Wagtail 74 maintenance

.github/dependabot.yml

@@ -9,20 +9,19 @@ updates:
   ignore:
   - dependency-name: flake8
     versions:
-    - 3.8.4
-    - 3.9.0
+    - 7.3.0
   - dependency-name: coverage
     versions:
-    - "5.4"
+    - "7.13.4"
   - dependency-name: pytest
     versions:
-    - 6.2.2
+    - 9.0.2
   - dependency-name: isort
     versions:
-    - 5.7.0
+    - 8.0.1
   - dependency-name: django-debug-toolbar
     versions:
-    - "3.2"
+    - "6.2.0"
   - dependency-name: pytest-django
     versions:
-    - 4.1.0
+    - 4.12.0

.github/workflows/python-release.yml

@@ -11,7 +11,7 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Set up Python 3.11
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: 3.11
 

.github/workflows/python-tox.yml

@@ -12,7 +12,7 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Set up Python ${{ matrix.python }}
-        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ matrix.python }}
 

CHANGES

@@ -1,3 +1,20 @@
+Unreleased
+==================
+ - Add support for Wagtail 7.4 (LTS) and Django 6.0
+ - Expand test matrix to cover Python 3.10, 3.11, and 3.12 (previously
+   declared in classifiers but not exercised in tox); CI now tests against
+   Wagtail 7.0, 7.3, and 7.4 (LTS + current + previous current)
+ - Declare upper bounds: ``Django>=5.2,<7`` and ``Wagtail>=7.0,<8``.
+   Users on Wagtail 7.0 with Django 4.2 should remain on ``wagtail-2fa
+   1.8.x``; this release requires Django 5.2 or newer
+ - Remove vestigial ``six`` install dependency (unused since the Python 2
+   compatibility shim was dropped)
+ - Remove dead ``DJANGO_VERSION`` import guard in ``views.py`` (the
+   ``Django < 4.1`` branch is unreachable now that ``Django>=5.2`` is
+   required)
+ - Update dependencies to latest versions
+
+
 1.8.0 (2026-02-05)
 ==================
  - bump required version of django-otp and update middleware

README.rst

@@ -114,8 +114,8 @@ and 2FA can be enabled or disabled per group.
 Sandbox
 =======
 
-First create a new virtualenv with Python 3.8 and activate it. Then run
-the following commands:
+First create a new virtualenv with Python 3.10 or newer and activate it.
+Then run the following commands:
 
 .. code-block:: shell
 

sandbox/requirements.txt

@@ -1,4 +1,4 @@
-Django>=3.2
-wagtail>=4.1
-django-debug-toolbar==3.2.2
+Django>=5.2
+Wagtail>=7.0
+django-debug-toolbar==6.2.0
 -e .[docs,test]

sandbox/sandbox/settings.py

@@ -119,7 +119,6 @@
 
 USE_I18N = True
 
-USE_L10N = True
 
 USE_TZ = True
 

sandbox/sandbox/urls.py

@@ -1,6 +1,7 @@
 import debug_toolbar
 from django.conf import settings
 from django.contrib import admin
+from django.urls import path
 from django.urls import include, re_path
 
 from wagtail import urls as wagtail_urls
@@ -9,9 +10,9 @@
 
 urlpatterns = [
     re_path(r'^admin/', admin.site.urls),
-    re_path(r'^cms/', include(wagtailadmin_urls)),
-    re_path(r'^documents/', include(wagtaildocs_urls)),
-    re_path(r'', include(wagtail_urls)),
+    path('cms/', include(wagtailadmin_urls)),
+    path('documents/', include(wagtaildocs_urls)),
+    path('', include(wagtail_urls)),
 ]
 
 
@@ -24,5 +25,5 @@
     urlpatterns += static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT)
 
     urlpatterns = [
-        re_path(r'^__debug__/', include(debug_toolbar.urls)),
+        path('__debug__/', include(debug_toolbar.urls)),
     ] + urlpatterns

setup.py

@@ -6,25 +6,24 @@
     "Django>=5.2",
     "Wagtail>=7.0",
     "django-otp>=1.7.0",
-    "six>=1.14.0",
     "qrcode>=6.1",
 ]
 
 docs_require = [
-    "sphinx>=1.4.1",
-    "sphinx_rtd_theme>=0.4.3",
+    "sphinx>=7.0",
+    "sphinx_rtd_theme>=2.0",
 ]
 
 tests_require = [
-    "coverage==5.5",
-    "pytest>=7.2.2",
-    "pytest-cov>=2.12.1",
-    "pytest-django>=4.4.0",
+    "coverage>=7.0",
+    "pytest>=8.0",
+    "pytest-cov>=5.0",
+    "pytest-django>=4.8",
     # Linting
-    "flake8>=3.9.2",  # 3.7.9
-    "isort>=5.12.0",
-    "flake8-blind-except>=0.2.0",
-    "flake8-debugger>=4.0.0",
+    "flake8>=7.0",
+    "isort>=5.13",
+    "flake8-blind-except>=0.2.1",
+    "flake8-debugger>=4.1",
 ]
 
