin search module into the search promotions module.

Item	Old	New
URL name	wagtailsearch_admin:queries_chooser	wagtailsearchpromotions:chooser
URL name	wagtailsearch_admin:queries_chooserresults	wagtailsearchpromotions:queries_chooserresults
Template	wagtail/search/templates/wagtailsearch/queries/chooser/chooser.html	wagtail/contrib/search_promotions/templates/wagtailsearchpromotions/queries/chooser/chooser.html
Template	wagtail/search/templates/wagtailsearch/queries/chooser/results.html	wagtail/contrib/search_promotions/templates/wagtailsearchpromotions/queries/chooser/results.html
Template	wagtail/search/templates/wagtailsearch/queries/chooser_field.html	wagtail/contrib/search_promotions/templates/wagtailsearchpromotions/queries/chooser_field.html

Block.get_template now accepts a value argument

The get_template method on StreamField blocks now accepts a value argument in addition to context. Code using the old signature should be updated:

# Old
def get_template(self, context=None): ...


# New
def get_template(self, value=None, context=None): ...

Wagtail 5.1.3 release notes

October 19, 2023

---
local:
depth: 1
---

What's new

CVE-2023-45809: Disclosure of user names via admin bulk action views

This release addresses an information disclosure vulnerability in the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any changes, the error message discloses the display names of user accounts, and by modifying URL parameters, the user can retrieve the display name for any user. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Many thanks to quyenheu for reporting this issue. For further details, please see the CVE-2023-45809 security advisory.

Bug fixes

• Fix SnippetBulkAction not respecting models definition (Sandro Rodrigues)
• Correctly quote non-numeric primary keys on snippet inspect view (Sage Abdullah)
• Prevent crash on snippet inspect view when displaying a null foreign key to an image (Sage Abdullah)
• Populate the correct return value when creating a new snippet within the snippet chooser (claudobahn)
• Reinstate missing filter by page type on page search (Matt Westcott)
• Use the correct action log when creating a redirect (Thibaud Colas)

Wagtail 5.1.2 release notes

September 25, 2023

---
local:
depth: 1
---

What's new

Bug fixes

• Avoid use of ignore_conflicts when creating extra permissions for snippets, for SQL Server compatibility (Sage Abdullah)
• Ensure sequence on wagtailsearchpromotions_query table is correctly set after migrating data (Jake Howard)
• Change spreadsheet export headings to match listing view column headings (Christer Jensen, Sage Abdullah)
• Fix numbers, booleans, and None from being exported as strings (Christer Jensen)
• Restore fallback on full-word search for snippet choosers and generic index views (Matt Westcott)
• Restore compatibility with pre-7.15 versions of the Elasticsearch Python library, allowing use of Opensearch (Matt Westcott)
• Fix error when pickling BaseSiteSetting instances (Matt Westcott)
• For Python 3.13 support - upgrade Willow to v1.6.2, replace imghdr with Willow's built-in MIME type detection (Jake Howard)

Upgrade considerations

Search within chooser interfaces requires AutocompleteField for full functionality

In Wagtail 4.2, the search bar within snippet chooser interfaces (and custom choosers created via ChooserViewSet) returned results for partial word matches - for example, a search for "wagt" would return results containing "Wagtail" - if this was supported by the search backend in use, and at least one AutocompleteField was present in the model's search_fields definition. Otherwise, it would fall back to only matching on complete words. In Wagtail 5.0, this fallback behavior was removed, and consequently a model with no AutocompleteFields in place would return no results.

As of Wagtail 5.1.2, the fallback behavior has been restored. Nevertheless, it is strongly recommended that you add AutocompleteField to your models' search_fields definitions, to ensure that users can receive search results continuously as they type. For example:

from wagtail.search import index
# ... other imports


@register_snippet
class MySnippet(index.Indexed, models.Model):
    search_fields = [
        index.SearchField("name"),
        index.AutocompleteField("name"),
    ]

Wagtail 5.1.1 release notes

August 14, 2023

---
local:
depth: 1
---

What's new

Other features

• Introduce wagtail.admin.ui.tables.BooleanColumn to display boolean values as icons (Sage Abdullah)

Bug fixes

• Show not-None falsy values instead of blank in generic table cell template (Sage Abdullah)
• Fix read_only panels for fields with translatable choice labels (Florent Lebreton)

3.2, 4.1, 4.2

3.8, 3.9, 3.10, 3.11

Wagtail 5.1 release notes

August 1, 2023

---
local:
depth: 1
---

What's new

Read-only panels

FieldPanels can now be marked as read-only with the read_only=True keyword argument, so that they are displayed in the admin but cannot be edited. This feature was developed by Andy Babic.

Wagtail tutorial improvements

As part of Google Season of Docs 2023, we worked with technical writer Damilola Oladele to make improvements to Wagtail’s "Getting started" tutorial. Here are the specific changes made as part of this project:

• Revamp the start of the getting started section, with a separate quick install page
• Move the tutorial’s snippets section to come before tags
• Rewrite the getting started tutorial to address identified friction points
• Switch the Getting started tutorial’s snippets example to be more understandable

Thank you to Damilola for his work, and to Google for sponsoring this project.

Custom template support for wagtail start

The wagtail start command now supports an optional --template argument that allows you to specify a custom project template to use. This is useful if you want to use a custom template that includes additional features or customizations. For more details, see the project template reference. This feature was developed by Thibaud Colas.

Search query boosting on Elasticsearch 6 and above

The boost option on SearchField, to increase the ranking of search results that match on the specified field, is now respected by Elasticsearch 6 and above. This was previously only supported up to Elasticsearch 5, due to a change in Elasticsearch's API. This feature was developed by Shohan Dutta Roy.

Elasticsearch 8 support

This release adds support for Elasticsearch 8. This can be set up by installing a version 8.x release of the elasticsearch Python package, and setting wagtail.search.backends.elasticsearch8 as the search backend. Compatibility updates were contributed by Matt Westcott and Wesley van Lee.

Extend Stimulus adoption

As part of tackling Wagtail’s technical debt and improving CSP compatibility, we have continued extending our usage of Stimulus, based on the plans laid out in RFC 78: Adopt Stimulus.

• Add support for attrs on FieldPanel and other panels to aid in custom Stimulus usage (Aman Pandey, Antoni Martyniuk, LB (Ben) Johnston)
• Migrate Tagit initialization to a Stimulus Controller (LB (Ben) Johnston)
• Migrate legacy dropdown implementation to a Stimulus controller (Thibaud Colas)
• Migrate async header search and search with the Task chooser modal to w-swap, a Stimulus controller (LB (Ben) Johnston)
• Replace Bootstrap tooltips with a new w-tooltip Stimulus controller (LB (Ben) Johnston)
• Migrate dialog instantiation to a new w-dialog Stimulus controller (Loveth Omokaro, LB (Ben) Johnston)
• Support dialog template cloning using a new w-teleport Stimulus controller (Loveth Omokaro, LB (Ben) Johnston)

AVIF image support

Wagtail now supports AVIF, a modern image format. We encourage all site implementers to consider using it to improve the performance of the sites and reduce their carbon footprint. For further details, see image file format, output image format and image quality.

This feature was developed by Aman Pandey as part of the Google Summer of Code program and a partnership with the Green Web Foundation and Green Coding Berlin, with support from Dan Braghis, Thibaud Colas, Sage Abdullah, Arne Tarara (Green Coding Berlin), and Chris Adams (Green Web Foundation).

Permissions consolidation

This release includes several changes to permissions, to make them easier to use and maintain, as well as to improve performance.

• Add initial implementation of PagePermissionPolicy (Sage Abdullah)
• Refactor UserPagePermissionsProxy and PagePermissionTester to use PagePermissionPolicy (Sage Abdullah, Tidiane Dia)
• Optimise queries in collection permission policies using cache on the user object (Sage Abdullah)
• Prevent 'choose' permission from being ignored when looking up 'choose', 'edit' and 'delete' permissions in combination (Sage Abdullah)
• Take user's permissions into account for image / document counts on the admin dashboard (Sage Abdullah)
• Deprecate UserPagePermissionsProxy (Sage Abdullah)
• Refactor GroupPagePermission to use Django's Permission model (Sage Abdullah)

Snippet enhancements

We have made several improvements to snippets as part of RFC 85: Snippets parity with ModelAdmin, ahead of the deprecation of ModelAdmin contrib app.

• Add the ability to export snippets listing via SnippetViewSet.list_export (Sage Abdullah)
• Add Inspect view to snippets (Sage Abdullah)
• Reorganise snippets documentation to cover customizations and optional features (Sage Abdullah)
• Add docs for migrating from ModelAdmin to Snippets (Sage Abdullah)
• Purge revisions of non-page models in purge_revisions command (Sage Abdullah)

Other features

• Mark calls to md5 as not being used for secure purposes, to avoid flagging on FIPS-mode systems (Sean Kelly)
• Return filters from parse_query_string as a QueryDict to support multiple values (Aman Pandey)
• Explicitly specify MenuItem.name for all admin menu and submenu items (Justin Koestinger)
• Add oEmbed provider patterns for YouTube Shorts (e.g. https://www.youtube.com/shorts/nX84KctJtG0) and YouTube Live URLs (valnuro, Fabien Le Frapper)
• Add a predictable default ordering of the "Object/Other permissions" in the Group Editing view, allow this ordering to be customized (Daniel Kirkham)
• Implement a new design for chooser buttons with better accessibility (Thibaud Colas)
• Add AbstractImage.get_renditions() for efficient generation of multiple renditions (Andy Babic)
• Phone numbers entered via a link chooser will now have any spaces stripped out, ensuring a valid href="tel:..." attribute (Sahil Jangra)
• Auto-select the StreamField block when only one block type is declared (Sébastien Corbin)
• Add support for more advanced Draftail customization APIs (Thibaud Colas)
• Add support for adding HTML attrs on FieldPanel, FieldRowPanel, MultiFieldPanel, and others (Aman Pandey, Antoni Martyniuk, LB (Ben) Johnston)
• Change to always cache renditions (Jake Howard)
• Update link/document rich text tooltips for consistency with the inline toolbar (Albina Starykova)
• Increase the contrast between the rich text / StreamField block picker and the page in dark mode (Albina Starykova)
• Change the default WebP quality to 80 to match AVIF (Aman Pandey)
• Adopt optimized Wagtail logo in the admin interface (Albina Starykova)
• Add support for presenting the userbar (Wagtail button) in dark mode (Albina Starykova)

Bug fixes

• Prevent choosers from failing when initial value is an unrecognized ID such as when moving a page from a location where parent_page_types would disallow it (Dan Braghis)
• Move comment notifications toggle to the comments side panel (Sage Abdullah)
• Remove comment button on InlinePanel fields (Sage Abdullah)
• Fix missing link to UsageView from EditView for snippets (Christer Jensen)
• Prevent lowercase conversions of IndexView column headers (Virag Jain)
• Ensure that RichText objects with the same values compare as equal (NikilTn)
• Use gettext_lazy on generic model views so that language settings are correctly used (Matt Westcott)
• Prevent JS error when reverting the spinner on a submit button after a validation error (LB (Ben) Johnston)
• Prevent crash when comparing page revisions that include MultipleChooserPanel (Matt Westcott)
• Ensure that title and slug continue syncing after entering non-URL-safe characters (LB (Ben) Johnston)
• Ensure that title and slug are synced on keypress, not just on blur (LB (Ben) Johnston)
• Add a more visible active state for side panel toggle buttons (Thibaud Colas)
• Debounce and optimize live preview panel to prevent excessive requests (Sage Abdullah)
• Page listings actions under the "More" dropdown are now accessible for screen reader and keyboard users (Thibaud Colas)
• Bulk actions under the "More" dropdown are now accessible for screen reader and keyboard users (Thibaud Colas)
• Navigation to translations via the locale dropdown is now accessible for screen reader and keyboard users (Thibaud Colas)
• Make it possible for speech recognition users to reveal chooser buttons (Thibaud Colas)
• Use constant-time comparison for image serve URL signatures (Jake Howard)
• Ensure taggit field type-ahead options show correctly in the dark mode theme (Sage Abdullah)
• Fix the lock description message missing the model_name variable when locked only by system (Sébastien Corbin)
• Fix empty blocks created in migration operations (Sandil Ranasinghe)
• Ensure that gettext_lazy works correctly when using verbose_name on a generic Settings models (Sébastien Corbin)
• Remove unnecessary usage of innerHTML when modifying DOM content (LB (Ben) Johnston)
• Avoid ValueError when extending PagesAPIViewSet and setting meta_fields to an empty list (Henry Harutyunyan, Alex Morega)
• Improve accessibility for header search, remove autofocus on page load, advise screen readers that content has changed when results update (LB (Ben) Johnston)
• Fix incorrect override of PagePermissionHelper.user_can_unpublish_obj() in ModelAdmin (Sébastien Corbin)
• Prevent memory exhaustion when updating a large number of image renditions (Jake Howard)
• Add missing Time Zone conversions and date formatting throughout the admin (Stefan Hammer)
• Ensure that audit logs and revisions consistently use UTC and add migration for existing entries (Stefan Hammer)
• Make sure "critical" buttons have enough color contrast in dark mode (Albina Starykova)
• Improve visibility of scheduled publishing errors in status side panel (Sage Abdullah)
• Avoid N+1 queries in users index view (Tidiane Dia)
• Use a theme-agnostic color token for read-only panels support in dark mode (Thibaud Colas)
• Ensure collapsible StreamBlocks expand as necessary to show validation errors (Storm Heg)
• Ensure userbar dialog can sit above other website content (LB (Ben) Johnston)
• Fix preview panel loading issues (Sage Abdullah)
• Fix search_promotions 0004_copy_queries migration for long-lived Wagtail instances (Sage Abdullah)
• Guard against TypeError in 0088_fix_log_entry_json_timestamps migration (Sage Abdullah)
• Add migration to replace JSON null values with empty objects in log entries' data (Sage Abdullah)
• Fix typo in the page_header_buttons template tag when accessing the context's request object (Robert Rollins)

