docs/releases/7.4.md
May 5, 2026
---
local:
depth: 1
---
Wagtail 7.4 is designated a Long Term Support (LTS) release. Long Term Support releases will continue to receive maintenance updates as necessary to address security and data-loss related issues, up until the next LTS release (typically a period of 12 months).
The autosave and concurrent editing notifications features have been improved based on user feedback. The improvements include: better handling of race conditions and network failures, refined messaging and alignment of indicator elements, as well as clearer display of idle users editing the same page.
These improvements were developed by Sage Abdullah, with support from the Wagtail UI team.
StreamField blocks now support deferred validation of required fields when saving drafts of pages (or snippets using DraftStateMixin). Users can now add a StreamField block and save work-in-progress versions without filling in all fields of the block. Validation is applied as normal when the page or snippet is published, scheduled, or submitted to a workflow.
The new behavior is enabled by default, but individual field blocks can opt out by setting the required_on_save option to True. All blocks now also have an {attr}~wagtail.blocks.Block.is_deferred_validation attribute that can be used in custom validation logic to conditionally skip validation when saving drafts. For more details, refer to .
This feature was developed by Sage Abdullah.
The preview feature has been improved to be more compatible with projects that use signed cookies as the sessions backend for Django. Previewing large pages in Wagtail no longer causes the session cookie to exceed the cookie size limit enforced by browsers.
This feature was developed by Sage Abdullah. We would like to thank Personalkollen for their sponsorship of this feature.
The page explorer can now be customized for each page type using the {class}~wagtail.admin.viewsets.pages.PageViewSet. This allows you to add custom columns, filters, and more based on the parent page. The same customizations can also be applied to the flat per-page-type listings. For more details, refer to .
This feature was developed by Sage Abdullah.
The Django Modelsearch library has been upgraded to version 1.3, bringing enhancements including support for fuzzy search on PostgreSQL, searching and filtering across related fields to any level of nesting, and ranking of results on SQLite.
is a new advanced how-to guide explaining how to meet common content personalization requirements with built-in features, such as combining BlockGroup in StreamField and preview modes to create segmented page sections. This guide was written by Thibaud Colas.
The Wagtail documentation now contains a new version of our official package maintenance guidelines, which we recommend for Wagtail and Django projects. Those guidelines are meant as an opinionated starting point to help with creation and long-term maintenance of packages in our ecosystem. They support our official package template, cookiecutter-wagtail-package. This new version of the guide was written by Thibaud Colas.
This release includes three enhancements to Wagtail’s content quality checker:
empty-meta-description check is enabled by default, to validate meta description tags are not empty.extractMetrics of PreviewController to retrieve content metrics.Those enhancements were developed by Thibaud Colas.
This release includes a number of improvements around the User Experience in the page editor, delivered with support from the Wagtail UI team.
Wagtail recently underwent an independent code security audit commissioned by the Interministerial Digital Directorate (DINUM) of France. Check out the audit findings and our action plan. Here are specific changes in this release made in accordance to those findings:
WAGTAILDOCS_MAX_UPLOAD_SIZE to 10MB (Thibaud Colas)WAGTAILDOCS_SERVE_METHOD (Thibaud Colas)Thank you to the Sites Conformes team at DINUM for supporting the project by commissioning this audit!
A CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information.
Many thanks to Seoyoung Kang from AhnLab and an independent security researcher for reporting this issue. For further details, please see security advisory GHSA-c6wj-9vcj-75pj.
A CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information.
Many thanks to Seoyoung Kang from AhnLab and an independent security researcher for reporting this issue. For further details, please see security advisory GHSA-c4mr-889m-vgf6.
A CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
Many thanks to Vishal Shukla for reporting this issue. For further details, please see security advisory GHSA-pwm3-7fv4-g6xx.
A CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page.
Many thanks to Sanjok Karki and an independent security researcher for reporting this issue. For further details, please see security advisory GHSA-67rv-mg8q-5pf3.
The Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections.
Many thanks to Sanjok Karki and an independent security researcher for reporting this issue. For further details, please see security advisory GHSA-p5gm-92h4-6pv6.
is_deferred_validation flag to support skipping custom validation when saving drafts (Daniel Kirkham)include_root parameter to admin pages API endpoint (Divyansh Mishra)creation_form_class on ChooserViewSet as a dotted path string (K Adithya)format-* operations on SVG images (Ankit Kumar)SnippetViewSet/ModelViewSet's list_display (Srishti Jaiswal)routablefullpageurl template tag, supporting full page URLs for routable pages (Pravin Kamble)get_object() DB query in API detail view (Siddheshwar Kadam)ImageBlock alt text populates on choosing a new image after unchecking decorative state (Pratham Jaiswal)verbose_name_plural for Query model in search promotions app (Saptami)max_count or max_count_per_parent (Lasse Schmieding)max_count_per_parent being moved under one parent (James Biggs)ChoiceBlock choices in block values (Devarshi Mani Tripathi)filter_spec parameter of ImageRenditionField (Soumya-codr)nested_default_fields attribute on API viewsets (Deepanshu Tevathiya)http with https in example URLs (Kunal Gupta)pathlib.Path for settings in "Integrating into Django" documentation (Kunal Gupta)ReferenceIndex API (Saptami)format_html in insert_global_admin_js example (Lasse Schmieding)published and unpublished signals (Kunal Hemnani)list_export in reports accepts a dotted path for nested attribute resolution (mikko2577)wagtail.admin.ui.tables (Sage Abdullah)hash_filelike test case to account for line break differences on Windows (Mustansir Dabhiya)PermissionError on document serve tests under Windows (Matt Westcott)if syntax (Sage Abdullah)timeout-minutes to GitHub Actions workflow jobs (Ashutosh)SwapController (LB (Ben Johnston))w-block- prefixes for block type class names (Kalash Kumari Thakur)StreamField blocks template rendering with include_block now a new w- prefix for CSS class names, such as w-block-my_block_name. For backwards compatibility, this is in addition to the pre-existing block-my_block_name classes. Those legacy classes without the w- prefix will be removed in a future release.
Django 4.2 is no longer supported as of this release; please upgrade to Django 5.2 or above before upgrading Wagtail.
The userbar AccessibilityItem has been renamed to {class}~wagtail.admin.userbar.ContentCheckerItem, to better signify its use for all types of content checks. The public API is identical aside from the renaming. Internals have also been renamed to use more appropriate terminology.
{% page_header_buttons %} template tagThe undocumented {% page_header_buttons %} template tag and its corresponding wagtailadmin/pages/listing/_page_header_buttons.html template have been deprecated and will be removed in a future release. If you made use of them in your templates, consider using the documented register_page_header_buttons hook, or overriding header_more_buttons and/or header_buttons in your custom page view instead. Alternatively, use the wagtail.admin.ui.menus.pages.get_page_header_buttons function to get the buttons, and render them as template components inside a dropdown menu instead.
Using the {% page_header_buttons %} template tag and its template will continue to work for now, but will raise a deprecation warning.