Wagtail 7.3 release notes¶

Initial support for autosave¶

The editor now automatically saves pages and snippets as you make changes to the content. Conflicting changes made in other editing sessions are detected using the existing concurrent editing notifications system. In the case of conflicts, validation errors, or other issues, autosave is paused and the user is notified. Autosave resumes once the issue has been resolved.

The autosave feature is enabled by default for all pages and snippets that use the RevisionMixin. The autosave interval can be configured or disabled via the WAGTAIL_AUTOSAVE_INTERVAL setting.

This feature was developed by Matt Westcott and Sage Abdullah, with review and support from Thibaud Colas and the Wagtail UI team, as well as designs by Ben Enright. We would like to thank Wharton Research Data Services for their sponsorship of this feature.

Settings and custom block layouts for StructBlock¶

The StructBlock.Meta class now supports a form_layout attribute that allows you to customize the order and grouping of child blocks in the editing interface. You can provide a list of block names to specify the order, or use the new BlockGroup class to create collapsible groups of blocks, including a special “settings” group that is hidden by default. Refer to Changing the order and grouping of child blocks for more details.

This feature was developed by Sage Abdullah, with support from the Wagtail UI team and reference to previous work by Andy Babic.

llms.txt for docs¶

The developer documentation and the Wagtail user guide now publish their contents in the llms.txt format. Those files can be used to provide context to Large Language Models on Wagtail projects. For both sites, this includes llms.txt files with an index of the site contents, large llms-full.txt files with full documentation contents, and Markdown variants of every page (with full docstrings contents):

• llms.txt

• llms-full.txt

• Add .md at the end of any documentation page URL to view the Markdown output of that page. Examples: 7.3 release notes in Markdown, StreamField block reference in Markdown

• User guide llms.txt

• User guide llms-full.txt

This feature was developed by Thibaud Colas.

New image quality defaults¶

Wagtail’s default image quality settings are now optimized for the needs of a wider number of sites, and consistent between image formats. The default settings are now lower for JPEG and AVIF. This will reduce image file sizes, loading times, and energy use of loading images.

Those changes in default settings won’t affect existing images, but it is possible to re-generate them if desired. View our image quality documentation for more information, and recommended quality settings for common use cases.

This feature was developed by Thibaud Colas.

Custom content checks¶

The built-in accessibility checker now supports custom content checks. Those checks can provide live feedback to CMS users when content doesn’t meet accessibility best practices. They also support opinionated rules about other aspects of content quality - for example SEO, readability, tone of voice, page weight.

This feature was developed by Thibaud Colas.

Settings editing hooks¶

New before_edit_setting and after_edit_setting hooks provide extension points for customizing the settings editing workflow. These hooks allow developers to extend settings management with custom validation, logging, notifications, or other actions. This matches capabilities available for pages and snippets.

This feature was developed by Baptiste Mispelon.

CVE-2026-25517: Improper permission handling on admin preview endpoints¶

This release addresses a permission vulnerability in the Wagtail admin interface. Due to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model’s fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user’s choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Other features¶

• Resize overly large avatar images on upload (Harshit Ranjan)

• Add natural keys for Page and Collection models (Samya Aggarwal)

• Add Loom oEmbed provider (Nick Ivons)

• Add ModelViewSet.pk_path_converter with defaults for IntegerField and UUIDField primary keys (Seb Corbin)

• Improve accessibility for sidebar menu with visual active (expanded) menu item indicators (Vignesh Shivhare)

• Lower default AVIF encoding quality from 80 to 73 (Thibaud Colas)

• Provide a structured rendering of StreamBlock in comparison view (Taras Panasiuk)

• Switch userbar items to the template components API (Thibaud Colas)

Bug fixes¶

• Do not try to resolve locale during fixture load (Jake Howard, Seb Corbin)

• Gracefully handle oEmbed responses with a non-200 status or missing type (Shivam Kumar, Bhavesh Sharma)

• Keep action button labelled as “Publish” rather than “Schedule to publish” if go-live date has passed (Vishrut Ramraj)

• Pass accumulated icons to each register_icons hook (Joey Jurjens, Sage Abdullah)

• Skip revisions that are missing the specified field in StreamField migrations (Joshua Munn)

• Preserve listing search and filter parameters when redirecting from bulk actions (Sage Abdullah)

• Ensure that object references within TypedTableBlock are counted in the reference index (Aman Bora)

• Fix slug auto-generation when slug field is omitted from page edit form (Pravin Kamble)

• Ensure request.is_preview and request.preview_mode are set for password-required responses (Ishtpreet Singh)

• Optimise storage of redirect paths containing Unicode characters and ensure percent-encoded characters are matched case-insensitively (Andy Babic, Florin Barnea, Aman Bora, Matt Westcott)

• Ensure that reference index records are deleted when the target object is deleted (bettercallok)

• Ensure filters are applied to export button URLs in custom page listings (Ritik Arya, Sage Abdullah)

• Prevent conflicting IDs in nested StructBlocks with blocks named content (Sage Abdullah, Serkan Korkusuz)

Documentation¶

• Recommend running purge_embeds after an embed provider changes policies (Paul Souders)

• Document WAGTAILIMAGES_FORMAT_CONVERSIONS in the settings docs (David Buxton)

• Wording changes to Draftail extension docs to improve searchability (Lasse Schmieding)