Documentation

• Document how to add non-ModelAdmin views to a ModelAdminGroup (Onno Timmerman)
• Document how to add StructBlock data to a StreamField (Ramon Wenger)
• Update ReadTheDocs settings to v2 to resolve urllib3 issue in linkcheck extension (Thibaud Colas)
• Update documentation for log_action parameter on RevisionMixin.save_revision (Christer Jensen)
• Update color customization guidance to include theme-agnostic options (Thibaud Colas)
• Mark LTS releases in release note page titles (Thiago C. S. Tioma)
• Revise main Getting started tutorial for clarity (Kevin Chung (kev-odin))
• Update the deployment documentation page and remove outdated information (Jake Howard)
• Add more items to performance page regarding pre-fetching images and frontend caching (Jake Howard)
• Add docs for managing stored queries in searchpromotions (Scott Foster)

Maintenance

• Removed support for Python 3.7 (Dan Braghis)
• Switch to ruff for flake8 / isort code checking (Oliver Parker)
• Deprecate insert_editor_css in favour of insert_global_admin_css (Ester Beltrami)
• Optimise use of specific on Task and TaskState (Matt Westcott)
• Use table UI component for workflow task index view (Matt Westcott)
• Make header search available on generic index view (Matt Westcott)
• Update pagination behavior to reject out-of-range / invalid page numbers (Matt Westcott)
• Remove color tokens which are duplicates / unused (Thibaud Colas)
• Add tests to help with maintenance of theme color tokens (Thibaud Colas)
• Split out a base listing view from generic index view (Matt Westcott)
• Update type hints in admin/ui/components.py so that parent_context is mutable (Andreas Nüßlein)
• Optimise the Settings context processor to avoid redundantly finding a Site to improve cache ratios (Jake Howard)
• Convert page listing to a class-based view (Matt Westcott)
• Clean up page reports and type usage views to be independent of page listing views (Matt Westcott)
• Refactor "More" dropdowns, locale selector, "Switch locales", page actions, to use the same dropdown component (Thibaud Colas)
• Convert the CONTRIBUTORS file to Markdown (Dan Braghis)
• Move django-filter version upper bound to v23 (Yuekui)
• Update Pillow dependency to allow 10.x, only include support for >= 9.1.0 (Yuekui)
• Replace ModelAdmin history header human readable date template tag (LB (Ben) Johnston)
• Update uuid to v9 and Jest to v29, with jest-environment-jsdom and new snapshot format (LB (Ben) Johnston)
• Update test cases producing undesirable console output due to missing mocks, uncaught errors, warnings (LB (Ben) Johnston)
• Remove unused snippets _header_with_history.html template (Thibaud Colas)
• Migrate away from using the "wagtailadmin/shared/field_as_li.html" template include (Storm Heg)
• Upgrade documentation theme sphinx_wagtail_theme to v6.1.1 which includes multiple styling fixes and always visible code copy buttons (LB (Ben) Johnston)
• Don't update the reference index while deleting it (Andy Chosak)

Upgrade considerations - changes affecting all projects

Search within chooser interfaces requires AutocompleteField for full functionality

In Wagtail 4.2, the search bar within snippet chooser interfaces (and custom choosers created via ChooserViewSet) returned results for partial word matches - for example, a search for "wagt" would return results containing "Wagtail" - if this was supported by the search backend in use, and at least one AutocompleteField was present in the model's search_fields definition. Otherwise, it would fall back to only matching on complete words. In Wagtail 5.0, this fallback behavior was removed, and consequently a model with no AutocompleteFields in place would return no results.

As of Wagtail 5.1.2, the fallback behavior has been restored. Nevertheless, it is strongly recommended that you add AutocompleteField to your models' search_fields definitions, to ensure that users can receive search results continuously as they type. For example:

from wagtail.search import index
# ... other imports


@register_snippet
class MySnippet(index.Indexed, models.Model):
    search_fields = [
        index.SearchField("name"),
        index.AutocompleteField("name"),
    ]

GroupPagePermission now uses Django's Permission model

The GroupPagePermission model that is responsible for assigning page permissions to groups now uses Django's Permission model instead of a custom string. This means that the permission_type CharField has been deprecated and replaced with a permission ForeignKey to the Permission model.

In addition to this, "edit" permissions now use the term change within the code. As a result, GroupPagePermissions that were previously recorded with permission_type="edit" are now recorded with a Permission object that has the codename="change_page" and a content_type that points to the Page model. Any permission checks that are done using PagePermissionPolicy should also use change instead of edit.

If you have any fixtures for the GroupPagePermission model, you will need to update them to use the new Permission model. For example, if you have a fixture that looks like this:

{
  "pk": 11,
  "model": "wagtailcore.grouppagepermission",
  "fields": {
    "group": ["Event moderators"],
    "page": 12,
    "permission_type": "edit"
  }
}

Update it to use a natural key for the permission field instead of the permission_type field:

{
  "pk": 11,
  "model": "wagtailcore.grouppagepermission",
  "fields": {
    "group": ["Event moderators"],
    "page": 12,
    "permission": ["change_page", "wagtailcore", "page"]
  }
}

If you have any code that creates GroupPagePermission objects, you will need to update it to use the Permission model instead of the permission_type string. For example, if you have code that looks like this:

from wagtail.models import GroupPagePermission

permission = GroupPagePermission(group=group, page=page, permission_type="edit")
permission.save()

Update it to use the Permission model instead:

from django.contrib.auth.models import Permission
from wagtail.models import GroupPagePermission

permission = GroupPagePermission(
    group=group,
    page=page,
    permission=Permission.objects.get(
        content_type__app_label="wagtailcore", codename="change_page"
    ),
)
permission.save()

During the deprecation period, the permission_type field will still be available on the GroupPagePermission model and is used to automatically populate empty permission field as part of a system check. The permission_type field will be removed in Wagtail 6.0.

The default ordering of Group Editing Permissions models has changed

The ordering for "Object permissions" and "Other permissions" now follows a predictable order equivalent to Django's default Model ordering. This will be different to the previous indeterminate ordering.

The default ordering is now ["content_type__app_label", "content_type__model"]. See for details on how to customize this order.

JSON-timestamps stored in ModelLogEntry and PageLogEntry are now ISO-formatted and UTC

Previously, timestamps stored in the "data"-JSONField of ModelLogEntry and PageLogEntry have used the custom python format %d %b %Y %H:%M. Additionally, the "go_live_at" timestamp had been stored with the configured local timezone, instead of UTC.

This has now been fixed, all timestamps are now stored as UTC, and because the "data"-JSONField now uses Django's DjangoJSONEncoder, those datetime objects are now automatically converted to the ISO format. This release contains a new migration 0088_fix_log_entry_json_timestamps which converts all existing timestamps used by Wagtail to the new format.

If you've developed your own subclasses of ModelLogEntry, PageLogEntry or BaseLogEntry, or used those existing models to create custom log entries, and you've stored timestamps similarly to Wagtail's old implementation (using strftime("%d %b %Y %H:%M")). You may want to adapt the storage of those timestamps to a consistent format too.

There are probably three places in your code, which have to be changed:

1. Creation: Instead of using strftime("%d %b %Y %H:%M"), you can now store the datetime directly in the "data" field. We've implemented a new helper wagtail.utils.timestamps.ensure_utc(), which ensures the correct timezone (UTC).
2. Display: To display the timestamp in the user's timezone and format with a LogFormatter, we've created utils to parse (wagtail.utils.timestamps.parse_datetime_localized()) and render (wagtail.utils.timestamps.render_timestamp()) those timestamps. Look at the existing formatters here.
3. Migration: You can use the code of the above migration (source) as a guideline to migrate your existing timestamps in the database.

Image Renditions are now cached by default

Wagtail will try to use the cache called "renditions". If no such cache exists, it will fall back to using the default cache. You can configure the "renditions" cache to use a different cache backend or to provide additional configuration parameters.

Upgrade considerations - deprecation of old functionality

Removed support for Python 3.7

Python 3.7 is no longer supported as of this release; please upgrade to Python 3.8 or above before upgrading Wagtail.

Pillow dependency update

Wagtail no longer supports Pillow versions below 9.1.0.

Elasticsearch 5 and 6 backends are deprecated

The Elasticsearch 5 and 6 search backends are deprecated and will be removed in a future release; please upgrade to Elasticsearch 7 or above.

insert_editor_css hook is deprecated

The insert_editor_css hook has been deprecated. The insert_global_admin_css hook has the same functionality, and all uses of insert_editor_css should be changed to insert_global_admin_css.

wagtail.contrib.modeladmin is deprecated

As part of the RFC 85: Snippets parity with ModelAdmin implementation, the wagtail.contrib.modeladmin app is deprecated. To manage non-page models in Wagtail, use wagtail.snippets instead.

If you still rely on ModelAdmin, use the separate wagtail-modeladmin package. The wagtail.contrib.modeladmin module will be removed in a future release.

UserPagePermissionsProxy is deprecated

The undocumented wagtail.models.UserPagePermissionsProxy class is deprecated.

If you use the .for_page(page) method of the class to get a PagePermissionTester instance, you can replace it with page.permissions_for_user(user).

If you use the other methods, they can be replaced via the wagtail.permission_policies.pages.PagePermissionPolicy class. The following is a list of the PagePermissionPolicy equivalent of each method:

from wagtail.models import UserPagePermissionsProxy
from wagtail.permission_policies.pages import PagePermissionPolicy

# proxy = UserPagePermissionsProxy(user)
permission_policy = PagePermissionPolicy()

# proxy.revisions_for_moderation()
permission_policy.revisions_for_moderation(user)

# proxy.explorable_pages()
permission_policy.explorable_instances(user)

# proxy.editable_pages()
permission_policy.instances_user_has_permission_for(user, "change")

# proxy.can_edit_pages()
permission_policy.instances_user_has_permission_for(user, "change").exists()

# proxy.publishable_pages()
permission_policy.instances_user_has_permission_for(user, "publish")

# proxy.can_publish_pages()
permission_policy.instances_user_has_permission_for(user, "publish").exists()

# proxy.can_remove_locks()
permission_policy.user_has_permission(user, "unlock")

The UserPagePermissionsProxy object that is available in page's ActionMenuItem context as user_page_permissions (which might be used as part of a register_page_action_menu_item hook) has been deprecated. In cases where the page object is available (e.g. the page edit view), the PagePermissionTester object stored as the user_page_permissions_tester context variable can still be used.

The UserPagePermissionsProxy object that is available in the template context as user_page_permissions as a side-effect of the page_permissions template tag has also been deprecated.

If you use the user_page_permissions context variable or use the UserPagePermissionsProxy class directly, make sure to replace it either with the PagePermissionTester or the PagePermissionPolicy equivalent.

get_pages_with_direct_explore_permission, get_explorable_root_page, and users_with_page_permission are deprecated

The undocumented get_pages_with_direct_explore_permission and get_explorable_root_page functions in wagtail.admin.navigation are deprecated. They can be replaced with PagePermissionPolicy().instances_with_direct_explore_permission(user) and PagePermissionPolicy().explorable_root_instance(user), respectively.

The undocumented users_with_page_permission function in wagtail.admin.auth is also deprecated. It can be replaced with PagePermissionPolicy().users_with_permission_for_instance(action, page, include_superusers).

Shared include wagtailadmin/shared/last_updated.html is no longer available

The undocumented shared include wagtailadmin/shared/last_updated.html is no longer available as it used the legacy Bootstrap tooltips and was not accessible. If you need to achieve a similar output, an element that shows a simple date with a tooltip for the full date, use the human_readable_date template tag instead.

Before

{% include "wagtailadmin/shared/last_updated.html" with last_updated=my_model.timestamp %}

After

{% load wagtailadmin_tags %}

<!-- ... -->
{% human_readable_date my_model.timestamp %}

Shared include field_as_li.html will be removed

The documented include "wagtailadmin/shared/field_as_li.html" will be removed in a future release, if being used it will need to be replaced with "wagtailadmin/shared/field.html" wrapped within li tags.

Before

{% include "wagtailadmin/shared/field_as_li.html" %}

After

<li>
    {% include "wagtailadmin/shared/field.html" %}
</li>

Upgrade considerations - changes affecting Wagtail customizations

Tag (Tagit) field usage now relies on data attributes

The AdminTagWidget widget has now been migrated to a Stimulus controller, if using this widget in Python, no changes are needed to adopt the new approach.

If the widget is being instantiated in JavaScript or HTML with the global util window.initTagField, this undocumented util should be replaced with the new data-* attributes approach. Additionally, any direct usage of the jQuery widget in JavaScript (e.g. $('#my-element).tagit()) should be removed.

The global util will be removed in a future release. It is recommended that the documented AdminTagWidget be used. However, if you need to use the JavaScript approach you can do this with the following example.

