Skip to content

Bump django-cms from 3.4.4 to 5.0.9 - #74

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/django-cms-5.0.9
Open

Bump django-cms from 3.4.4 to 5.0.9#74
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/django-cms-5.0.9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 20, 2026

Copy link
Copy Markdown

Bumps django-cms from 3.4.4 to 5.0.9.

Release notes

Sourced from django-cms's releases.

5.0.9

What's Changed

Full Changelog: django-cms/django-cms@5.0.8...5.0.9

5.0.8

What's Changed

New Contributors

Full Changelog: django-cms/django-cms@5.0.7...5.0.8

5.0.7

What's Changed

... (truncated)

Changelog

Sourced from django-cms's changelog.

5.0.9 (2026-07-10)

Features:

  • Accessibility update for wizards (#8674) (#8679) (c91db51ce) -- Fabian Braun
  • Support django 6.1+ breadcrumb styles (#8689) (#8714) (ffd05c4f8) -- Fabian Braun

Bug Fixes:

  • Corrupted plugin positions are now automatically healed (#8667) (#8670) (5a71802c9) -- Fabian Braun
  • Harden page duplication, group permissions and URL validator (#8704) (#8713) (3e1ccf757) -- Fabian Braun
  • Language selector triggered wrong toolbar (#8687) (#8693) (2b5de9f19) -- Fabian Braun
  • Missing authorization in render_object_structure disclosed non-PageContent placeholder structure (#8692) (#8703) (9c82abfeb) -- Fabian Braun
  • Page title leaked unescaped into rendering error message, clipboard could be cleared by get request (#8699) (#8711) (b56a56884) -- Fabian Braun
  • Replace left-over inline JS/CSS that might be blocked by CSP (#8690) (#8715) (3edf89a0a) -- Fabian Braun
  • Subpage wizard failed (#8698) (#8710) (27b1f6313) -- Fabian Braun
  • get_child_classes was always cached (#8677) (#8680) (330d4a36d) -- Fabian Braun

Statistics:

This release includes 14 pull requests, and was created with the help of the following contributors (in alphabetical order):

  • Fabian Braun (10 pull requests)

With the review help of the following contributors:

  • Github Release Action
  • Vinit Kumar
  • sourcery-ai[bot]

Thanks to all contributors for their efforts!

5.0.8 (2026-06-09)

Bug Fixes:

  • Enforce authorization on structure, move and clipboard endpoints (#8644) (#8645) (7642a98ab) -- Fabian Braun
  • GrouperModelAdmin shadowed prepopulated_fields class attribute (#8636) (#8639) (1b164a488) -- Fabian Braun
  • Honour plugin-declared Vary headers in the page cache key (#8646) (#8647) (d5dc1efa1) -- Fabian Braun
  • Missing redirect_url in CMSNavigationNode.attr (#8625) (f975cace5) -- Venelin Stoykov
  • Release script dropped changes (#8655) (23df299bd) -- Fabian Braun
  • Slugs of published pages could be changed (#8640) (#8654) (9fed876a0) -- Fabian Braun
  • Transifex upload script failed (#8656) (936a620ef) -- Fabian Braun
  • template-specific CMS_PLACEHOLDER_CONF keys ignored when rendering page placeholders (#8652) (c7424f7f2) -- Ralph
  • Correct lookup prefix and register length lookup in PermissionTuple.allow_list()
  • Use loop variable instead of queryset in user_can_delete_page placeholder check
  • Return 404 instead of 500 for missing objects in delete_view and edit_title_fields

... (truncated)

Commits
  • d7eeb65 chore: Prepare release 5.0.9 (#8720)
  • ffd05c4 feat: Support django 6.1+ breadcrumb styles (#8689) (#8714)
  • 3e1ccf7 fix: Harden page duplication, group permissions and URL validator (#8704) (#8...
  • 3edf89a fix: Replace left-over inline JS/CSS that might be blocked by CSP (#8690) (#8...
  • b56a568 fix: Page title leaked unescaped into rendering error message, clipboard coul...
  • 27b1f63 fix: Subpage wizard failed (#8698) (#8710)
  • 9c82abf fix: Missing authorization in render_object_structure disclosed non-PageCon...
  • 2b5de9f fix: Language selector triggered wrong toolbar (#8687) (#8693)
  • c91db51 feat: Accessibility update for wizards (#8674) (#8679)
  • 330d4a3 fix: get_child_classes was always cached (#8677) (#8680)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [django-cms](https://github.com/django-cms/django-cms) from 3.4.4 to 5.0.9.
- [Release notes](https://github.com/django-cms/django-cms/releases)
- [Changelog](https://github.com/django-cms/django-cms/blob/5.0.9/CHANGELOG.rst)
- [Commits](django-cms/django-cms@3.4.4...5.0.9)

---
updated-dependencies:
- dependency-name: django-cms
  dependency-version: 5.0.9
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants