Update Wagtail and wagtail-markdown

Author: jlchilders11

requirements.txt

@@ -48,8 +48,6 @@ billiard==4.2.4
     # via celery
 black==26.5.1
     # via -r ./requirements.in
-bleach==4.1.0
-    # via wagtail-markdown
 boto3==1.42.41
     # via
     #   -r ./requirements.in
@@ -196,7 +194,7 @@ django-import-export==4.4.0
     # via -r ./requirements.in
 django-js-asset==3.1.2
     # via django-mptt
-django-modelcluster==6.4.1
+django-modelcluster==6.5
     # via wagtail
 django-mptt==0.14.0
     # via -r ./requirements.in
@@ -341,14 +339,16 @@ mistletoe==1.5.1
     # via -r ./requirements.in
 model-bakery==1.23.2
     # via -r ./requirements.in
-modelsearch==1.1.1
+modelsearch==1.3.1
     # via wagtail
 multidict==6.7.1
     # via
     #   aiohttp
     #   yarl
 mypy-extensions==1.1.0
     # via black
+nh3==0.3.6
+    # via wagtail-markdown
 nodeenv==1.10.0
     # via pre-commit
 numpy==2.4.2
@@ -367,7 +367,6 @@ openpyxl==3.1.5
 packaging==26.0
     # via
     #   black
-    #   bleach
     #   django-haystack
     #   django-test-plus
     #   ghapi
@@ -508,7 +507,6 @@ setuptools==80.10.2
     # via fs
 six==1.17.0
     # via
-    #   bleach
     #   django-bakery
     #   fs
     #   python-dateutil
@@ -590,16 +588,14 @@ vine==5.1.0
     #   kombu
 virtualenv==20.36.1
     # via pre-commit
-wagtail==7.3
+wagtail==7.4.2
     # via
     #   -r ./requirements.in
     #   wagtail-markdown
-wagtail-markdown==0.13.0
+wagtail-markdown==0.14.1
     # via -r ./requirements.in
 wcwidth==0.5.3
     # via prompt-toolkit
-webencodings==0.5.1
-    # via bleach
 wheel==0.46.3
     # via -r ./requirements.in
 whitenoise==6.11.0

versions/templatetags/whats_new_extras.py

@@ -1,6 +1,6 @@
 import re
 
-import bleach
+import nh3
 from django import template
 from django.utils.html import escape
 from django.utils.safestring import mark_safe
@@ -12,7 +12,7 @@
 # same position — e.g. `a**b**c` stays a code span, the inner ** is not bolded.
 _INLINE_RE = re.compile(r"`([^`]+)`|\*\*([^*]+?)\*\*")
 
-# The only tags inline_markdown is allowed to emit. bleach (already a project
+# The only tags inline_markdown is allowed to emit. nh3 (already a project
 # dependency via wagtail-markdown) is the source of truth for this allowlist.
 _ALLOWED_TAGS = ["code", "strong"]
 
@@ -30,10 +30,10 @@ def inline_markdown(value):
     Scoped to what `WHATS_NEW_SYSTEM_PROMPT` permits in description bullets:
     code identifiers in single backticks and double-asterisk bold. The input is
     escaped first so raw markup becomes inert text, the two permitted spans are
-    converted, then `bleach.clean` enforces the allowlist on the result.
+    converted, then `nh3.clean` enforces the allowlist on the result.
     """
     if not value:
         return ""
     html = _INLINE_RE.sub(_replace_span, escape(value))
-    cleaned = bleach.clean(html, tags=_ALLOWED_TAGS, attributes={}, strip=True)
+    cleaned = nh3.clean(html, tags=_ALLOWED_TAGS, attributes={}, strip=True)
     return mark_safe(cleaned)

versions/tests/test_templatetags.py

@@ -64,7 +64,7 @@ def test_inline_markdown_does_not_bold_inside_code_span():
     assert inline_markdown("`a**b**c`") == "<code>a**b**c</code>"
 
 
-def test_inline_markdown_strips_disallowed_tags_via_bleach():
-    """bleach enforces the <code>/<strong> allowlist; an unescaped angle
+def test_inline_markdown_strips_disallowed_tags_via_nh3():
+    """nh3 enforces the <code>/<strong> allowlist; an unescaped angle
     bracket inside a bold span is neutralized without dropping content."""
     assert inline_markdown("**a<b** test") == "<strong>a&lt;b</strong> test"