TWE-728: ruff.toml: extend-select over select, resolve RUF012 noise

.eslintrc.js

@@ -6,8 +6,5 @@ module.exports = {
         // This is actually because we don't have react in this project
         react: { version: '18.2.0' },
     },
-    rules: {
-        // tailwindcss@4 uses package.json exports which eslint-import-resolver-node doesn't support.
-        'import/no-unresolved': ['error', { ignore: ['^tailwindcss'] }],
-    },
+    rules: {},
 };

.github/pull_request_template.md

@@ -1,4 +1,4 @@
-[Link to Ticket]()
+[Link to Ticket](<>)
 
 ### Description of Changes Made
 

.github/workflows/flightpath.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
-          python-version: '3.13'
+          python-version: '3.14'
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip

.github/workflows/flightpath_status_check.yml

@@ -18,7 +18,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
-          python-version: '3.13'
+          python-version: '3.14'
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip

.github/workflows/gh-pages.yml

@@ -36,7 +36,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.13'
+          python-version: '3.14'
           cache: 'pip'
 
       - name: Install dependencies

.github/workflows/test.yml

@@ -14,7 +14,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.13'
+          python-version: '3.14'
       - uses: actions/setup-node@v4
         with:
           node-version-file: '.nvmrc'
@@ -94,7 +94,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.13'
+          python-version: '3.14'
           cache: 'poetry'
       - uses: actions/download-artifact@v4
         with:

.pre-commit-config.yaml

@@ -1,9 +1,9 @@
 default_language_version:
   node: system
-  python: python3.13
+  python: python3.14
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: 'v0.15.15' # keep in sync with pyproject.toml
+    rev: 'v0.16.5' # keep in sync with pyproject.toml
     hooks:
       - id: ruff
         args: [--fix, --exit-non-zero-on-fix]
@@ -51,7 +51,7 @@ repos:
         files: ^pyproject.toml$
 
   - repo: https://github.com/adamchainz/django-upgrade
-    rev: '1.30.0' # update with latest tag on GitHub
+    rev: '1.32.0' # update with latest tag on GitHub
     hooks:
       - id: django-upgrade
         args: [--target-version, '5.2'] # Django version used in this site

.stylelintrc.js

@@ -19,19 +19,29 @@ module.exports = {
             {
                 ignoreAtRules: [
                     'container',
-                    'config',
+                    'custom-variant',
                     'source',
                     'utility',
                     'theme',
                 ],
             },
         ],
-        'no-invalid-position-declaration': [
-            true,
-            {
-                ignoreAtRules: ['utility'],
-            },
-        ],
+        'no-invalid-position-declaration': true,
         'scss/dollar-variable-no-missing-interpolation': null,
     },
+    overrides: [
+        {
+            // Tailwind v4 CSS-first syntax (@utility/@theme/@custom-variant).
+            // A newer stylelint's plain-CSS rules don't recognise these
+            // at-rules as scoping contexts, so they false-positive on valid
+            // v4 syntax. Null exactly these two rules for this directory —
+            // every other rule (including scss/at-rule-no-unknown, which
+            // already doesn't flag these at-rules as unknown) stays live.
+            files: ['tbx/static_src/css/**/*.css'],
+            rules: {
+                'nesting-selector-no-missing-scoping-root': null,
+                'no-invalid-position-declaration': null,
+            },
+        },
+    ],
 };

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file. This projec
 
 Add your changes to the Unreleased section and move them to the appropriate section when they are merged.
 
+## Unreleased
+
+- [TWE-730](https://torchbox.atlassian.net/browse/TWE-730) - Django 5.2.18 security update
+
 ## 2026-05-21
 
 - [TWE-711](https://torchbox.atlassian.net/browse/TWE-711) - Fix RelatedBlog error edge case

Dockerfile

@@ -6,7 +6,7 @@ ARG CI=true
 WORKDIR /app
 
 # Install front-end dependencies.
-COPY package.json package-lock.json tsconfig.json webpack.config.js tailwind.config.js  ./
+COPY package.json package-lock.json tsconfig.json webpack.config.js ./
 RUN npm ci --no-audit --progress=false
 
 FROM frontend-deps AS frontend
@@ -21,7 +21,7 @@ RUN npm run build:prod
 # all useful packages required for image manipulation out of the box. They
 # however weight a lot, approx. up to 1.5GiB per built image.
 # Pinned to a particlar version as requested by support team 6/10/25
-FROM python:3.13-trixie AS python-base
+FROM python:3.14-trixie AS python-base
 
 ARG POETRY_INSTALL_ARGS="--no-dev"
 

README.md

@@ -25,7 +25,7 @@ mkdocs serve
 
 The documentation will be available at: <http://localhost:8001/>
 
-It is also available via github pages at https://torchbox.github.io/torchbox.com/
+It is also available via github pages at <https://torchbox.github.io/torchbox.com/>
 
 ## Setting up a local build
 
@@ -50,7 +50,7 @@ if you have older versions already installed they _may_ work, but are not guaran
   - [Install instructions](https://docs.docker.com/compose/install/) (Linux-only: Compose is already installed for Mac users as part of Docker Desktop or Orbstack.)
 - [Fabric](https://www.fabfile.org/), version 2.4.0 or up
   - [Install instructions](https://www.fabfile.org/installing.html)
-- Python, version 3.6.9 or up
+- Python, version 3.14 or up
 