 with open("README.rst") as fh:
@@ -57,19 +56,17 @@
         "Development Status :: 4 - Beta",
         "Environment :: Web Environment",
         "Framework :: Django",
-        "Framework :: Django :: 3.2",
-        "Framework :: Django :: 4.1",
-        "Framework :: Django :: 4.2",
+        "Framework :: Django :: 5.2",
+        "Framework :: Django :: 6.0",
         "Framework :: Wagtail",
-        "Framework :: Wagtail :: 2",
-        "Framework :: Wagtail :: 3",
-        "Framework :: Wagtail :: 4",
+        "Framework :: Wagtail :: 7",
         "License :: OSI Approved :: MIT License",
         "Programming Language :: Python",
-        "Programming Language :: Python :: 3.8",
-        "Programming Language :: Python :: 3.9",
         "Programming Language :: Python :: 3.10",
         "Programming Language :: Python :: 3.11",
+        "Programming Language :: Python :: 3.12",
+        "Programming Language :: Python :: 3.13",
+        "Programming Language :: Python :: 3.14",
     ],
     zip_safe=False,
 )

src/wagtail_2fa/middleware.py

@@ -17,6 +17,10 @@ class VerifyUserMiddleware(_OTPMiddleware):
         "wagtailadmin_sprite",
     ]
 
+    def get_allowed_url_names(self):
+        extra = getattr(settings, "WAGTAIL_2FA_ALLOWED_URL_NAMES", [])
+        return self._allowed_url_names + list(extra)
+
     # These URLs do not require verification if the user has no devices
     _allowed_url_names_no_device = [
         "wagtail_2fa_device_list",
@@ -75,7 +79,7 @@ def _require_verified_user(self, request):
 
         # Don't require verification for specified URL names
         request_url_name = resolve(request.path_info).url_name
-        if request_url_name in self._allowed_url_names:
+        if request_url_name in self.get_allowed_url_names():
             return False
 
         # If the user does not have a device, don't require verification

src/wagtail_2fa/templates/wagtail_2fa/device_list.html

@@ -46,7 +46,10 @@ <h2>
 
         {# Users can only add devices to their own account #}
         {% if user_id == request.user.id %}
-            <a href="{% url 'wagtail_2fa_device_new' %}" class="button bicolor icon icon-plus">{% trans 'New device' %}</a>
+            <a href="{% url 'wagtail_2fa_device_new' %}" class="button bicolor button--icon">
+                <span class="icon-wrapper"><svg class="icon icon-plus icon" aria-hidden="true"><use href="#icon-plus"></use></svg></span>
+                {% trans 'New device' %}
+            </a>
         {% endif %}
     </div>
 {% endblock %}

src/wagtail_2fa/templates/wagtail_2fa/otp_form.html

@@ -1,4 +1,4 @@
-{% extends "wagtailadmin/admin_base.html" %}
+{% extends "wagtailadmin/base.html" %}
 {% load i18n wagtailadmin_tags %}
 {% block titletag %}{% trans "Sign in" %}{% endblock %}
 {% block bodyclass %}login{% endblock %}
@@ -31,11 +31,11 @@ <h1>{% block branding_login %}{% trans "Enter your two-factor authentication cod
                 <input type="hidden" name="next" value="{{ next|default:home_url }}" />
 
                 {% block fields %}
-                    {% field field=form.otp_token %}{% endfield %}
+                    {% formattedfield form.otp_token %}
 
                     {% block extra_fields %}
                         {% for field_name, field in form.extra_fields %}
-                            {% field field=field %}{% endfield %}
+                            {% formattedfield field %}
                         {% endfor %}
                     {% endblock extra_fields %}
 
@@ -45,7 +45,9 @@ <h1>{% block branding_login %}{% trans "Enter your two-factor authentication cod
                 {% block submit_buttons %}
                     <button type="submit" class="button button-longrunning" tabindex="3" data-controller="w-progress" data-action="w-progress#activate" data-w-progress-active-value="{% trans 'Signing in…' %}">{% icon name="spinner" %}<em>{% trans 'Sign in' %}</em></button>
                     <span style="margin-top:1rem;display:block;">
-                        <a href="{% url 'wagtailadmin_logout' %}" class="button button-secondary" tabindex="4">{% trans 'Sign out' %}</a>                    
+                        <button type="submit" class="button button-secondary" formaction="{% url 'wagtailadmin_logout' %}?next={% url 'wagtailadmin_login' %}" formmethod="post" tabindex="4">
+                            {% trans "Sign out" %}
+                        </button>
                     </span>
                 {% endblock %}
             </footer>