Old syntax

<input id="id_tags" type="text" value="popular, technology" hidden />
<script>
    window.initTagField('id_tags', 'path/to/url', { autocompleteOnly: true });
</script>

New syntax

<input
    id="id_tags"
    type="text"
    value="popular, technology"
    hidden
    data-controller="w-tag"
    data-w-tag-options-value='{"autocompleteOnly": true}'
    data-w-tag-url-value="/path/to/url"
/>

Note: The data-w-tag-options-value is a JSON object serialized into string. Django's HTML escaping will handle it automatically when you use the AdminTagWidget, but if you are manually writing the attributes, be sure to use quotation marks correctly.

Header searching now relies on data attributes

Previously the header search relied on inline scripts and a window.headerSearch global to activate the behavior. This has now changed to a data attributes approach and the window global usage will be removed in a future major release.

If you are using the documented Wagtail viewsets, Snippets or ModelAdmin approaches to building custom admin views, there should be no change required.

If you are using the shared header template include for a custom search integration, here's how to adopt the new approach.

Header include before

{% extends "wagtailadmin/base.html" %}
{% load wagtailadmin_tags %}
{% block extra_js %}
    {{ block.super }}
    <script>
        window.headerSearch = {
            url: "{% url 'myapp:search_results' %}",
            termInput: '#id_q',
            targetOutput: '#my-results',
        };
    </script>
{% endblock %}
{% block content %}
    {% include "wagtailadmin/shared/header.html" with title="my title" search_url="myapp:index" %}
    ... other content
{% endblock %}

Header include after

Note: No need for extra_js usage at all.

{% extends "wagtailadmin/base.html" %}
{% load wagtailadmin_tags %}
{% block content %}
    {% url 'myapp:search_results' as search_results_url %}
    {% include "wagtailadmin/shared/header.html" with title="my title" search_url="myapp:index" search_results_url=search_results_url search_target="#my-results" %}
    ... other content
{% endblock %}

Alternatively, if you have customizations that manually declare or override window.headerSearch, here's how to adopt the new approach.

Manual usage before

<script>
    window.headerSearch = {
        url: '{{ my_async_results_url }}',
        termInput: '#id_q',
        targetOutput: '#some-results',
    };
</script>
<form role="search">
    <input type="text" name="q" id="id_q" />
</form>
<div id="some-results"></div>

Manual usage after

<form
    role="search"
    data-controller="w-swap"
    data-action="change->w-swap#searchLazy input->w-swap#searchLazy"
    data-w-swap-src-value="{{ my_async_results_url }}"
    data-w-swap-target-value="#some-results"
>
    <input type="text" name="q" id="id_q" data-w-swap-target="input" />
</form>
<div id="some-results"></div>

Tooltips now rely on new data attributes

The undocumented Bootstrap jQuery tooltip widget is no longer in use, you will need to update any HTML that is using these attributes to the new syntax.

<!-- Old attributes: -->
<span data-wagtail-tooltip="Tooltip content here">Label</span>
<!-- New attributes: -->
<span data-controller="w-tooltip" data-w-tooltip-content-value="Tooltip content here">Label</span>

Dialog hide/show custom events name change

The undocumented client-side Custom Event handling for dialog showing & hiding will change in a future release.

Action	Old event	New event
Show	wagtail:show	w-dialog:show
Hide	wagtail:hide	w-dialog:hide

Additionally, two new events will be dispatched when the dialog visibility changes.

Action	Event name
Show	w-dialog:shown
Hide	w-dialog:hidden

Shared template .../tables/attrs.html has been renamed to .../shared/attrs.html

The undocumented shared template for rendering a dict of attrs to HTML, similar to Django form widgets, has been renamed.

	Template location	Usage with include
Old	wagtail/admin/templates/wagtailadmin/tables/attrs.html	{% include "wagtailadmin/tables/attrs.html" with attrs=link_attrs %}
New	wagtail/admin/templates/wagtailadmin/shared/attrs.html	{% include "wagtailadmin/shared/attrs.html" with attrs=link_attrs %}

Wagtail 5.0.5 release notes

October 19, 2023

---
local:
depth: 1
---

What's new

CVE-2023-45809: Disclosure of user names via admin bulk action views

This release addresses an information disclosure vulnerability in the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any changes, the error message discloses the display names of user accounts, and by modifying URL parameters, the user can retrieve the display name for any user. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Many thanks to quyenheu for reporting this issue. For further details, please see the CVE-2023-45809 security advisory.

Wagtail 5.0.4 release notes

October 4, 2023

---
local:
depth: 1
---

What's new

Maintenance

• Relax Willow / Pillow dependency to allow use of current Pillow versions with security fixes (Dan Braghis)

Wagtail 5.0.3 release notes

September 25, 2023

---
local:
depth: 1
---

What's new

Bug fixes

• Avoid use of ignore_conflicts when creating extra permissions for snippets, for SQL Server compatibility (Sage Abdullah)
• Ensure sequence on wagtailsearchpromotions_query table is correctly set after migrating data (Jake Howard)
• Update Pillow dependency to 9.1.0 (Daniel Kirkham)

Wagtail 5.0.2 release notes

June 21, 2023

---
local:
depth: 1
---

What's new

New features

• Added to support title / slug field synchronization (LB (Ben) Johnston)

Bug fixes

• Prevent JS error when reverting the spinner on a submit button after a validation error (LB (Ben) Johnston)
• Prevent crash when comparing page revisions that include MultipleChooserPanel (Matt Westcott)
• Ensure that title and slug continue syncing after entering non-URL-safe characters (LB (Ben) Johnston)
• Ensure that title and slug are synced on keypress, not just on blur (LB (Ben) Johnston)
• Add a more visible active state for side panel toggle buttons (Thibaud Colas)
• Use custom dark theme colors for revision comparisons (Thibaud Colas)

Upgrade considerations

Use of TitleFieldPanel for the page title field

This release introduces a new class, which is used by default for the page title field and provides the mechanism for synchronizing the slug field with the title. Before Wagtail 5.0, this happened automatically on any field named 'title'.

If you have used FieldPanel("title") directly in a panel definition (rather than extending Page.content_panels as standard), and wish to restore the previous behavior of auto-populating the slug, you will need to change this to TitleFieldPanel("title"). For example:

from wagtail.admin.panels import FieldPanel, MultiFieldPanel

    # ...
    content_panels = [
        MultiFieldPanel([
            FieldPanel("title"),
            FieldPanel("subtitle"),
        ]),
    ]

should become:

from wagtail.admin.panels import FieldPanel, MultiFieldPanel, TitleFieldPanel

    # ...
    content_panels = [
        MultiFieldPanel([
            TitleFieldPanel("title"),
            FieldPanel("subtitle"),
        ]),
    ]

Wagtail 5.0.1 release notes

May 25, 2023

---
local:
depth: 1
---

What's new

Bug fixes

• Rectify previous fix for TableBlock becoming uneditable after save (Sage Abdullah)
• Ensure that copying page correctly picks up the latest revision (Matt Westcott)
• Ensure comment buttons always respect WAGTAILADMIN_COMMENTS_ENABLED (Thibaud Colas)
• Fix error when deleting a single snippet through the bulk actions interface (Sage Abdullah)
• Pass the correct for_update value for get_form_class in SnippetViewSet edit views (Sage Abdullah)
• Move comment notifications toggle to the comments side panel (Sage Abdullah)
• Remove comment button on InlinePanel fields (Sage Abdullah)
• Fix missing link to UsageView from EditView for snippets (Christer Jensen)
• Prevent lowercase conversions of IndexView column headers (Virag Jain)
• Fix various color issues in dark mode (Thibaud Colas)

Documentation

• Update documentation for log_action parameter on RevisionMixin.save_revision (Christer Jensen)

3.2, 4.1, 4.2

3.7, 3.8, 3.9, 3.10, 3.11

Wagtail 5.0 release notes

May 2, 2023

---
local:
depth: 1
---

What's new

Django 4.2 support

This release adds support for Django 4.2.

Object usage information on deleting objects

On deleting a page, image, document or snippet, the confirmation screen now provides a summary of where the object is used, allowing users to see the effect that deletion will have elsewhere on the site. This also prevents objects from being deleted in cases where deletion would be blocked by an on_delete=PROTECT constraint. This feature was developed by Sage Abdullah.

SVG image support

The image library can now be configured to allow uploading SVG images. These are handled by the {% image %} template tag as normal, with some limitations on image operations - for full details, see . This feature was developed by Joshua Munn, and sponsored by YouGov.

Custom validation support for StreamField

Support for adding custom validation logic to StreamField blocks has been formalized and simplified. For most purposes, raising a ValidationError from the block's clean method is now sufficient; more complex behaviors (such as attaching errors to a specific child block) are possible through block-specific subclasses of ValidationError. For more details, see . This feature was developed by Matt Westcott.

Customizable SVG icons

Wagtail’s icon set is now fully updated, customizable, and extendable. Built-in icons are now based on the latest FontAwesome visuals, with capabilities to both customize existing icons as well as add new ones. In particular, this includes:

• A new {% icon %} icon template tag to reuse icons in custom templates.
• A register_icons hook to register new icons and override existing ones.
• Live documentation of all available icons in the styleguide, showcasing the icons available on the current site.
• A list of all built-in icons within our developer documentation.
• Support for customizing icons for snippets via SnippetViewSet.icon.
• Support for custom panel icons, with defaults, displayed for top-level editor panels.
• New icons for StreamField blocks

For more details, see our new icons documentation.

This has been made possible thanks to a multi-year refactoring effort to migrate all icons to SVG. Thank you to all contributors who participated in this effort: Coen van der Kamp, LB (Ben) Johnston, Dan Braghis, Daniel Kirkham, Sage Abdullah, Thibaud Colas, Scott Cranfill, Storm Heg, Steve Steinwand, Jérôme Lebleu, Abayomi Victory.

Accessibility checker improvements

The built-in accessibility checker has been updated with:

• 5 more Axe rules enabled by default.
• Sorting of checker results according to their position on the page.
• Highlight styles to more easily identify elements with errors.
• Configuration APIs in {class}~wagtail.admin.userbar.ContentCheckerItem for simpler customization of the checks performed.

Those improvements were implemented by Albina Starykova as part of an Outreachy internship, with support from mentors Thibaud Colas, Sage Abdullah, and Joshua Munn.

Always-on minimap

Following its introduction in Wagtail 4.1, we have made several improvements to the page editor minimap:

• It now stays opened until dismissed, so users can keep it expanded if desired.
• Its "expanded" state is preserved when navigating between different views of the CMS.
• The minimap and "Collapse all" button now appear next to side panels rather than underneath, so they can be used at any time.
• Clicking any item reveals the minimap, with appropriate text for screen reader users.
• Navigating to a collapsed section of the page will reveal this section.

Thank you to everyone who provided feedback on this new addition to the editor experience. Those changes were implemented by Thibaud Colas.

Dark mode

Wagtail’s admin interface now supports dark mode. The new dark theme can be enabled in account preferences, as well as configuring permanent usage of the light theme, or following system preferences.

We hope this new theme will bring accessibility improvements for users who prefer light text on dark backgrounds, and energy usage efficiency improvements for users of OLED monitors. This feature was developed by Thibaud Colas, with designs from Ben Enright.

Snippets parity with ModelAdmin

Continuing on recent improvements to snippets, we have made the following additions to how snippets can be customized in the admin interface:

• Allow customizing the base URL and URL namespace for snippet views.
• Allow customizing the default ordering and number of items per page for snippet listing views.
• Allow admin templates for snippets to be overridden on a per-model or per-app basis.
• Allow overriding the base queryset to be used in snippet IndexView.
• Allow customizing the search_fields and search backend via SnippetViewSet.
• Allow filters on snippet index views to be customized through the list_filter attribute.
• Allow panels / edit_handler to be specified via SnippetViewSet.
• Support for customizing icons for snippets via SnippetViewSet.icon.
• Allow snippets to be registered into arbitrary admin menu items.

For more details, see .

Developed by Sage Abdullah, these features were implemented as part of RFC 85: Snippets parity with ModelAdmin. We will start the deprecation process of the ModelAdmin contrib package in the next feature release and publish it as a separate package for users who wish to continue using it. The ModelAdmin package will be removed in Wagtail 6.0.

