search

IATI / IATI-Standard-Website

IATI (about & guidance) website based on Django and Wagtail CMS
MIT License
6 stars 8 forks source link

Bump wagtail from 4.1.9 to 5.2.6 #763

Open dependabot[bot] opened 3 months ago

dependabot[bot] commented 3 months ago

Bumps wagtail from 4.1.9 to 5.2.6.

Release notes

Sourced from wagtail's releases.

5.2.6

  • Fix: CVE-2024-39317: Regular expression denial-of-service via search query parsing (Jake Howard)
  • Fix: Fix image preview when Willow optimizers are enabled (Alex Tomkins)
  • Maintenance: Remove django-pattern-library upper bound in testing dependencies (Sage Abdullah)

5.2.5

  • Fix: Respect WAGTAIL_ALLOW_UNICODE_SLUGS setting when auto-generating slugs (LB (Ben) Johnston)
  • Fix: Use correct URL when redirecting back to page search results after an AJAX search (Sage Abdullah)
  • Fix: Provide convert_mariadb_uuids management command to assist with upgrading to Django 5.0+ on MariaDB (Matt Westcott)

5.2.4

  • Fix: Prevent TitleFieldPanel from raising an error when the slug field is missing or read-only (Rohit Sharma)
  • Fix: Fix pagination links on model history and usage views (Matt Westcott)
  • Fix: Fix crash when accessing workflow reports with a deleted snippet (Sage Abdullah)
  • Fix: Prevent error on submitting an empty search in the admin under Elasticsearch (Maikel Martens)

5.2.3

  • Fix: Prevent a ValueError with FormSubmissionsPanel on Django 5.0 when creating a new form page (Matt Westcott)
  • Fix: Specify telepath 0.3.1 as the minimum supported version, for Django 5.0 compatibility (Matt Westcott)

5.2.2

  • Added support for Django 5.0
  • Fix: Use a visible border and background color to highlight active formatting in the rich text toolbar (Cassidy Pittman)
  • Fix: Ensure image focal point box can be removed (Gunnar Scherf)
  • Fix: Ensure that Snippets search results correctly use the index_results.html or index_results_template_name override on initial load (Stefan Hammer)
  • Fix: Avoid error when attempting to moderate a page drafted by a now deleted user (Dan Braghis)
  • Fix: Ensure workflow dashboard panels work when the page/snippet is missing (Sage Abdullah)
  • Fix: Prevent custom controls from stacking on top of the comment button in Draftail toolbar (Ben Morse)
  • Fix: Avoid error when exporting Aging Pages report where a page has an empty last_published_by_user (Chiemezuo Akujobi)

5.2.1

  • Fix: Add a fallback background for the editing preview iframe for sites without a background (Ian Price)
  • Fix: Remove search logging from project template so that new projects without the search promotions module will not error (Matt Westcott)
  • Fix: Ensure text only email notifications for updated comments do not escape HTML characters (Rohit Sharma)
  • Fix: Use logical OR operator to combine search fields for Django ORM in generic IndexView (Varun Kumar)
  • Fix: Ensure that explorer_results views fill in the correct next_url parameter on action URLs (Matt Westcott)
  • Fix: Fix crash when accessing the history view for a translatable snippet (Sage Abdullah)
  • Fix: Prevent upload of SVG images from failing when image feature detection is enabled (Joshua Munn)
  • Fix: Fix crash when using the locale switcher on the snippets create view (Sage Abdullah)
  • Fix: Fix performance regression on reports from calling decorate_paginated_queryset before pagination / filtering (Alex Tomkins)
  • Fix: Make searching on specific fields work correctly on Elasticsearch when boost is in use (Matt Westcott)
  • Fix: Prevent snippet permission post-migrate hook from failing on multiple database configurations (Joe Tsoi)
  • Fix: Reinstate ability to filter on page type when searching on an empty query (Sage Abdullah)
  • Fix: Prevent error on locked pages report when a user has locked multiple pages (Matt Westcott)
  • Docs: Fix code example for {% picture ... as ... %} template tag (Rezyapkin)

5.2 (LTS)

  • Redesigned page listing view (Ben Enright, Matt Westcott, Thibaud Colas, Sage Abdullah)
  • Support OpenSearch as an alternative to Elasticsearch (Matt Westcott)
  • Add support for Python 3.12 (Matt Westcott)

... (truncated)

Changelog

Sourced from wagtail's changelog.

