Repository navigation
TWE-728: Quarterly maintenance: Wagtail 7.4 → 8.0 - #456
Merged
Merged
Conversation
damwaingames
approved these changes
Sep 8, 2026
damwaingames
left a comment
Collaborator
There was a problem hiding this comment.
I made a commit cleaning up upgrading.md and also completing the tailwind 4 work properly. You may want to double check it.
zerolab
reviewed
Sep 16, 2026
zerolab
reviewed
Sep 16, 2026
zerolab
reviewed
Sep 16, 2026
zerolab
reviewed
Sep 16, 2026
nickmoreton
force-pushed
the
support/TWE-728-wagtail-80-upgrade
branch
from
October 12, 2026 16:24
097b9c6 to
d6d67ca
Compare
2 tasks done
zerolab
reviewed
Oct 13, 2026
2 of 3 tasks
Bumps the Wagtail pin from ~7.4 to ~8.0 (major) via `poetry add`, refreshing the lockfile for Wagtail and its transitive dependencies. Folds in the specifier-normalisation pass (Poetry `^` carets rewritten to `~` tilde pins at each package's installed major.minor). wagtail-upgrade-audit 0.19.2 has no `wagtail80` ruleset yet (its known audits top out at `wagtail74`), so no automated findings were available for this major version. `manage.py check` and the test suite were run as validation instead and are green. Django stays at ~5.2 (patch-only bump, handled in the next commit). Co-authored-by: Support Skills <support@torchbox.com>
Advances every eligible specifier floor to the latest supply-chain- cool-down-allowed minor and refreshes poetry.lock accordingly (Django and Wagtail excluded — they move only through the audit gate, handled in the previous commit). Notable floor bumps: django-redis ~6.0 → ~7.0 (major), django-debug-toolbar ~6.3 → ~7.1 (major), plus minor bumps to gunicorn, django-pattern-library, django-permissions-policy, django-phonenumber-field, wagtailmedia, sentry-sdk, beautifulsoup4, django-upgrade, ruff, pymdown-extensions, faker, and wagtail-factories. `manage.py check` and the full test suite (141 tests) pass with no new warnings. Co-authored-by: Support Skills <support@torchbox.com>
- Bump devDependencies/dependencies to latest via ncu, held to the ESLint ceiling (eslint, eslint-webpack-plugin) and the npm cool-down clamp (jest, jest-environment-jsdom, sass-loader, webpack). - Hold typescript at ^6.0.3 (<7): ts-jest's latest release (29.4.12) still peer-depends on typescript <7, so a TS7 install fails ERESOLVE. Logged in docs/upgrading.md with the lift condition. - Drop dead IE11 scaffolding (presumptive drop, confirmed green): browserslist ie11 entries, the foreach/closest polyfills, the svgo ie11 closing-tags override, and raise the TS target from es5 to es2016. - Fix fallout from the bump: reformat .github/pull_request_template.md (prettier 3.9.6), drop an eslint-disable in dynamic-hero.js left over from an older swiper resolution issue (swiper 12 -> 14). Co-authored-by: Support Skills <support@torchbox.com>
Co-authored-by: Support Skills <support@torchbox.com>
Co-authored-by: Support Skills <support@torchbox.com>
…e narrative Co-authored-by: Support Skills <support@torchbox.com>
Co-authored-by: Support Skills <support@torchbox.com>
Co-authored-by: Support Skills <support@torchbox.com>
ruff 0.16 expanded its default rule set from just E/F to nearly every category. ruff.toml used extend-select, so the 0.16 default drift leaked in underneath the explicit list, surfacing 459 new findings (dominated by RUF012 on idiomatic Wagtail/Django patterns) that were never actually selected. Switching extend-select to select closes the config over ruff's defaults, so it no longer drifts with them. Confirmed 0 findings under ruff 0.16.5 with the fix; pre-commit hook bumped to v0.16.5 to match the poetry-managed version, lifting the hold from 96fd005. Co-authored-by: Support Skills <support@torchbox.com>
Move the colour, breakpoint and spacing theme, content sources and the forced-colors variant into tbx/static_src/css/tailwind.css. Split the webpack style rule so plain CSS skips sass-loader (Dart Sass cannot parse Tailwind's --color-*: initial reset). Remove the JS config from the Docker build and compose mount, and the ESLint ignore that only existed for it. Rewrite the upgrading.md Node hold entries as state and remove the Tailwind section, whose content now lives in the CSS file and existing checklists. Compiled output verified equivalent by diffing the full webpack build before and after. Co-authored-by: Support Skills <support@torchbox.com>
Co-authored-by: Support Skills <support@torchbox.com>
… (2.8.0) Co-authored-by: Support Skills <support@torchbox.com>
- wagtail-markdown from 0.14.1 to 0.15.0 - wagtailmedia from 0.18.1 to 0.19.1 - django-debug-toolbar from 7.1.1 to 8.0.0
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
nickmoreton
force-pushed
the
support/TWE-728-wagtail-80-upgrade
branch
from
October 21, 2026 08:21
c5a0420 to
0aac0a3
Compare
Lock-only bump for GHSA-jm43-45cc-q9rr, GHSA-g6cr-c9h3-6j2m, GHSA-3xgh-xc8p-9h54, GHSA-4pg7-87vv-vrh7, GHSA-jrgm-fhgv-hmj9. Co-authored-by: Support Skills <support@torchbox.com>
Lock-only bump for GHSA-6q48-6c7w-9gw2. certifi 2026.10.18 drops the emSign root certificates, whose intermediates were revoked after a key compromise. The release is two days old, so it goes in inside the cool-down, by agreement, for this release only. Co-authored-by: Support Skills <support@torchbox.com>
`tbx-support run trivy-scan run_scan` on this branch printed "Trivy scan complete. No vulnerabilities found." Co-authored-by: Support Skills <support@torchbox.com>
TWE-733: Security update: Wagtail 8.0.1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TWE-728: Quarterly maintenance: Wagtail 7.4 → 8.0
Stacked PR: #470 Python 3.13 -> 3.14
Wagtail 8.0 release notes
Changes made
Requires manual attention
Testing
All sub-MRs green. Platform: confirmed no-op via a green Docker build and full test run (141 tests, OK, 2 skipped). Python bump (#452): two-commit split for the Wagtail MAJOR, wagtail-upgrade-audit run (see attention item above), full test suite green twice (once per commit), CI green via gh pr checks (compile_static, lint, test_js, test_python all pass) — used as the certification substitute since tbx-support mr pipeline does not support GitHub. Node bump (#453): CI green via gh pr checks (all 4 jobs pass). Tailwind v4 migration cleanup (#454): build/lint/test green locally and in CI. Trivy scan (#455): 0 findings; its diff is docs-only so no CI workflow triggered (paths-ignore: ["docs/**"]) — confirmed structurally, not a red or stuck pipeline.
Visual QA attestation: the Node bump's gate reported an outstanding Tailwind v4 completing migration (tailwindcss was already ^4.3.0 on main; this cycle finished the remaining catalogue items and bumped the patch version to ^4.3.3), which triggers the same post-integration visual-QA gate as a full MAJOR crossing — so it was run against the fully assembled integration branch regardless. Nick Moreton (nick.moreton@torchbox.com) confirmed on 2026-09-01 against an ephemeral environment (compose project tbx-standup-2d9df799, http://localhost:32770/) — homepage, pattern library, and dark/light mode toggle all rendered correctly. The environment was torn down after confirmation.