Other features

• Add WAGTAILIMAGES_EXTENSIONS setting to restrict image uploads to specific file types (Aman Pandey, Ananjan-R)
• Update user list column level to Access level to be easier to understand (Vallabh Tiwari)
• Migrate .button-longrunning behavior to a Stimulus controller with support for custom label element & duration (Loveth Omokaro)
• Implement new simplified userbar designs (Albina Starykova)
• Add usage view for pages (Sage Abdullah)
• Copy page form now updates the slug field dynamically with a slugified value on blur (Loveth Omokaro)
• Ensure selected collection is kept when navigating from documents or images listings to add multiple views & upon upload (Aman Pandey, Bojan Mihelac)
• Keep applied filters when downloading form submissions (Suyash Srivastava)
• Messages added dynamically via JavaScript now have an icon to be consistent with those supplied in the page's HTML (Aman Pandey)
• Switch lock/unlock side panel toggle to a switch, with more appropriate confirmation message status (Sage Abdullah)
• Ensure that changed or cleared selection from choosers will dispatch a DOM change event (George Sakkis)
• Add the ability to disable model indexing by setting search_fields = [] (Daniel Kirkham)
• Enhance wagtail.search.utils.parse_query_string to allow inner single quotes for key/value parsing (Aman Pandey)
• Add helpful properties to Locale for more convenient usage within templates, see (Andy Babic)
• Re-label "StreamField blocks" option in block picker to "Blocks" (Thibaud Colas)
• Switch styleguide navigation to use panel components and minimap (Thibaud Colas)
• Explicitly specify MenuItem.name for Snippets, Reports, and Settings menu items (Sage Abdullah)
• Move the help text of fields and blocks directly below their label for easier reading (Thibaud Colas)
• The select all checkbox in simple translation's submit translation page will now be in sync with other checkbox changes (Hanoon)
• Revise alignment and spacing of form fields and sections (Thibaud Colas)
• Update Wagtail’s type scale so StreamField block labels and field labels are the same size (Thibaud Colas)
• Style comments as per page editor design, in side panel (Karl Hobley, Thibaud Colas)
• ReferenceIndex modified to only index Wagtail-related models, and allow other models to be explicitly registered (Daniel Kirkham)

Bug fixes

• Ensure label_format on StructBlock gracefully handles missing variables (Aadi jindal)
• Adopt a no-JavaScript and more accessible solution for the 'Reset to default' switch to Gravatar when editing user profile (Loveth Omokaro)
• Ensure Site.get_site_root_paths works on cache backends that do not preserve Python objects (Jaap Roes)
• Ignore right clicks on side panel resizer (Sage Abdullah)
• Resize in the correct direction for RTL languages with the side panel resizer (Sage Abdullah)
• Fix image uploads on storage backends that require file pointer to be at the start of the file (Matt Westcott)
• Fix "Edit this page" missing from userbar (Satvik Vashisht)
• No longer allow invalid duplicate site hostname creation as hostnames and domain names are a case insensitive (Coen van der Kamp)
• Image and Document multiple upload update forms now correctly use the progress button (longrunning) behavior when clicked (Loveth Omokaro)
• Prevent audit log report from failing on missing models (Andy Chosak)
• Ensure that the privacy collection privacy edit button is styled as a button (Jatin Kumar)
• Fix page/snippet cannot proceed a GroupApprovalTask if it's locked by someone outside of the group (Sage Abdullah)
• Allow manual lock even if WorkflowLock is currently applied (Sage Abdullah)
• Add missing log information for wagtail.schedule.cancel (Stefan Hammer)
• Fix timezone activation leaking into subsequent requests in require_admin_access() (Stefan Hammer)
• Fix dialog component's message to have rounded corners at the top side (Sam)
• When multiple documents are uploaded and then subsequently updated, ensure that existing success messages are cleared correctly (Aman Pandey)
• Prevent matches from unrelated models from leaking into SQLite FTS searches (Matt Westcott)
• Prevent duplicate addition of StreamField blocks with the new block picker (Deepam Priyadarshi)
• Enable partial search on images and documents index view where available (Mng)
• Adopt a no-JavaScript and more accessible solution for option selection in reporting, using HTML only radio input fields (Mehul Aggarwal)
• Ensure that document search results count shows the correct all matches, not the paginate total (Andy Chosak)
• Fix radio and checkbox elements shrinking when using a long label (Sage Abdullah)
• Fix select elements expanding beyond their container when using a long option label (Sage Abdullah)
• Fix timezone handling of TemplateResponses for users with a custom timezone (Stefan Hammer, Sage Abdullah)
• Ensure TableBlock initialization correctly runs after load and its width is aligned with the parent panel (Dan Braghis)
• Ensure that the JavaScript media files are loaded by default in Snippet index listings for date fields (Sage Abdullah)
• Fix server-side caching of the icons sprite (Thibaud Colas)
• Avoid showing scrollbars in the block picker unless necessary (Babitha Kumari)
• Always show Add buttons, guide lines, Move up/down, Duplicate, Delete; in StreamField and Inline Panel (Thibaud Colas)
• Make admin JS i18n endpoint accessible to non-authenticated users (Matt Westcott)
• Autosize text area field will now correctly resize when switching between comments toggle states (Suyash Srivastava)
• Fix incorrect API serialization for document download_url when WAGTAILDOCS_SERVE_METHOD is direct (Swojak-A)
• Fix template configuration of snippets index results view (fidoriel, Sage Abdullah)
• Prevent long preview mode names from making the select element overflow the side panel (Sage Abdullah)
• When i18n is not enabled, avoid making a Locale query on every page view (Dan Braghis)
• Fix initialization of commenting widgets within StreamField (Thibaud Colas)
• Fix various regressions in the commenting UI (Thibaud Colas)
• Prevent TableBlock from becoming uneditable after save (Sage Abdullah)
• Correctly show the "new item" badge within menu sections previously dismissed (Sage Abdullah)
• Fix side panel stuck in resize state when pointer is released outside the grip (Sage Abdullah)

Documentation

• Add code block to make it easier to understand contribution docs (Suyash Singh)
• Fix broken formatting for MultiFieldPanel / FieldRowPanel permission kwarg docs (Matt Westcott)
• Add helpful troubleshooting links and refine wording for getting started with development (Loveth Omokaro)
• Ensure search autocomplete overlay on mobile does not overflow the viewport (Ayman Makroo)
• Improve documentation for InlinePanel (Vallabh Tiwari)
• Remove confusing SettingsPanel reference in the page editing TabbedInterface example as SettingsPanel no longer shows anything as of 4.1 (Kenny Wolf, Julian Bigler)
• Add contributor guidelines for building Stimulus Controllers (Thibaud Colas, Loveth Omokaro, LB (Ben) Johnston)
• Fix typo in "Extending Draftail" documentation (Hans Kelson)
• Clarify ClusterableModel requirements for using relations with RevisionMixin-enabled models (Sage Abdullah)
• Add guide to making your first contribution (LB (Ben) Johnston)

Maintenance

• Removed features deprecated in Wagtail 3.0 and 4.0 (Matt Westcott)
• Update djhtml (html formatting) library to v 1.5.2 (Loveth Omokaro)
• Re-enable strictPropertyInitialization in tsconfig (Thibaud Colas)
• Refactor accessibility checker userbar item (Albina Starykova)
• Removed unused Page.get_static_site_paths method (Yosr Karoui)
• Provisional Django 5.0 compatibility fixes (Sage Abdullah)
• Add unit tests for CollapseAll and MinimapItem components (Albina Starykova)
• Code quality fixes (GLEF1X)
• Refactor image / document / snippet usage views into a shared generic view (Sage Abdullah)
• Rename the Stimulus AutoFieldController to the less confusing SubmitController (Loveth Omokaro)
• Replace script tags with template tag for image/document bulk uploads (Rishabh Kumar Bahukhandi)
• Remove unneeded float styles on 404 page (Fabien Le Frapper)
• Convert userbar implementation to TypeScript (Albina Starykova)
• Migrate slug field behavior to a Stimulus controller and create new SlugInput widget (Loveth Omokaro)
• Refactor status HTML usage to shared template tag (Aman Pandey, LB (Ben) Johnston, Himanshu Garg)
• Add curlylint and update djhtml, semgrep versions in pre-commit config (Himanshu Garg)
• Use shared header template for ModelAdmin and Snippets type index header (Aman Pandey)
• Move models and forms for wagtailsearch.Query to wagtail.contrib.search_promotions (Karl Hobley)
• Migrate initErrorDetection (tabs error counts) to a Stimulus Controller w-count (Aman Pandey)
• Migrate window.addMessage behavior to a global event listener & Stimulus Controller approach with w-messages (Aman Pandey)
• Update Algolia DocSearch to use new application and correct versioning setup (Thibaud Colas)
• Move snippet choosers and model check registration to SnippetViewSet.on_register() (Sage Abdullah)
• Remove unused snippets delete-multiple view (Sage Abdullah)
• Improve performance of determining live page URLs across the admin interface using pageurl template tag (Satvik Vashisht)
• Migrate window.initSlugAutoPopulate behavior to a Stimulus Controller w-sync (Loveth Omokaro)
• Rename status classes to w-status to align with preferred CSS class naming conventions (Mansi Gundre)
• Include wagtail-factories in wagtail.test.utils to avoid cross-dependency issues (Matt Westcott)
• Fix search tests to correctly reflect behavior of search backends other than the fallback backend (Matt Westcott)
• Migrate select all checkbox in simple translation's submit translation page to Stimulus controller w-bulk, remove inline script usage (Hanoon)
• Refactor SnippetViewSet to extend ModelViewSet (Sage Abdullah)
• Migrate initDismissibles behavior to a Stimulus controller w-disimissible (Loveth Omokaro)
• Replace jQuery autosize v3 with Stimulus w-autosize controller using autosize npm package v6 (Suyash Srivastava)
• Update w-action controller to support a click method (Suyash Srivastava)
• Migrate the site settings switcher select from jQuery to a refined version of the w-action controller usage (Aadi jindal, LB (Ben) Johnston)
• Always use expanded Sass output so CSS processing is identical in development and production builds (Thibaud Colas)
• Refactor admin color palette to semantic, theme-agnostic design tokens (Thibaud Colas)

Upgrade considerations

Removal of deprecated features

The following features deprecated in Wagtail 3.0 have been fully removed. See Wagtail 3.0 release notes for details on these changes, including how to remove usage of these features:

• The modules wagtail.core, wagtail.tests, wagtail.admin.edit_handlers and wagtail.contrib.forms.edit_handlers are removed.
• The field panel classes StreamFieldPanel, RichTextFieldPanel, ImageChooserPanel, DocumentChooserPanel and SnippetChooserPanel are removed.
• StreamField definitions must include use_json_field=True (except migrations created before Wagtail 5.0).
• The BASE_URL setting is no longer recognized.
• The ModelAdmin.get_form_fields_exclude method is no longer passed a request argument.
• The ModelAdmin.get_edit_handler method is no longer passed a request or instance argument.
• The widget_overrides, required_fields, required_formsets, bind_to, render_as_object and render_as_field methods on Panel (previously EditHandler) are removed.

The following features deprecated in Wagtail 4.0 have been fully removed. See Wagtail 4.0 release notes for details on these changes, including how to remove usage of these features:

• The wagtail.contrib.settings.models.BaseSetting class is removed.
• The Page.get_latest_revision_as_page method is removed.
• The page and page_id properties and as_page_object method on Revision are removed.
• The JavaScript functions createPageChooser, createSnippetChooser, createDocumentChooser and createImageChooser are removed.
• The wagtail.contrib.modeladmin.menus.SubMenu class is removed.
• Subclasses of wagtail.contrib.modeladmin.helpers.AdminURLHelper are now required to accept a base_url_path keyword argument on the constructor.
• The wagtail.admin.widgets.chooser.AdminChooser class is removed.
• The wagtail.snippets.views.snippets.get_snippet_edit_handler function is removed.

Dropped support for Django 4.0

Django 4.0 reached end of life on 1st April 2023 and is no longer supported by Wagtail. Django 3.2 (LTS) is still supported until April 2024.

Elasticsearch backend no longer performs partial matching on search

The search method on pages, images and documents, and on the backend object returned by wagtail.search.backends.get_search_backend(), no longer performs partial word matching when the Elasticsearch backend is in use. Previously, a search query such as Page.objects.search("cat") would return results containing the word "caterpillar", while Page.objects.search("cat", partial_match=False) would only return results for the exact word "cat". The search method now always performs exact word matches, and the partial_match argument has no effect. This change makes the Elasticsearch backend consistent with the database-backed full-text search backends.

To revert to the previous partial word matching behavior, use the autocomplete method instead - for example, Page.objects.autocomplete("cat"). It may also be necessary to add an entry for the relevant fields on the model's search_fields definition, as the old SearchField("some_field", partial_match=True) format is no longer supported.

The partial_match argument on search and SearchField is now deprecated, and should be removed from your code; it will be dropped entirely in Wagtail 6.

ReferenceIndex no longer tracks models used outside of Wagtail

When introduced in Wagtail 4.1, the ReferenceIndex model recorded references across all of a project's models by default. The default set of models being indexed has now been changed to only those used within the Wagtail admin, specifically:

• all Page types
• Images
• Documents
• models registered as Snippets
• models registered with ModelAdmin

This change will remove the impact of the indexing on non-Wagtail apps and models.

If you have models that still require reference indexing, and which are not registered as snippets or with ModelAdmin, you will need to explicitly register them within your app's AppConfig.ready() method. See Reference index for further details.

The use of wagtail_reference_index_ignore to prevent indexing of models is unchanged, but in many cases it may no longer be necessary.

It is recommended that the rebuild_references_index management command is run after the upgrade to remove any unnecessary records.

Page.get_static_site_paths method removed

The undocumented Page.get_static_site_paths method (which returns a generator of URL paths for use by static site generator packages) has been removed. Packages relying on this functionality should provide their own fallback implementation.

(wagtailsearch_query_migration)=

wagtailsearch.Query has moved to wagtail.contrib.search_promotions

The wagtailsearch.Query model has been moved from the search application to the contrib application wagtail.contrib.search_promotions. All imports will need to be updated and migrations will need to be run via a management command, some imports will still work with a warning until a future version.

To continue using the Query model, you must also add the wagtail.contrib.search_promotions application to your project's INSTALLED_APPS setting.

Migration command

If you have daily hits records in the wagtailsearch.Query you can run the management command to move these records to the new location.

./manage.py copy_daily_hits_from_wagtailsearch

Managing stored search queries

The search_garbage_collect command used to remove old stored search queries and daily hits has been moved to searchpromotions_garbage_collect.

Import updates

Import	Old import	New import
Query Model	from wagtail.search.models import Query	from wagtail.contrib.search_promotions.models import Query
QueryForm	from wagtail.search.forms import QueryForm	from wagtail.contrib.search_promotions.forms import QueryForm

Changes to header CSS classes in ModelAdmin templates

If there are custom styles in place for the ModelAdmin's header content or more complex template overrides in use, there are a few changes for the following classes to be aware of.