• Fix StreamField param name (Baptiste Mispelon)

• Clarify that before_delete_page and similar hooks only trigger on the individual page view, not bulk actions (Shivam Kumar)

• Clarify template location in custom user model documentation (Akhil Muraleedharan)

• Improve signposting for contributor docs (Matt Westcott)

• Add mention of novalidate attribute in form builder docs (Thibaud Colas)

• Fix formatting for PageQuerySet.prefetch_related performance note (Lasse Schmieding)

• Fix path to search.html in tutorial (Lee Hart)

• Grammar fixes to contributor guidelines (Biswajeet Yadav)

• Mention punctuation is unsupported in paths for RoutablePageMixin (Tibor Leupold)

• Various typo and grammar fixes (Mustansir Dabhiya)

• Improve instructions for building documentation on Windows (Mustansir Dabhiya)

• Add detailed documentation on reordering within generic listing view (Ankit Chaudhary)

• Document early notification process for security releases (Jake Howard)

• Remove mention of Wagtailtrans from internationalization docs (Andreas Nüßlein)

Maintenance¶

• Dropped support for Django 5.1

• Updated NPM packages (LB (Ben) Johnston)

• Rationalize front-end linting tasks and run concurrently (LB (Ben) Johnston)

• Add a basic set of Storybook stories for the Stimulus Autosize controller (LB (Ben) Johnston)

• Remove use of _WAGTAILSEARCH_FORCE_AUTO_UPDATE in search tests (Matt Westcott)

• Add unit test for SubmitController error handling (LB (Ben) Johnston)

• Improve nightly release upload scripts (Jake Howard)

• Upload redundant latest.whl nightly build for ease of use with package managers (Sage Abdullah)

• Move MANIFEST.in settings into pyproject.toml (Pravin Kamble)

• Fix linting rules B006 (mutable data structures for argument defaults) and B904 (raise ... from err within an except clause) (Vivek Subramani, Matt Westcott)

• Remove jQuery dependency for image URL generator (LB (Ben) Johnston)

• Upgrade to django-modelcluster 6.4.1 for Django 6.0 compatibility (Matt Westcott)

• Refactor CreateView/EditView validation logic to support non-form validation (Matt Westcott)

• Formalized support for Django 6.0 (Pravin Kamble)

• Add no-jquery ESLint plugin to start final deprecation of jQuery (LB (Ben) Johnston)

• Add mode value to w-teleport to allow different DOM update strategies (Sage Abdullah)

• Ignore ‘build’ dir when running ESLint (Matt Westcott)

• Upgrade to django-tasks 0.11.0 for Django 6.0 and Python 3.11 compatibility (Guilhem Saurel)

• Switch userbar items to the template components API (Thibaud Colas)

Loading of fixtures containing models referencing Locale¶

Previously, when loading fixtures of Page models or other models extending TranslatableMixin, missing locale_id values would be automatically filled with the default Locale. This could break the setup of TransactionTestCase, and so this functionality has now been removed. Fixtures must now specify an explicit locale_id value.

New image quality defaults¶

Image quality settings for JPEG and AVIF now use lower default values, set to provide consistent perceptual quality between formats. This will take effect for newly-generated images only.

• WAGTAILIMAGES_JPEG_QUALITY changed from 85 to 76.

• WAGTAILIMAGES_AVIF_QUALITY changed from 80 to 61.

The new values match the default (unchanged) WAGTAILIMAGES_WEBP_QUALITY of 80. For sites considering custom values for those settings, refer to our recommended image quality table to make sure perceptual quality is consistent between different formats.

Userbar items rendering¶

The items in the Wagtail userbar have been refactored to Template components. This changes the internal API for custom userbar items, with a render_html(parent_context) method. The pre-existing render(request) method has been deprecated and will be removed in a future release.

Userbar items internals¶

As part of refactoring userbar items to Template components, the following undocumented internals have changed:

• The userbar BaseItem and its subclasses now inherit from Component.

• Its template attribute has been renamed to template_name.

• Its get_context_data method now receives a parent_context parameter, instead of a request parameter.

Image URL generator changes¶

The URL wagtailimages:generate_url and its associated view class GenerateURLView have been replaced. The new dynamic image URL generator UI uses Stimulus, with the URL wagtailimages:url_generator_output and the same URLGeneratorView as the page itself with async requests now returning HTML partials. Any overrides to those views or their template wagtailimages/url_generator.html will need to be adapted.

Refactored validation logic for generic model CreateView and EditView¶

The form validation logic in wagtail.admin.views.generic.models.CreateView (aliased as wagtail.admin.views.generic.CreateView, and also subclassed as wagtail.snippets.views.snippets.CreateView) and wagtail.admin.views.generic.models.EditView (aliased as wagtail.admin.views.generic.EditView, and also subclassed as wagtail.snippets.views.snippets.EditView) has been refactored to better support validation conditions not handled by the form object (such as formsets displayed alongside the form, or a ‘locked’ status on the model). Any user code that overrides the post, form_valid, form_invalid and/or get_error_message methods to implement additional validation will need to be updated. These views now implement a new method is_valid(form), which by default delegates to form.is_valid(). To signal a validation error, this method should set the attribute self.produced_error_message to the desired error message string, and return False. For a generic validation error, this error message string can be obtained from self.get_error_message().