PyPI package

wagtail

6.4.1

Default version

Published

February 21, 2025

Description

A Django content management system.

Links

Origin: https://pypi.org/project/wagtail/6.4.1/
Repo: https://github.com/wagtail/wagtail
Documentation: https://docs.wagtail.org

Projects

wagtail/wagtail

GitHub

A Django content management system focused on flexibility and user experience

4k forks

19k stars

OpenSSF scorecard

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

View information about checks and how to fix failures.

Score

6/10

Scorecard as of April 21, 2025.

Code-Review

1/10

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

Reasoning

Found 3/28 approved changesets -- score normalized to 1

CII-Best-Practices

0/10

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

Reasoning

no effort to earn an OpenSSF best practices badge detected

Maintained

10/10

Determines if the project is "actively maintained".

Reasoning

30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10

Dangerous-Workflow

10/10

Determines if the project's GitHub Action workflows avoid dangerous patterns.

Reasoning

no dangerous workflow patterns detected

Security-Policy

9/10

Determines if the project has published a security policy.

Reasoning

security policy file detected

License

10/10

Determines if the project has defined a license.

Reasoning

license file detected

Token-Permissions

10/10

Determines if the project's workflows follow the principle of least privilege.

Reasoning

GitHub workflow tokens follow principle of least privilege

Binary-Artifacts

10/10

Determines if the project has generated executable (binary) artifacts in the source repository.

Reasoning

no binaries found in the repo

SAST

7/10

Determines if the project uses static code analysis.

Reasoning

SAST tool detected but not run on all commits

Pinned-Dependencies

0/10

Determines if the project has declared and pinned the dependencies of its build process.

Reasoning

dependency not pinned by hash detected -- score normalized to 0

Fuzzing

0/10

Determines if the project uses fuzzing.

Reasoning

project is not fuzzed

Vulnerabilities

0/10

Determines if the project has open, known unfixed vulnerabilities.

Reasoning

46 existing vulnerabilities detected

Project metadata as of April 27, 2025.

This site uses cookies from Google to deliver its services and to analyze traffic.

Pinned-Dependencies

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/codeql-analysis.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/codeql-analysis.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/codeql-analysis.yml/main?enable=pin

Warn: third-party GitHubAction not pinned by hash: .github/workflows/test.yml:324: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:327: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:332: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:354: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: third-party GitHubAction not pinned by hash: .github/workflows/test.yml:377: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:380: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:384: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:402: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:419: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:424: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:434: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:449: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: third-party GitHubAction not pinned by hash: .github/workflows/test.yml:456: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:61: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:79: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:127: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:131: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:154: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:215: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:219: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:241: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: third-party GitHubAction not pinned by hash: .github/workflows/test.yml:262: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:270: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:274: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:292: update your workflow using https://app.stepsecurity.io/secureworkflow/wagtail/wagtail/test.yml/main?enable=pin

Warn: containerImage not pinned by hash: wagtail/project_template/Dockerfile:2: pin your Docker image by updating python:3.12-slim-bookworm to python:3.12-slim-bookworm@sha256:85824326bc4ae27a1abb5bc0dd9e08847aa5fe73d8afb593b1b45b7cb4180f57