Content	Old classes	New classes
Heading & search (contains h1)	.left.header-left	.left
Action buttons (header_extra)	.right.header-right	.right

Slug field auto-cleaning now relies on data attributes

The slug field JavaScript behavior was previously attached to any field with an ID of id_slug, this has now changed to be any field with the appropriate Stimulus data attributes.

If using a custom edit handler or set of panels for page models, the correct widget will now need to be used for these data attributes to be included. This widget will use the WAGTAIL_ALLOW_UNICODE_SLUGS Django setting.

from wagtail.admin.widgets.slug import SlugInput
# ... other imports


class MyPage(Page):
    promote_panels = [
        FieldPanel("slug", widget=SlugInput),
        # ... other panels
    ]

Additionally, the slug behavior can be attached to any field easily by including the following attributes in HTML or via Django's widget attrs.

<input
    type="text"
    name="slug"
    data-controller="w-slug"
    data-action="blur->w-slug#slugify"
/>

To allow unicode values, add the data attribute value;

<input
    type="text"
    name="slug"
    data-controller="w-slug"
    data-action="blur->w-slug#slugify"
    data-w-slug-allow-unicode-value="true"
/>

Changes to title / slug field synchronization

The mechanism for synchronizing the slug field with the page title has changed, and is no longer hard-coded to activate on fields named 'title'. Notably, this change affects page panel definitions that use FieldPanel("title") directly (rather than the convention of extending Page.content_panels), as well as non-page models such as snippets.

To assist in upgrading these definitions, Wagtail 5.0.2 provides a new class to be used in place of FieldPanel("title"). For example:

from wagtail.admin.panels import FieldPanel, MultiFieldPanel

    # ...
    content_panels = [
        MultiFieldPanel([
            FieldPanel("title"),
            FieldPanel("subtitle"),
        ]),
    ]

should become:

from wagtail.admin.panels import FieldPanel, MultiFieldPanel, TitleFieldPanel

    # ...
    content_panels = [
        MultiFieldPanel([
            TitleFieldPanel("title"),
            FieldPanel("subtitle"),
        ]),
    ]

If you have made deeper customizations to this behavior, or are unable to upgrade to Wagtail 5.0.2 or above, please read on as you may need to make some changes to adopt the new approach.

The title field will sync its value with the slug field on Pages if the Page is not published and the slug has not been manually changed. This JavaScript behavior previously attached to any field with an ID of id_title; this has now changed to be any field with the appropriate Stimulus data attributes.

There is a new Stimulus controller w-sync which allows any field to change one or more other fields when its value changes, the other field in this case will be the slug field (w-slug) with the id id_slug.

If you need to hook into this behavior, the new approach will now correctly dispatch change events on the slug field. Alternatively, you can modify the data attributes on the fields to adjust this behavior.

To adjust the target field (the one to be updated), you cam modify "data-w-sync-target-value", the default being "body:not(.page-is-live) [data-edit-form] #id_slug" (find the field with id id_slug when the page is not live).

To adjust what triggers the initial check (to see if the fields should be in sync), or the trigger the sync, you can use the Stimulus data-action attributes.

<input
    id="id_title"
    type="text"
    name="title"
    data-controller="w-sync"
    data-action="focus->w-sync#check blur->w-sync#apply change->w-sync#apply"
    data-w-sync-target-value="body:not(.page-is-live) #some_other_slug"
/>

Above we have adjusted these attributes to add a 'change' event listener to trigger the sync and also adjusted to look for a field with some_other_slug instead.

Auto height/size text area widget now relies on data attributes

If you are using the wagtail.admin.widgets.AdminAutoHeightTextInput only, this change will have no impact when upgrading. However, if you are relying on the global autosize function at window.autosize on the client, this will no longer work.

It is recommended that the AdminAutoHeightTextInput widget be used instead. You can also adopt the data-controller attribute and this will now function as before. Alternatively, you can simply add the required Stimulus data controller attribute as shown below.

Old syntax

<textarea id="story" name="story">It was a dark and stormy night...</textarea>
<script>window.autosize($('story'));</script>

New syntax

<textarea name="story" data-controller="w-autosize">It was a dark and stormy night...</textarea>

There are no additional data attributes supported at this time.

Progress button (button-longrunning) now relies on data attributes

The button-longrunning class usage has been updated to use the newly adopted Stimulus approach, the previous data attributes will be deprecated in a future release.

If using the old approach, ensure any HTML templates are updated to the new approach before the next major release.

Old syntax

<button type="submit" class="button action-save button-longrunning" data-clicked-text="{% trans 'Creating…' %}">
  {% icon name="spinner" %}
  <em>{% trans 'Create' %}</em>
</button>

New syntax

Minimum required attributes are data-controller and a data-action.

<button type="submit" class="button action-save button-longrunning" data-controller="w-progress" data-action="w-progress#activate" data-w-progress-active-value="{% trans 'Creating…' %}">
  {% icon name="spinner" %}
  <em data-w-progress-target="label">{% trans 'Create' %}</em>
</button>

Examples of additional capabilities

Stimulus targets and actions can be leveraged to revise the behavior via data attributes.

• <button ... data-w-progress-duration-value="500" ...> - custom duration can be declared on the element
• <button ... class="custom-button" data-w-progress-active-class="custom-button--busy" ...> - custom 'active' class to replace the default button-longrunning-active (must be a single string without spaces)
• <button ... ><strong data-w-progress-target="label">{% trans 'Create' %}</strong></button> - any element can be the button label (not just em)
• <button ... data-action="w-progress#activate focus->w-progress#activate" ...> - any event can be used to trigger the in progress behavior
• <button ... data-action="w-progress#activate:once" ...> - only trigger the progress behavior once
• <button ... data-action="readystatechange@document->w-progress#activate:once" data-w-progress-duration-value="5000" disabled ...> - disabled on load (once JS starts) and becomes enabled after 5s duration

JavaScript window.addMessages replaced with event dispatching

The undocumented window.addMessage function is no longer available and will throw an error if called, if similar functionality is required use DOM Event dispatching instead as follows.

// old
window.addMessage('success', 'Content has updated');

// new
document.dispatchEvent(
    new CustomEvent('w-messages:add', {
        detail: { text: 'Content has updated', type: 'success' },
    }),
);
// new (clearing existing messages before adding a new one)
document.dispatchEvent(
    new CustomEvent('w-messages:add', {
        detail: {
            clear: true,
            text: 'All content has updated',
            type: 'success',
        },
    }),
);
// message types 'success', 'error', 'warning' are supported

Note that this event name may change in the future and this functionality is still not officially supported.

Changes to StreamField ValidationError classes

The client-side handling of StreamField validation errors has been updated. The JavaScript classes StreamBlockValidationError, ListBlockValidationError, StructBlockValidationError and TypedTableBlockValidationError have been removed, and the corresponding Python classes can no longer be serialized using Telepath. Instead, the setError methods on client-side block objects now accept a plain JSON representation of the error, obtained from the as_json_data method on the Python class. Custom JavaScript code that works with these objects must be updated accordingly.

Additionally, the Python StreamBlockValidationError, ListBlockValidationError, StructBlockValidationError and TypedTableBlockValidationError classes no longer provide a params dict with block_errors and non_block_errors items; these are now available as the attributes block_errors and non_block_errors on the exception itself (or cell_errors and non_block_errors in the case of TypedTableBlockValidationError).

Snippets delete-multiple view removed

The ability to remove multiple snippet instances from the DeleteView and the undocumented wagtailsnippets_{app_label}_{model_name}:delete-multiple URL pattern have been removed. The view's functionality has been replaced by the delete action of the bulk actions feature introduced in Wagtail 4.0.

The delete bulk action view now also calls the {before,after}_delete_snippet hooks, in addition to the {before,after}_bulk_action hooks.

If you have customized the IndexView and/or DeleteView views in a SnippetViewSet subclass, make sure that the delete_multiple_url_name attribute is renamed to delete_url_name.

Snippets index views template name changed

The template name for the index view of a snippet model has changed from wagtailsnippets/snippets/type_index.html and wagtailsnippets/snippets/results.html to wagtailsnippets/snippets/index.html and wagtailsnippets/snippets/index_results.html. In addition, the model index view that lists the snippet types now looks for the template wagtailsnippets/snippets/model_index.html before resorting to the generic index template. If you have customized these templates, make sure to update them accordingly.

status classes are now w-status

Please update any custom styling or usage within the admin when working with status tags to the following new classes.

Old	New
status-tag	w-status
primary	w-status--primary
disabled	w-status--disabled
status-tag--label	w-status--label

Note that a new template tag has been built for usage within the admin that may make it easier to generate status tags.

{% load wagtailadmin_tags %}
{% status "live" url="/test-url/" title=trans_title hidden_label=trans_hidden_label classname="w-status--primary" attrs='target="_blank" rel="noreferrer"' %}
{% status status_label classname="w-status--primary" %}

Deprecated icon font

The Wagtail icon font has been deprecated and will be removed in a future release, as it is now unused in Wagtail itself. There are no changes to make for any icons usage via dedicated APIs such as icon class properties. Any direct icon font usage needs to be converted to SVG icons instead, as documented in our icons overview.

To check whether your project uses the icon font, check for occurrences of:

• Loading of the wagtail.woff font file.
• Usage of font-family: wagtail in CSS.
• icon-<name> CSS classes outside of SVG elements.

Deprecated icons

The following icons are unused in Wagtail itself and will be removed in a future release. If you are using any of these icons, please replace them with an alternative (see our full list of icons), or re-add the icon to your own project.

Icon name	Alternative
angle-double-left	arrow-left
angle-double-right	arrow-right
arrow-down-big	arrow-down
arrow-up-big	arrow-up
arrows-up-down	order
chain-broken	link
chevron-down	arrow-down (identical)
dots-vertical	dots-horizontal
download-alt	download (identical)
duplicate	copy (identical)
ellipsis-v	dots-horizontal
horizontalrule	minus
repeat	rotate
reset	rotate
tick	check (identical)
undo	rotate
uni52	folder-inverse (identical)
wagtail-inverse	wagtail-icon

Snippets get_admin_url_namespace() and get_admin_base_path() moved to SnippetViewSet

The undocumented get_admin_url_namespace() and get_admin_base_path() methods that were set on snippet models at runtime have been moved to the {class}~wagtail.snippets.views.snippets.SnippetViewSet class. If you use these methods, you could access them via {meth}SnippetModel.snippet_viewset.get_admin_url_namespace() <wagtail.snippets.views.snippets.SnippetViewSet.get_admin_url_namespace> and {meth}SnippetModel.snippet_viewset.get_admin_base_path() <wagtail.snippets.views.snippets.SnippetViewSet.get_admin_base_path>, respectively.

Snippets get_usage() and usage_url() methods removed

The undocumented get_usage() and usage_url() methods that were set on snippet models at runtime have been removed. Calls to the get_usage() method can be replaced with wagtail.models.ReferenceIndex.get_grouped_references_to(object). The usage_url() method does not have a direct replacement, but the URL name can be retrieved via {meth}SnippetModel.snippet_viewset.get_url_name("usage") <wagtail.admin.viewsets.base.ViewSet.get_url_name>, which can be used to construct the URL with {func}~django.urls.reverse.

• Fix: Rectify previous fix for TableBlock becoming uneditable after save (Sage Abdullah)
• Fix: Ensure that copying page correctly picks up the latest revision (Matt Westcott)
• Fix: Adjust collection field alignment in multi-upload forms (LB (Ben) Johnston)
• Fix: Prevent lowercase conversions of IndexView column headers (Virag Jain)
• Docs: Update documentation for log_action parameter on RevisionMixin.save_revision (Christer Jensen)

Wagtail 4.2.4 release notes

May 25, 2023

---
local:
depth: 1
---

What's new

Bug fixes

• Rectify previous fix for TableBlock becoming uneditable after save (Sage Abdullah)
• Ensure that copying page correctly picks up the latest revision (Matt Westcott)
• Adjust collection field alignment in multi-upload forms (LB (Ben) Johnston)
• Prevent lowercase conversions of IndexView column headers (Virag Jain)

Documentation

• Update documentation for log_action parameter on RevisionMixin.save_revision (Christer Jensen)

Wagtail 4.2.3 release notes

May 2, 2023

---
local:
depth: 1
---

What's new

Bug fixes

• Prevent TableBlock from becoming uneditable after save (Sage Abdullah)

Wagtail 4.2.2 release notes

April 3, 2023

---
local:
depth: 1
---

What's new

CVE-2023-28836: Stored XSS attack via ModelAdmin views

This release addresses a stored cross-site scripting (XSS) vulnerability on ModelAdmin views within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft pages and documents that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites with ModelAdmin enabled.

Many thanks to Thibaud Colas for reporting this issue. For further details, please see the CVE-2023-28836 security advisory.

CVE-2023-28837: Denial-of-service via memory exhaustion when uploading large files

This release addresses a memory exhaustion bug in Wagtail's handling of uploaded images and documents. For both images and documents, files are loaded into memory during upload for additional processing. A user with access to upload images or documents through the Wagtail admin interface could upload a file so large that it results in a crash or denial of service.

The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. It can only be exploited by admin users with permission to upload images or documents.

Many thanks to Jake Howard for reporting this issue. For further details, please see the CVE-2023-28837 security advisory.

Bug fixes

• Fix radio and checkbox elements shrinking when using a long label (Sage Abdullah)
• Fix select elements expanding beyond their container when using a long option label (Sage Abdullah)
• Fix timezone handling of TemplateResponses for users with a custom timezone (Stefan Hammer, Sage Abdullah)
• Ensure TableBlock initialization correctly runs after load and its width is aligned with the parent panel (Dan Braghis)
• Ensure that the JavaScript media files are loaded by default in Snippet index listings for date fields (Sage Abdullah)
• Fix server-side caching of the icons sprite (Thibaud Colas)
• Avoid showing scrollbars in the block picker unless necessary (Babitha Kumari)
• Always show Add buttons, guide lines, Move up/down, Duplicate, Delete; in StreamField and Inline Panel (Thibaud Colas)
• Ensure datetimepicker widget overlay shows over modals & drop-downs (LB (Ben) Johnston)

Documentation

• Fix module path for MultipleChooserPanel in panel reference docs

Maintenance

• Render large image renditions to disk (Jake Howard)

Wagtail 4.2.1 release notes

March 13, 2023

---
local:
depth: 1
---

What's new

Bug fixes

• Support creating StructValue copies (Tidiane Dia)
• Fix image uploads on storage backends that require file pointer to be at the start of the file (Matt Westcott)
• Fix "Edit this page" missing from userbar (Satvik Vashisht)
• Prevent audit log report from failing on missing models (Andy Chosak)
• Fix page/snippet cannot proceed a GroupApprovalTask if it's locked by someone outside of the group (Sage Abdullah)
• Add missing log information for wagtail.schedule.cancel (Stefan Hammer)
• Fix timezone activation leaking into subsequent requests in require_admin_access() (Stefan Hammer)
• Fix dialog component's message to have rounded corners at the top side (Sam)
• Prevent matches from unrelated models from leaking into SQLite FTS searches (Matt Westcott)
• Prevent duplicate addition of StreamField blocks with the new block picker (Deepam Priyadarshi)
• Update Algolia DocSearch to use new application and correct versioning setup (Thibaud Colas)

Documentation

• Docs: Clarify ClusterableModel requirements for using relations with RevisionMixin-enabled models (Sage Abdullah)

• Added StreamField data migration helpers (Sandil Ranasinghe, Jacob Topp-Mugglestone, Joshua Munn, Karl Hobley)
• Added ability to lock snippet models with LockableMixin (Sage Abdullah)
• Added ability to submit snippets for moderation with WorkflowMixin (Sage Abdullah)
• Create {% fullpageurl %} tag for getting the absolute URL of a page (Jake Howard)
• Added MultipleChooserPanel, a variant of InlinePanel with improved editor experience when inserting multiple linked objects (Matt Westcott)
• Test assertion util WagtailPageTestCase.assertCanCreate now supports the kwarg publish=True to determine whether to publish the page (Harry Percival, Akua Dokua Asiedu, Matt Westcott)
• Ensure that the rebuild_references_index command can run without console output if called with --verbosity 0 (Omerzahid Ali, Aman Pandey)
• Add full support for secondary buttons with icons in the Wagtail design system - button bicolor button--icon button-secondary including the button-small variant (Seremba Patrick)
• Add purge_embeds management command to delete all the cached embed objects in the database (Aman Pandey)
• Make it possible to resize the page editor’s side panels (Sage Abdullah)
• Add ability to include form_fields as an APIField on FormPage (Sævar Öfjörð Magnússon, Suyash Singh, LB (Ben) Johnston)
• Ensure that images listings are more consistently aligned when there are fewer images uploaded (Theresa Okoro)
• Add more informative validation error messages for non-unique slugs within the admin interface and for programmatic page creation (Benjamin Bach)
• Always show the page editor title field’s border when the field is empty (Thibaud Colas)
• Snippet models extending DraftStateMixin now automatically define a "Publish" permission type (Sage Abdullah)
• Users now remain on the edit page after saving a snippet as draft (Sage Abdullah)
• Base project template now populates the meta description tag from the search description field (Aman Pandey)
• Added support for azure-mgmt-cdn version >= 10 and azure-mgmt-frontdoor version >= 1 in the frontend cache invalidator (Sylvain Fankhauser)
• Add a system check to warn when a django-storages backend is configured to allow overwriting (Rishabh jain)
• Update admin focus outline color to have higher contrast against white backgrounds (Thibaud Colas)
• Implement latest design for the admin dashboard header (Thibaud Colas, Steven Steinwand)
• Add Axe accessibility checker integration within userbar, with count and list of errors (Albina Starykova)
• Restyle the userbar to follow the visual design of the Wagtail admin (Albina Starykova)
• Allow configuring Axe accessibility checker integration via construct_wagtail_userbar hook (Sage Abdullah)
• Support pinning and un-pinning the rich text editor toolbar depending on user preference (Thibaud Colas)
• Make the rich text block trigger and slash-commands always available regardless of where the cursor is (Thibaud Colas)
• Adjust the size of panel labels on the "Account" form (Thibaud Colas)
• Delay hiding the contents of the side panels when closing, so the animation is smoother (Thibaud Colas)
• ListBlock now shows item-by-item differences when comparing versions (Tidiane Dia)
• Implement a new design for chooser buttons with better accessibility (Thibaud Colas)
• Fix: Make sure workflow timeline icons are visible in high-contrast mode (Loveth Omokaro)
• Fix: Ensure authentication forms (login, password reset) have a visible border in Windows high-contrast mode (Loveth Omokaro)
• Fix: Ensure visual consistency between buttons and links as buttons in Windows high-contrast mode (Albina Starykova)
• Fix: references extraction for ChooserBlock (Alex Tomkins)
• Fix: Incorrectly formatted link in the documentation for Wagtail community support (Bolarinwa Comfort Ajayi)
• Fix: Text within status tags text will now resize correctly when customizing browser font size (Mary Ojo)
• Fix: Ensure logo shows correctly on log in page in Windows high-contrast mode (Loveth Omokaro)
• Fix: Comments notice background overflows its container (Yekasumah)
• Fix: Ensure links within help blocks meet color contrast guidelines for accessibility (Theresa Okoro)
• Fix: Ensure the skip link (used for keyboard control) meets color contrast guidelines for accessibility (Dauda Yusuf)
• Fix: Ensure tag fields correctly show in both dark and light Windows high-contrast modes (Albina Starykova)
• Fix: Ensure new tooltips & tooltip menus have visible borders and tip triangle in Windows high-contrast mode (Juliet Adeboye)
• Fix: Ensure there is a visual difference of 'active/current link' vs normal links in Windows high-contrast mode (Mohammad Areeb)
• Fix: Avoid issues where trailing whitespace could be accidentally removed in translations for new page & snippet headers (Florian Vogt)
• Fix: Make sure minimap error indicators follow the minimap scrolling (Thibaud Colas)
• Fix: Remove the ability to view or add comments to InlinePanel inner fields to avoid lost or incorrectly linked comments (Jacob Topp-Mugglestone)
• Fix: Use consistent heading styles on top-level fields in the page editor (Sage Abdullah)
• Fix: Allow button labels to wrap onto two lines in dropdown buttons (Coen van der Kamp)
• Fix: Remove spurious horizontal resize handle from text areas (Matt Westcott)
• Fix: Move DateField, DateTimeField, TimeField comment buttons to be right next to the fields (Theresa Okoro)
• Fix: Support text resizing in workflow steps cards (Ivy Jeptoo)
• Fix: Ignore images added via fixtures when using WAGTAILIMAGES_FEATURE_DETECTION_ENABLED to avoid errors for images that do not exist (Aman Pandey)
• Fix: Restore ability to perform JSONField query operations against StreamField when running against the Django 4.2 development branch (Sage Abdullah)
• Fix: Ensure there is correct grammar and pluralization for Tab error counts shown to screen readers (Aman Pandey)
• Fix: Pass through expected cc, bcc and reply_to to the Django mail helper from wagtail.admin.mail.send_mail (Ben Gosney)
• Fix: Allow reviewing or reverting to a Page's initial revision (Andy Chosak)
• Fix: Use the correct padding for autocomplete block picker (Umar Farouk Yunusa)
• Fix: Ensure that short content pages (such as editing snippets) do not show an inconsistent background (Sage Abdullah)
• Fix: Fix horizontal positioning of rich text inline toolbar (Thibaud Colas)
• Fix: Ensure that DecimalBlock correctly handles None, when required=False, values (Natarajan Balaji)
• Fix: Close the userbar when clicking its toggle (Albina Starykova)
• Fix: Add a border around the userbar menu in Windows high-contrast mode so it can be identified (Albina Starykova)
• Fix: Make sure browser font resizing applies to the userbar (Albina Starykova)
• Fix: Fix check for delete_url_name attribute in generic DeleteView (Alex Simpson)
• Fix: Re-implement design system colors so HSL values exactly match the desired RGB (Albina Starykova)
• Fix: Resolve issue where workflow and other notification emails would not include the correct tab URL for account notification management (LB (Ben) Johnston)
• Fix: Use consistent spacing above and below page headers (Thibaud Colas)
• Fix: Use the correct icon sizes and spacing in slim header (Thibaud Colas)
• Fix: Use the correct color for placeholders in rich text fields (Thibaud Colas)
• Fix: Prevent obstructing the outline around rich text fields (Thibaud Colas)
• Fix: Page editor dropdowns now use indigo backgrounds like elsewhere in the admin interface (Thibaud Colas)
• Fix: Allow parsing of multiple key/value pairs from string in wagtail.search.utils.parse_query_string (Beniamin Bucur)
• Fix: Prevent memory exhaustion when purging a large number of revisions (Jake Howard)
• Fix: Add right-to-left (RTL) support for the following form components: Switch, Minimap, live preview (Thibaud Colas)
• Fix: Improve right-to-left (RTL) positioning for the following components: Page explorer, Sidebar sub-menu, rich text tooltips, rich text toolbar trigger, editor section headers (Thibaud Colas)
• Fix: Add right-to-left (RTL) support for the caret of select inputs (Badr Fourane)
• Fix: Use the workflow name as the workflow information dialog title (Sage Abdullah)
• Fix: Link to workflow history view instead of page history view in the workflow information dialog (Sage Abdullah)
• Fix: Fix in-progress count in warning message when disabling workflows (Sage Abdullah)
• Fix: Show workflow name on workflow history index page (Sage Abdullah)
• Fix: Fix workflow history detail timeline content from showing on initial load (Sage Abdullah)
• Fix: Center-align StreamField and rich text block picker buttons with the dotted guide line (Thibaud Colas)
• Fix: Search bar in chooser modals now performs autocomplete searches under PostgreSQL (Matt Westcott)
• Fix: Server-side document filenames are preserved when replacing a document file (Suyash Singh, Matt Westcott)
• Fix: Add missing wagtailadmin_tags in workflow_state_approved.html template (Alex Tomkins)
• Fix: Do not show bulk actions checkbox in page type usage view (Sage Abdullah)
• Fix: Prevent account name from overflowing the sidebar (Aman Pandey)
• Fix: Ensure edit form is displayed as unlocked immediately after canceling a workflow (Sage Abdullah)
• Fix: Prevent latest_revision pointer from being copied over when copying translatable snippets for translation (Sage Abdullah)
• Fix: Page listings actions under the "More" dropdown are now accessible for screen reader and keyboard users (Thibaud Colas)
• Fix: Bulk actions under the "More" dropdown are now accessible for screen reader and keyboard users (Thibaud Colas)
• Fix: Navigation to translations via the locale dropdown is now accessible for screen reader and keyboard users (Thibaud Colas)
• Fix: Make it possible for speech recognition users to reveal chooser buttons (Thibaud Colas)
• Docs: Add custom permissions section to permissions documentation page (Dan Hayden)
• Docs: Add documentation for how to get started with contributing translations for the Wagtail admin (Ogunbanjo Oluwadamilare)
• Docs: Officially recommend fnm over nvm in development documentation (LB (Ben) Johnston)
• Docs: Mention the importance of passing request and current_site to get_url on the performance documentation page (Jake Howard)
• Docs: Add documentation for register_user_listing_buttons hook (LB (Ben Johnston))
• Docs: Add development (contributing to Wagtail) documentation notes for development on Windows (Akua Dokua Asiedu)
• Docs: Mention Wagtail’s usage of Django’s default user model by default (Temidayo Azeez)
• Docs: Add links to treebeard documentation for relevant methods (Temidayo Azeez)
• Docs: Add clarification on where to register entity plugins (Mark McOsker)
• Docs: Fix logo in README not being visible in high-contrast mode (Benita Anawonah)
• Docs: Improve 'first wagtail site' tutorial (Akua Dokua Asiedu)
• Docs: Grammatical adjustments of page models usage guide (Damilola Oladele)
• Docs: Add class inheritance information to StreamField block reference (Temidayo Azeez)
• Docs: Document the hook register_image_operations and add an example of a custom Image filter (Coen van der Kamp)
• Docs: Fix incorrect example code for StreamField migration of RichTextField (Matt Westcott)
• Docs: Document the policy needed to create invalidations in CloudFront (Jake Howard)
• Docs: Document how to add permission restriction to a report view (Rishabh jain)
• Docs: Add example for how to configure API renderer_classes (Aman Pandey)
• Docs: Document potential data loss for BaseLogEntry migration in 3.0 (Sage Abdullah)
• Docs: Add documentation for the reference index mechanism (Daniel Kirkham)
• Docs: Remove confusing SettingsPanel reference in the page editing TabbedInterface example as SettingsPanel no longer shows anything as of 4.1 (Kenny Wolf, Julian Bigler)
• Docs: Add more extensive documentation for the permission kwarg support in Panels (LB (Ben) Johnston)
• Maintenance: Switch to using Willow instead of Pillow for images (Darrel O'Pry)
• Maintenance: Remove unsquashed testapp migrations (Matt Westcott)
• Maintenance: Upgrade to Node 18 for frontend build tooling (LB (Ben) Johnston)
• Maintenance: Run Python tests with coverage and upload coverage data to codecov (Sage Abdullah)
• Maintenance: Clean up duplicate JavaScript for the escapeHtml function (Jordan Rob)
• Maintenance: Clean up Prettier & Eslint usage for search promotions formset JS file (LB (Ben Johnston))
• Maintenance: Ensure that translation file generation ignores JavaScript unit tests and clean up unit tests for Django gettext utils (LB (Ben Johnston))
• Maintenance: Migrated initButtonSelects from core.js to own TypeScript file and add unit tests (Loveth Omokaro)
• Maintenance: Migrated initSkipLink util to TypeScript and add JSDoc & unit tests (Juliet Adeboye)
• Maintenance: Clean up some unused utility classes and migrate unlist to Tailwind utility class w-list-none (Loveth Omokaro)
• Maintenance: Clean up linting on legacy code and add shared util hasOwn in TypeScript (Loveth Omokaro)
• Maintenance: Remove unnecessary box-sizing: border-box declarations in SCSS (Albina Starykova)
• Maintenance: Migrated initTooltips to TypeScript and add JSDoc and unit tests (Fatuma Abdullahi)
• Maintenance: Migrated initTagField from core.js to own TypeScript file and add unit tests (Chisom Okeoma)
• Maintenance: Added unit tests & JSDoc to initDismissibles (Yekasumah)
• Maintenance: Standardise on classname for passing HTML class attributes (LB (Ben Johnston))
• Maintenance: Clean up expanding formset and InlinePanel JavaScript initialization code and adopt a class approach (Matt Westcott)
• Maintenance: Extracted revision and draft state logic from generic views into mixins (Sage Abdullah)
• Maintenance: Extracted generic lock / unlock views from page lock / unlock views (Sage Abdullah)
• Maintenance: Move identity JavaScript util into shared utils folder (LB (Ben Johnston))
• Maintenance: Remove unnecessary declaration of function to determine URL query params, instead use URLSearchParams (Loveth Omokaro)
• Maintenance: Update tsconfig to better support modern TypeScript development and clean up some code quality issues via Eslint (Loveth Omokaro)
• Maintenance: Set up Stimulus application initialization according to RFC 78 (LB (Ben) Johnston)
• Maintenance: Refactor submit-on-change search filters for image and document listings to use Stimulus (LB (Ben) Johnston)
• Maintenance: Switch userbar to initialize a Web Component to avoid styling clashes (Albina Starykova)
• Maintenance: Refactor userbar stylesheets to use the same CSS loading as the rest of the admin (Albina Starykova)
• Maintenance: Remove unused search-bar and button-filter styles (Thibaud Colas)
• Maintenance: Use util method to construct dummy requests in tests (Jake Howard)
• Maintenance: Remove unused dev-only react-axe integration (Thibaud Colas)
• Maintenance: Migrate accessible Skip Link implementation to a Stimulus controller (Loveth Omokaro)
• Maintenance: Split up wagtail.admin.panels into submodules, existing exports have been preserved (Matt Westcott)
• Maintenance: Refactor userbar styles to use the same stylesheet as other components (Thibaud Colas)
• Maintenance: Add deprecation warnings for wagtail.core and other imports deprecated in Wagtail 3.0 (Matt Westcott)
• Maintenance: Migrate admin upgrade notification message implementation to a Stimulus controller (Loveth Omokaro)
• Maintenance: Migrate workflow and workflow tasks enable action and lock/unlock actions to a Stimulus controller (Loveth Omokaro)
• Maintenance: Pull out icon sprite setup function from inline script to its own TypeScript file & add unit tests (Loveth Omokaro)
• Maintenance: Upgraded Transifex configuration to v3 (Loic Teixeira)
• Maintenance: Replace repeated HTML avatar component with a template tag include {% avatar ... %} throughout the admin interface (Aman Pandey)
• Maintenance: Remove unused icon-help and help-inverse code (Thibaud Colas)
• Maintenance: Migrate privacy switch, FileFields, history buttons, error messages, Datetimepicker, ordering icons, thumbnails, ModelAdmin, page listings, workflows, and user creation form controls to SVG icons (Thibaud Colas)
• Maintenance: Switch form submission listings to use the same ordering icons as other listings (Thibaud Colas)
• Maintenance: Refactor "More" dropdowns, locale selector, "Switch locales", page actions, to use the same dropdown component (Thibaud Colas)
• Maintenance: Remove or replace legacy CSS classes: visuallyhidden, visuallyvisible, divider-after, divider-before, inline, inline-block, block, u-hidden, clearfix, reordering, overflow (Thibaud Colas)
• Maintenance: Prevent future issues with icon.html end-of-file newlines (Thibaud Colas)
• Maintenance: Rewrite styles using legacy c-, o-, u-, t-, is- prefixes (Thibaud Colas)
• Maintenance: Remove invalid CSS styles / Sass selector concatenation (Thibaud Colas)

