INTR-455 Django and Wagtail updates (#845)

Co-authored-by: Cameron Lamb <[email protected]>

pyproject.toml

@@ -10,7 +10,7 @@ package-mode = false
 [tool.poetry.dependencies]
 python = "^3.12"
 # Django
-django = "^4.2"
+django = "^5.1"
 django-environ = "^0.10.0"
 django-settings-export = "^1.2.1"
 # TODO: Set django-simple-history to the next release after 3.4.0 (when released)
@@ -22,13 +22,13 @@ crispy-forms-gds = "^0.2.6"
 # DIT Django
 django-audit-log-middleware = "^0.0.4"
 django-hawk-drf = "^1.1.0"
-django-chunk-upload-handlers = "^0.0.14"
-django-feedback-govuk = "^0.2.9"
+django-chunk-upload-handlers = "^0.0.15"
+django-feedback-govuk = "^0.2.10"
 django_log_formatter_ecs = "^0.0.5"
 django-staff-sso-client = "^4.2"
 notifications-python-client = "^8.2"
 # Wagtail
-wagtail = "^6.2"
+wagtail = "^6.3"
 wagtailmedia = "^0.14.2"
 wagtailmenus = "^3.1.8"
 wagtail-draftail-anchors = "^0.6.0"
@@ -50,15 +50,14 @@ redis = "^4.5.4"
 atoma = "^0.0.17"
 bleach = "^6.0.0"
 elastic-apm = "^6.15.1"
-requests = "^2.32.0"
 boto3 = "^1.26.115"
 pyjwt = { extras = ["crypto"], version = "^2.6.0" }
 wagtail-generic-chooser = "^0.6"
 wagtail-modeladmin = "^2.0.0"
 dj-database-url = "^2.1.0"
 django-celery-beat = "^2.5.0"
 django-waffle = "^4.0.0"
-django-log-formatter-asim = "0.0.4"
+django-log-formatter-asim = "^0.0.6"
 dbt-copilot-python = "^0.1.3"
 opentelemetry-distro = "^0.43b0"
 opentelemetry-exporter-otlp = "^1.22.0"

src/core/migrations/0007_alter_historicaldocument_file_size.py

@@ -0,0 +1,18 @@
+# Generated by Django 4.2.17 on 2024-12-20 16:53
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("core", "0006_tag_taggedpage"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="historicaldocument",
+            name="file_size",
+            field=models.PositiveBigIntegerField(editable=False, null=True),
+        ),
+    ]

src/peoplefinder/forms/profile_edit.py

@@ -302,8 +302,10 @@ def __init__(self, *args, **kwargs):
         self.request_user = kwargs.pop("request_user", None)
         super().__init__(*args, **kwargs)
 
-        remote_working_choices = self.fields["remote_working"].choices
-        self.fields["remote_working"].choices = remote_working_choices[1:]
+        remote_working_choices = list(self.fields["remote_working"].choices)
+        if remote_working_choices[0][0] == "":
+            remote_working_choices.pop(0)
+        self.fields["remote_working"].choices = remote_working_choices
 
         usual_office_days_label = self.fields["usual_office_days"].label + " (optional)"
         self.fields["usual_office_days"].label = ""

src/peoplefinder/services/person.py

@@ -12,7 +12,7 @@
 from django.http import HttpRequest
 from django.shortcuts import reverse
 from django.utils import timezone
-from django.utils.html import strip_tags
+from django.utils.html import escape, strip_tags
 from django.utils.safestring import mark_safe
 from notifications_python_client.notifications import NotificationsAPIClient
 
@@ -551,6 +551,8 @@ def get_profile_section_values(
             field_value = getattr(person, field_name)
 
             if isinstance(field_value, str):
+                # escaping field_value before using mark_safe -> https://docs.djangoproject.com/en/dev/releases/4.2.17/#django-4-2-17-release-notes
+                field_value = escape(field_value)
                 # Replace newlines with "<br>".
                 field_value = mark_safe(  # noqa: S308
                     strip_tags(field_value).replace("\n", "<br>")