5.2.6 (11.07.2024)


 * Fix: CVE-2024-39317: Regular expression denial-of-service via search query parsing (Jake Howard)
 * Fix: Fix image preview when Willow optimizers are enabled (Alex Tomkins)
 * Maintenance: Remove django-pattern-library upper bound in testing dependencies (Sage Abdullah)

5.2.5 (01.05.2024)

  • Fix: Respect WAGTAIL_ALLOW_UNICODE_SLUGS setting when auto-generating slugs (LB (Ben) Johnston)
  • Fix: Use correct URL when redirecting back to page search results after an AJAX search (Sage Abdullah)
  • Fix: Provide convert_mariadb_uuids management command to assist with upgrading to Django 5.0+ on MariaDB (Matt Westcott)

5.2.4 (03.04.2024)


 * Fix: Prevent TitleFieldPanel from raising an error when the slug field is missing or read-only (Rohit Sharma)
 * Fix: Fix pagination links on model history and usage views (Matt Westcott)
 * Fix: Fix crash when accessing workflow reports with a deleted snippet (Sage Abdullah)
 * Fix: Prevent error on submitting an empty search in the admin under Elasticsearch (Maikel Martens)

5.2.3 (23.01.2024)

  • Fix: Prevent a ValueError with FormSubmissionsPanel on Django 5.0 when creating a new form page (Matt Westcott)
  • Fix: Specify telepath 0.3.1 as the minimum supported version, for Django 5.0 compatibility (Matt Westcott)

5.2.2 (06.12.2023)


 * Added support for Django 5.0
 * Fix: Use a visible border and background color to highlight active formatting in the rich text toolbar (Cassidy Pittman)
 * Fix: Ensure image focal point box can be removed (Gunnar Scherf)
 * Fix: Ensure that Snippets search results correctly use the `index_results.html` or `index_results_template_name` override on initial load (Stefan Hammer)
 * Fix: Avoid error when attempting to moderate a page drafted by a now deleted user (Dan Braghis)
 * Fix: Ensure workflow dashboard panels work when the page/snippet is missing (Sage Abdullah)
 * Fix: Prevent custom controls from stacking on top of the comment button in Draftail toolbar (Ben Morse)

5.2.1 (16.11.2023)

  • Fix: Add a fallback background for the editing preview iframe for sites without a background (Ian Price)
  • Fix: Remove search logging from project template so that new projects without the search promotions module will not error (Matt Westcott)
  • Fix: Ensure text only email notifications for updated comments do not escape HTML characters (Rohit Sharma)

... (truncated)

Commits
  • 3ee28ee Fix test syntax for Python<=3.11
  • b8f8394 Version bump to 5.2.6
  • b49de41 Fill in release date for 5.2.6
  • 68917f1 Release note for CVE-2024-39317 in 5.2.6
  • 31b1e85 Require word boundaries before search query filters (CVE-2024-39317)
  • d398c3f Do not set STATICFILES_STORAGE in test settings on Django >= 4.2
  • fea0cde Install django-rest-framework 3.15.1 when testing against Django 3.2
  • 7f1a42a Add release notes for 5.2.6
  • 71e6f69 Remove upper bound on django-pattern-library in testing dependencies
  • 67a968c Fix image preview when Willow optimizers are enabled (#12047)
  • Additional commits viewable in compare view


Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/IATI/IATI-Standard-Website/network/alerts).

Note Automatic rebases have been disabled on this pull request as it has been open for over 30 days.