3.2, 4.0, 4.1

3.7, 3.8, 3.9, 3.10, 3.11

4.1 LTS

3.2, 4.0, 4.1

3.7, 3.8, 3.9, 3.10, 3.11

Wagtail 4.2 release notes

February 6, 2023

---
local:
depth: 1
---

What's new

StreamField data migration helpers

Wagtail now provides a set of utilities for creating data migrations on StreamField data. For more information, see StreamField data migrations. This feature was developed by Sandil Ranasinghe, initially as the wagtail-streamfield-migration-toolkit add-on package, as part of the Google Summer of Code 2022 initiative, with support from Jacob Topp-Mugglestone, Joshua Munn and Karl Hobley.

Locking for snippets

Snippets can now be locked by users to prevent other users from editing, through the use of the LockableMixin. For more details, see .

This feature was developed by Sage Abdullah.

Workflows for snippets

Snippets can now be assigned to workflows through the use of the WorkflowMixin, allowing new changes to be submitted for moderation before they are published. For more details, see .

This feature was developed by Sage Abdullah.

fullpageurl template tag

Wagtail now provides a fullpageurl template tag (for both Django templates and Jinja2) to output a page's full URL including the domain. For more details, see .

This feature was developed by Jake Howard.

CSP compatibility & Stimulus adoption

Wagtail now uses the Stimulus framework for client-side interactivity (see RFC 78). Our Outreachy contributor Loveth Omokaro has refactored significant portions of the admin interface:

• The Skip Link component displayed on all pages.
• The dashboard’s Upgrade notification message.
• Auto-submitting of listing filters.
• Loading of Wagtail’s icon sprite
• Page lock/unlock actions
• Workflow enable actions

Those changes improve the maintainability of the code, and help us move towards compatibility with strict CSP (Content Security Policy) rules. Thank you to Loveth and project mentors LB (Ben) Johnston, Thibaud Colas, and Paarth Agarwal.

Accessibility checker integration

The CMS now includes an accessibility checker in the user bar, to assist users in building more accessible websites and follow ATAG 2.0 guidelines. The checker, which is based on the Axe testing engine, is designed for content authors to identify and fix accessibility issues on their own. It scans the loaded page for errors and displays the results, with three rules turned on in this release. It’s configurable with the construct_wagtail_userbar hook.

This new feature was implemented by Albina Starykova as part of an Outreachy internship, with support from mentors Thibaud Colas, Sage Abdullah, and Joshua Munn.

Rich text improvements

Following feedback from Wagtail users on rich text UI improvements in Wagtail 4.0, we have further refined the behavior of rich text fields to cater for different scenarios:

• Users can now choose between an “inline” floating toolbar, and a fixed toolbar at the top of the editor. Both toolbars display all formatting options.
• The ‘/’ command palette and block picker in rich text fields now contain all formatting options except text styles.
• The ‘/’ command palette and block picker are now always available no matter where the cursor is placed, to support inserting content at any point within text, transforming existing content, and splitting StreamField blocks in the middle of a paragraph when needed.
• The block picker interface now displays two columns so more options are visible without scrolling.

Thank you to all who provided feedback, participants to our usability testing sessions, and to Nick Lee and Thibaud Colas for the implementation.

Multiple chooser panel

A new panel type is available. This is a variant of InlinePanel which improves the editor experience when adding large numbers of linked items - rather than creating and populating each sub-form individually, a chooser modal is opened allowing multiple objects to be selected at once.

This feature was developed by Matt Westcott, and sponsored by YouGov.

Other features

• Test assertion WagtailPageTestCase.assertCanCreate now supports the kwarg publish=True to determine whether to publish the page (Harry Percival, Akua Dokua Asiedu, Matt Westcott)
• Ensure that the rebuild_references_index command can run without console output if called with --verbosity 0 (Omerzahid Ali, Aman Pandey)
• Add full support for secondary buttons with icons in the Wagtail design system - button bicolor button--icon button-secondary including the button-small variant (Seremba Patrick)
• Add purge_embeds management command to delete all the cached embed objects in the database (Aman Pandey)
• Make it possible to resize the page editor’s side panels (Sage Abdullah)
• Add ability to include form_fields as an APIField on FormPage (Sævar Öfjörð Magnússon, Suyash Singh, LB (Ben) Johnston)
• Ensure that images listings are more consistently aligned when there are fewer images uploaded (Theresa Okoro)
• Add more informative validation error messages for non-unique slugs within the admin interface and for programmatic page creation (Benjamin Bach)
• Always show the page editor title field’s border when the field is empty (Thibaud Colas)
• Snippet models extending DraftStateMixin now automatically define a "Publish" permission type (Sage Abdullah)
• Users now remain on the edit page after saving a snippet as draft (Sage Abdullah)
• Base project template now populates the meta description tag from the search description field (Aman Pandey)
• Added support for azure-mgmt-cdn version >= 10 and azure-mgmt-frontdoor version >= 1 in the frontend cache invalidator (Sylvain Fankhauser)
• Add a system check to warn when a django-storages backend is configured to allow overwriting (Rishabh Jain)
• Update admin focus outline color to have higher contrast against white backgrounds (Thibaud Colas)
• Implement latest design for the admin dashboard header (Thibaud Colas, Steven Steinwand)
• Restyle the userbar to follow the visual design of the Wagtail admin (Albina Starykova)
• Adjust the size of panel labels on the "Account" form (Thibaud Colas)
• Delay hiding the contents of the side panels when closing, so the animation is smoother (Thibaud Colas)
• ListBlock now shows item-by-item differences when comparing versions (Tidiane Dia)
• Switch StreamField blocks to use the same picker interface as within rich text fields (Thibaud Colas)

Bug fixes

• Make sure workflow timeline icons are visible in high-contrast mode (Loveth Omokaro)
• Ensure authentication forms (login, password reset) have a visible border in Windows high-contrast mode (Loveth Omokaro)
• Ensure visual consistency between buttons and links as buttons in Windows high-contrast mode (Albina Starykova)
• Ensure ChooserBlock.extract_references uses the model class, not the model string (Alex Tomkins)
• Incorrectly formatted link in the documentation for Wagtail community support (Bolarinwa Comfort Ajayi)
• Ensure logo shows correctly on log in page in Windows high-contrast mode (Loveth Omokaro)
• Comments notice background overflows its container (Yekasumah)
• Ensure links within help blocks meet color contrast guidelines for accessibility (Theresa Okoro)
• Ensure the skip link (used for keyboard control) meets color contrast guidelines for accessibility (Dauda Yusuf)
• Ensure tag fields correctly show in both dark and light Windows high-contrast modes (Albina Starykova)
• Ensure new tooltips & tooltip menus have visible borders and tip triangle in Windows high-contrast mode (Juliet Adeboye)
• Ensure there is a visual difference of 'active/current link' vs normal links in Windows high-contrast mode (Mohammad Areeb)
• Avoid issues where trailing whitespace could be accidentally removed in translations for new page & snippet headers (Florian Vogt)
• Make sure minimap error indicators follow the minimap scrolling (Thibaud Colas)
• Remove the ability to view or add comments to InlinePanel inner fields to avoid lost or incorrectly linked comments (Jacob Topp-Mugglestone)
• Use consistent heading styles on top-level fields in the page editor (Sage Abdullah)
• Allow button labels to wrap onto two lines in dropdown buttons (Coen van der Kamp)
• Remove spurious horizontal resize handle from text areas (Matt Westcott)
• Move DateField, DateTimeField, TimeField comment buttons to be right next to the fields (Theresa Okoro)
• Support text resizing in workflow steps cards (Ivy Jeptoo)
• Ignore images added via fixtures when using WAGTAILIMAGES_FEATURE_DETECTION_ENABLED to avoid errors for images that do not exist (Aman Pandey)
• Restore ability to perform JSONField query operations against StreamField when running against the Django 4.2 development branch (Sage Abdullah)
• Ensure there is correct grammar and pluralization for Tab error counts shown to screen readers (Aman Pandey)
• Pass through expected cc, bcc and reply_to to the Django mail helper from wagtail.admin.mail.send_mail (Ben Gosney)
• Allow reviewing or reverting to a Page's initial revision (Andy Chosak)
• Use the correct padding for autocomplete block picker (Umar Farouk Yunusa)
• Ensure that short content pages (such as editing snippets) do not show an inconsistent background (Sage Abdullah)
• Fix horizontal positioning of rich text inline toolbar (Thibaud Colas)
• Ensure that DecimalBlock correctly handles None, when required=False, values (Natarajan Balaji)
• Close the userbar when clicking its toggle (Albina Starykova)
• Add a border around the userbar menu in Windows high-contrast mode so it can be identified (Albina Starykova)
• Make sure browser font resizing applies to the userbar (Albina Starykova)
• Fix check for delete_url_name attribute in generic DeleteView (Alex Simpson)
• Re-implement design system colors so HSL values exactly match the desired RGB (Albina Starykova)
• Resolve issue where workflow and other notification emails would not include the correct tab URL for account notification management (LB (Ben) Johnston)
• Use consistent spacing above and below page headers (Thibaud Colas)
• Use the correct icon sizes and spacing in slim header (Thibaud Colas)
• Use the correct color for placeholders in rich text fields (Thibaud Colas)
• Prevent obstructing the outline around rich text fields (Thibaud Colas)
• Page editor dropdowns now use indigo backgrounds like elsewhere in the admin interface (Thibaud Colas)
• Allow parsing of multiple key/value pairs from string in wagtail.search.utils.parse_query_string (Beniamin Bucur)
• Prevent memory exhaustion when purging a large number of revisions (Jake Howard)
• Add right-to-left (RTL) support for the following form components: Switch, Minimap, live preview (Thibaud Colas)
• Improve right-to-left (RTL) positioning for the following components: Page explorer, Sidebar sub-menu, rich text tooltips, rich text toolbar trigger, editor section headers (Thibaud Colas)
• Center-align StreamField and rich text block picker buttons with the dotted guide line (Thibaud Colas)
• Search bar in chooser modals now performs autocomplete searches under PostgreSQL (Matt Westcott)
• Server-side document filenames are preserved when replacing a document file (Suyash Singh, Matt Westcott)
• Do not show bulk actions checkbox in page type usage view (Sage Abdullah)
• Prevent account name from overflowing the sidebar (Aman Pandey)
• Ensure edit form is displayed as unlocked immediately after canceling a workflow (Sage Abdullah)
• Prevent latest_revision pointer from being copied over when copying translatable snippets for translation (Sage Abdullah)