Warn: pipCommand not pinned by hash: wagtail/project_template/Dockerfile:28

Warn: pipCommand not pinned by hash: wagtail/project_template/Dockerfile:32

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:390

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:391

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:392

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:393

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:394

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:430

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:431

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:67

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:68

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:69

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:137

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:138

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:139

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:140

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:225

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:226

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:227

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:228

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:280

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:281

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:282

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:283

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:284

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:338

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:339

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:340

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:341

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:342

Warn: pipCommand not pinned by hash: .github/workflows/test.yml:343

Info: 0 out of 25 GitHub-owned GitHubAction dependencies pinned

Info: 0 out of 4 third-party GitHubAction dependencies pinned

Info: 0 out of 1 containerImage dependencies pinned

Info: 0 out of 31 pipCommand dependencies pinned

Vulnerabilities

Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8

Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275

Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv

Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw

Warn: Project is vulnerable to: GHSA-67mh-4wv8-2f99

Warn: Project is vulnerable to: GHSA-r683-j2x4-v87g

Warn: Project is vulnerable to: PYSEC-2014-5 / GHSA-296w-6qhq-gf92

Warn: Project is vulnerable to: PYSEC-2011-2 / GHSA-3jqw-crqj-w8qw

Warn: Project is vulnerable to: PYSEC-2012-3 / GHSA-59w8-4wm2-4xw8

Warn: Project is vulnerable to: PYSEC-2012-4 / GHSA-5h2q-4hrp-v9rr

Warn: Project is vulnerable to: PYSEC-2014-6 / GHSA-625g-gx8c-xcmg

Warn: Project is vulnerable to: PYSEC-2015-8 / GHSA-6565-fg86-6jcx

Warn: Project is vulnerable to: PYSEC-2021-98 / GHSA-68w8-qjq3-2gfm

Warn: Project is vulnerable to: PYSEC-2012-2 / GHSA-78vx-ggch-wghm

Warn: Project is vulnerable to: PYSEC-2015-9 / GHSA-7fq8-4pv5-5w5c

Warn: Project is vulnerable to: PYSEC-2015-4 / GHSA-7qfw-j7hp-v45g

Warn: Project is vulnerable to: PYSEC-2011-9 / GHSA-7wph-fc4w-wqp2

Warn: Project is vulnerable to: PYSEC-2014-2 / GHSA-89hj-xfx5-7q66

Warn: Project is vulnerable to: GHSA-8x94-hmjh-97hq

Warn: Project is vulnerable to: PYSEC-2016-2 / GHSA-c8c8-9472-w52h

Warn: Project is vulnerable to: PYSEC-2016-3 / GHSA-crhm-qpjc-cm64

Warn: Project is vulnerable to: PYSEC-2014-4 / GHSA-f7cm-ccfp-3q4r

Warn: Project is vulnerable to: PYSEC-2016-16 / GHSA-fp6p-5xvw-m74f

Warn: Project is vulnerable to: PYSEC-2011-8 / GHSA-fwr5-q9rx-294f

Warn: Project is vulnerable to: PYSEC-2015-5 / GHSA-gv98-g628-m9x5

Warn: Project is vulnerable to: PYSEC-2015-20 / GHSA-h582-2pch-3xv3

Warn: Project is vulnerable to: PYSEC-2011-5 / GHSA-h95j-h2rv-qrg4

Warn: Project is vulnerable to: GHSA-hmr4-m2h5-33qx

Warn: Project is vulnerable to: PYSEC-2015-6 / GHSA-jhjg-w2cp-5j44

Warn: Project is vulnerable to: PYSEC-2016-15 / GHSA-pw27-w7w4-9qc7

Warn: Project is vulnerable to: PYSEC-2015-10 / GHSA-q5qw-4364-5hhm

Warn: Project is vulnerable to: PYSEC-2011-4 / GHSA-rm2j-x595-q9cj

Warn: Project is vulnerable to: GHSA-rrqc-c2jx-6jgv

Warn: Project is vulnerable to: PYSEC-2014-1 / GHSA-rvq6-mrpv-m6rm

Warn: Project is vulnerable to: PYSEC-2014-7 / GHSA-rw75-m7gp-92m3

Warn: Project is vulnerable to: PYSEC-2019-16 / GHSA-vfq6-hq5r-27r6

Warn: Project is vulnerable to: PYSEC-2014-3 / GHSA-wqjj-hx84-v449

Warn: Project is vulnerable to: PYSEC-2011-3 / GHSA-wxg3-mfph-qg9w

Warn: Project is vulnerable to: PYSEC-2011-1 / GHSA-x88j-93vc-wpmp

Warn: Project is vulnerable to: PYSEC-2007-1

Warn: Project is vulnerable to: PYSEC-2008-1

Warn: Project is vulnerable to: PYSEC-2008-2

Warn: Project is vulnerable to: PYSEC-2009-3

Warn: Project is vulnerable to: PYSEC-2015-11

Warn: Project is vulnerable to: PYSEC-2015-7

Warn: Project is vulnerable to: PYSEC-2016-18