 Note that on Mac OS, if you have an older version of fabric installed, you may need to uninstall the old one and then install the new version with pip3:
 
@@ -59,7 +59,7 @@ pip uninstall fabric
 pip3 install fabric
 ```
 
-You can manage different python versions by setting up `pyenv`: https://realpython.com/intro-to-pyenv/
+You can manage different python versions by setting up `pyenv`: <https://realpython.com/intro-to-pyenv/>
 
 Additionally, for interacting with production / staging environments, you'll need:
 
@@ -89,7 +89,7 @@ dj createcachetable
 dj createsuperuser
 ```
 
-The site should be available on the host machine at: http://127.0.0.1:8000/
+The site should be available on the host machine at: <http://127.0.0.1:8000/>
 
 If you only wish to run the frontend or backend tooling, the commands `honcho` runs are in `docker/Procfile`.
 

docker-compose.yml

@@ -51,7 +51,6 @@ services:
       - ./.stylelintrc.js:/app/.stylelintrc.js:rw
       - ./package-lock.json:/app/package-lock.json:rw
       - ./package.json:/app/package.json:rw
-      - ./tailwind.config.js:/app/tailwind.config.js:rw
       - ./tsconfig.json:/app/tsconfig.json:rw
       - ./webpack.config.js:/app/webpack.config.js:rw
 

docs/front-end/breakpoints.md

@@ -21,4 +21,4 @@ $breakpoints: (
 
 Other breakpoints can be added to this map as required, however the breakpoints should be used sparingly and only when the design requires it.
 
-These breakpoints should match the screen sizes set up in `tailwind.config.js`.
+These breakpoints should match the breakpoints set up in the `@theme` block in `tbx/static_src/css/tailwind.css`.

docs/front-end/utility-classes.md

@@ -6,4 +6,4 @@ Some, such as the `listing` component are designed to be a base with variations
 
 However, we have some utility classes which are designed for re-use, along with the option to to use Tailwind utility classes. Classes that are designed for re-use include `button`, `heading--[xyz]`, `text--[xyz]`, `link`, and `icon--listing-arrow`.
 
-The same tailwind utility classes that are avialable in `wagtail-kit` are available in this build. `tailwind.config.js` includes the custom spacing for the build, allowing us to use classes such as `mb-spacerMini` where it wouldn't be practical to create a new scss component just for a one-off spacing adjustment.
+The same tailwind utility classes that are avialable in `wagtail-kit` are available in this build. The `@theme` block in `tbx/static_src/css/tailwind.css` includes the custom spacing for the build, allowing us to use classes such as `mb-spacerMini` where it wouldn't be practical to create a new scss component just for a one-off spacing adjustment.

docs/upgrading.md

@@ -87,3 +87,23 @@ As much as possible, we want to use the official releases available on PyPI for
 **Last checked** Wagtail 7.3 upgrade
 
 Add references to any custom templates that override the Wagtail admin templates. These should be checked to ensure they still work as expected after the upgrade.
+
+## Node dependency holds
+
+### typescript
+
+**Last checked** Wagtail 8.0 upgrade
+
+- Held at `^6.0.3`. `ts-jest` (latest 29.4.12) declares a peer range of `typescript >=4.3 <7`, so TypeScript 7 fails to install.
+- Lift when a `ts-jest` release supports TypeScript 7.
+
+### eslint and eslint-webpack-plugin
+
+**Last checked** Wagtail 8.0 upgrade
+
+- Held at `^8.57.1` and `^5.0.3`, the range `eslint-config-torchbox@^1.1.0` supports. No flat-config (ESLint v9) release of that package exists yet.
+- This is the fleet-wide ESLint v8 ceiling applied by the Node bump tooling. It lifts via the ESLint to Biome migration, not per project. See the [ESLint v9 migration guide](https://eslint.org/docs/latest/use/migrate-to-9.0.0).
+
+## Security
+
+Last security review: 2026-09-01

fabfile.py

@@ -10,7 +10,7 @@
 # Process .env file
 if os.path.exists(".env"):
     with open(".env") as f:
-        for line in f.readlines():
+        for line in f:
             if not line or line.startswith("#") or "=" not in line:
                 continue
             var, value = line.strip().split("=", 1)
@@ -102,15 +102,17 @@ def sh(c, service="web"):
     """
     Run bash in a local container
     """
-    subprocess.run(["docker", "compose", "exec", service, "bash"])
+    subprocess.run(["docker", "compose", "exec", service, "bash"], check=False)
 
 
 @task
 def sh_root(c, service="web"):
     """
     Run bash as root in the local web container.
     """
-    subprocess.run(["docker", "compose", "exec", "--user=root", "web", "bash"])
+    subprocess.run(
+        ["docker", "compose", "exec", "--user=root", "web", "bash"], check=False
+    )
 
 
 @task
@@ -130,7 +132,7 @@ def psql(c, command=None):
     if command:
         cmd_list.extend(["-c", command])
 
-    subprocess.run(cmd_list)
+    subprocess.run(cmd_list, check=False)
 
 
 # TODO check the rest of these work correctly from here down
@@ -474,5 +476,6 @@ def migrate(c):
     Run database migrations
     """
     subprocess.run(
-        ["docker", "compose", "run", "--rm", "web", "./manage.py", "migrate"]
+        ["docker", "compose", "run", "--rm", "web", "./manage.py", "migrate"],
+        check=False,
     )