Documentation

• Wagtail's documentation (v2.9 to v4.0) has been updated on Dash user contributions for Dash or Zeal offline docs applications (Damilola Oladele, Mary Ayobami, Elizabeth Bassey)
• Wagtail's documentation (v2 to v4.0) has been added to DevDocs which has offline support and is easily accessible in any browser (Vallabh Tiwari)
• Add custom permissions section to permissions documentation page (Dan Hayden)
• Add documentation for how to get started with contributing translations for the Wagtail admin (Ogunbanjo Oluwadamilare)
• Officially recommend fnm over nvm in development documentation (LB (Ben) Johnston)
• Mention the importance of passing request and current_site to get_url on the performance documentation page (Jake Howard)
• Add documentation for register_user_listing_buttons hook (LB (Ben Johnston))
• Add development (contributing to Wagtail) documentation notes for development on Windows (Akua Dokua Asiedu)
• Mention Wagtail’s usage of Django’s default user model by default (Temidayo Azeez)
• Add links to treebeard documentation for relevant methods (Temidayo Azeez)
• Add clarification on where to register entity plugins (Mark McOsker)
• Fix logo in README not being visible in high-contrast mode (Benita Anawonah)
• Improve 'first wagtail site' tutorial (Akua Dokua Asiedu)
• Grammatical adjustments of page models usage guide (Damilola Oladele)
• Add class inheritance information to StreamField block reference (Temidayo Azeez)
• Document the hook register_image_operations and add an example of a custom Image filter (Coen van der Kamp)
• Fix incorrect example code for StreamField migration of RichTextField (Matt Westcott)
• Document the policy needed to create invalidations in CloudFront (Jake Howard)
• Document how to add permission restriction to a report view (Rishabh jain)
• Add example for how to configure API renderer_classes (Aman Pandey)
• Document potential data loss for BaseLogEntry migration in 3.0 (Sage Abdullah)
• Add documentation for the reference index mechanism (Daniel Kirkham)

Maintenance

• Switch to using Willow instead of Pillow for images (Darrel O'Pry)
• Remove unsquashed testapp migrations (Matt Westcott)
• Upgrade to Node 18 for frontend build tooling (LB (Ben) Johnston)
• Run Python tests with coverage and upload coverage data to codecov (Sage Abdullah)
• Clean up duplicate JavaScript for the escapeHtml function (Jordan Rob)
• Ensure that translation file generation ignores JavaScript unit tests and clean up unit tests for Django gettext utils (LB (Ben Johnston))
• Migrated initButtonSelects from core.js to own TypeScript file and add unit tests (Loveth Omokaro)
• Migrated initSkipLink util to TypeScript and add JSDoc & unit tests (Juliet Adeboye)
• Clean up some unused utility classes and migrate unlist to Tailwind utility class w-list-none (Loveth Omokaro)
• Clean up linting on legacy code and add shared util hasOwn in TypeScript (Loveth Omokaro)
• Remove unnecessary box-sizing: border-box declarations in SCSS (Albina Starykova)
• Migrated initTooltips to TypeScript and add JSDoc and unit tests (Fatuma Abdullahi)
• Migrated initTagField from core.js to own TypeScript file and add unit tests (Chisom Okeoma)
• Added unit tests & JSDoc to initDismissibles (Yekasumah)
• Standardise on classname for passing HTML class attributes (LB (Ben Johnston))
• Clean up expanding formset and InlinePanel JavaScript initialization code and adopt a class approach (Matt Westcott)
• Extracted revision and draft state logic from generic views into mixins (Sage Abdullah)
• Extracted generic lock / unlock views from page lock / unlock views (Sage Abdullah)
• Move identity JavaScript util into shared utils folder (LB (Ben Johnston))
• Remove unnecessary declaration of function to determine URL query params, instead use URLSearchParams (Loveth Omokaro)
• Update tsconfig to better support modern TypeScript development and clean up some code quality issues via Eslint (Loveth Omokaro)
• Switch userbar to initialize a Web Component to avoid styling clashes (Albina Starykova)
• Refactor userbar stylesheets to use the same CSS loading as the rest of the admin (Albina Starykova)
• Remove unused search-bar and button-filter styles (Thibaud Colas)
• Use util method to construct dummy requests in tests (Jake Howard)
• Remove unused dev-only react-axe integration (Thibaud Colas)
• Split up wagtail.admin.panels into submodules, existing exports have been preserved (Matt Westcott)
• Refactor userbar styles to use the same stylesheet as other components (Thibaud Colas)
• Add deprecation warnings for wagtail.core and other imports deprecated in Wagtail 3.0 (Matt Westcott)
• Upgraded Transifex configuration to v3 (Loic Teixeira)
• Replace repeated HTML avatar component with a template tag include {% avatar ... %} throughout the admin interface (Aman Pandey)
• Refactor accessibility checker userbar item (Albina Starykova)

Upgrade considerations

Wagtail-specific image field (WagtailImageField)

The AbstractImage and AbstractRendition models use a Wagtail-specific WagtailImageField which extends Django's ImageField to use Willow for image file handling. This will generate a new migration if you are using a custom image model.

Comments within InlinePanel not supported

When the commenting system was introduced, support for InlinePanel fields was incorrectly added. This has led to issues where comments can be lost on save, or in most cases will be added to the incorrect item within the InlinePanel. The ability to add comments here has now been removed and as such any existing comments that were added will no longer show.

See https://github.com/wagtail/wagtail/issues/9685 for tracking of adding this back officially in the future.

Adoption of classname convention for some template tags & includes

Some undocumented Wagtail admin template tags and includes have been refactored to adopt a more consistent naming of classname.

If these are used within packages or customizations they will need to be updated to the new variable naming convention.

Name	New (classname)	Old (various)
icon (see note)	{% icon name='spinner' classname='...' %}	{% icon name='spinner class_name='...' %}
dialog_toggle	{% dialog_toggle classname='...' %}	{% dialog_toggle class_name='...' %}
paginate	{% paginate pages classname="..." %}	{% paginate pages classnames="..." %}
tab_nav_link	{% include 'wagtailadmin/shared/tabs/tab_nav_link.html' with classname="..." %}	{% include 'wagtailadmin/shared/tabs/tab_nav_link.html' with classes="..." %}
side_panel_button	{% include 'wagtailadmin/shared/side_panels/includes/side_panel_button.html' with classname="..." %}	{% include 'wagtailadmin/shared/side_panels/includes/side_panel_button.html' with classes="..." %}

Note that the icon template tag will still support class_name with a deprecation warning. Support will be dropped in a future release.

InlinePanel JavaScript function is now a class

The (internal, undocumented) InlinePanel JavaScript function, used to initialize client-side behavior for inline panels, has been converted to a class. Any user code that calls this function should now replace InlinePanel(...) calls with new InlinePanel(...). Additionally, child form controls are now initialized automatically, and so it is no longer necessary to call initChildControls, updateChildCount, updateMoveButtonDisabledStates or updateAddButtonState.

Python code that uses the InlinePanel panel type is not affected by this change.

WAGTAILADMIN_GLOBAL_PAGE_EDIT_LOCK setting is now WAGTAILADMIN_GLOBAL_EDIT_LOCK

The WAGTAILADMIN_GLOBAL_PAGE_EDIT_LOCK setting has been renamed to WAGTAILADMIN_GLOBAL_EDIT_LOCK.

Wagtail userbar as a web component

The wagtailuserbar template tag now initializes the userbar as a Web Component, with a wagtail-userbar custom element using shadow DOM to apply styles without any collisions with the host page.

For any site customizing the position of the userbar, target the styles to wagtail-userbar::part(userbar) instead of .wagtail-userbar. For example:

wagtail-userbar::part(userbar) {
    bottom: 30px;
}

Configuration of the accessibility checker user bar item

Like other userbar items, the new accessibility checker is configurable with the construct_wagtail_userbar hook. For example, to remove the new item, use:

from wagtail.admin.userbar import AccessibilityItem


@hooks.register("construct_wagtail_userbar")
def remove_userbar_accessibility_checks(request, items):
    items[:] = [item for item in items if not isinstance(item, AccessibilityItem)]

Support for legacy versions of azure-mgmt-cdn and azure-mgmt-frontdoor packages will be dropped

If you are using the front-end cache invalidator module (wagtail.contrib.frontend_cache) with Azure CDN or Azure Front Door, the following packages need to be updated:

• For Azure CDN: upgrade azure-mgmt-cdn to version 10 or above
• For Azure Front Door: upgrade azure-mgmt-frontdoor to version 1 or above

Support for older versions will be dropped in a future release.

Changes to Workflow and Task methods

To accommodate workflows support for snippets, the page parameter in {meth}Workflow.start() <wagtail.models.Workflow.start> has been renamed to obj.

In addition, some methods on the base {class}~wagtail.models.Task model have been changed. If you have {doc}custom Task types </extending/custom_tasks>, make sure to update the methods to reflect the following changes:

• page_locked_for_user() is now {meth}~wagtail.models.Task.locked_for_user. Using page_locked_for_user() is deprecated and will be removed in a future release.
• The page parameter in user_can_access_editor(), locked_for_user(), user_can_lock(), user_can_unlock(), get_actions(), has been renamed to obj.

Changes to WorkflowState and TaskState models

To accommodate workflows support for snippets, the WorkflowState.page foreign key has been replaced with a GenericForeignKey as WorkflowState.content_object. The generic foreign key is defined using a combination of the new WorkflowState.base_content_type and WorkflowState.object_id fields.

The TaskState.page_revision foreign key has been renamed to TaskState.revision.

wagtail.admin.forms.search.SearchForm validation logic

The wagtail.admin.forms.search.SearchForm class (which is internal and undocumented, but may be in use by applications that extend the Wagtail admin) no longer treats an empty search field as invalid. Any code that checks form.is_valid to determine whether or not to apply a search() filter to a queryset should now explicitly check that form.cleaned_data["q"] is non-empty.

Wagtail 4.1.9 release notes

October 19, 2023

---
local:
depth: 1
---

What's new

CVE-2023-45809: Disclosure of user names via admin bulk action views

This release addresses an information disclosure vulnerability in the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any changes, the error message discloses the display names of user accounts, and by modifying URL parameters, the user can retrieve the display name for any user. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Many thanks to quyenheu for reporting this issue. For further details, please see the CVE-2023-45809 security advisory.

Wagtail 4.1.8 release notes

September 28, 2023

---
local:
depth: 1
---

What's new

Maintenance

• Additionally update Pillow dependency to allow use of versions with security fixes (Dan Braghis)

Wagtail 4.1.7 release notes

September 27, 2023

---
local:
depth: 1
---

What's new

Maintenance

• Relax Willow dependency to allow use of current Pillow versions with security fixes (Dan Braghis)

Wagtail 4.1.6 release notes

May 25, 2023

---
local:
depth: 1
---

What's new

Bug fixes

• Rectify previous fix for TableBlock becoming uneditable after save (Sage Abdullah)
• Ensure that copying page correctly picks up the latest revision (Matt Westcott)
• Adjust collection field alignment in multi-upload forms (LB (Ben) Johnston)
• Prevent lowercase conversions of IndexView column headers (Virag Jain)

Documentation

• Update documentation for log_action parameter on RevisionMixin.save_revision (Christer Jensen)

[release withdrawn due to packaging issues]