Bump wagtail from 7.4.1 to 7.4.2

[dependabot]

Bumps wagtail from 7.4.1 to 7.4.2.

Release notes

Sourced from wagtail's releases.

7.4.2

• CVE-2026-54259: Improper restriction handling on Documents and Images chosen endpoints
• CVE-2026-54260: Denial of service via unbounded filter specs in the image preview
• CVE-2026-54261: Improper permission handling in image preview
• CVE-2026-54262: Pages translations can be created without page permissions when using simple_translation
• CVE-2026-54263: Reflected XSS in dynamic image URL generator view
• Fix: Prevent spurious migrations when there are missing child blocks in StructBlock.Meta.form_layout (Matthias Brück, Sage Abdullah)
• Fix: Prevent error in usage views when using gettext_lazy for a model's verbose_name (James Biggs)
• Fix: Prevent development markdown files from being added to virtual environment root upon installation (Dan Braghis)
• Fix: Prevent StreamField blocks referenced multiple times from losing their required state after deferred validation (Sage Abdullah)
• Docs: Add missing return in example views for template components (Tibor Leupold)

Changelog

Sourced from wagtail's changelog.

7.4.2 (15.06.2026)

 * CVE-2026-54259: Improper restriction handling on Documents and Images chosen endpoints
 * CVE-2026-54260: Denial of service via unbounded filter specs in the image preview
 * CVE-2026-54261: Improper permission handling in image preview
 * CVE-2026-54262: Pages translations can be created without page permissions when using simple_translation
 * CVE-2026-54263: Reflected XSS in dynamic image URL generator view
 * Fix: Prevent spurious migrations when there are missing child blocks in `StructBlock.Meta.form_layout` (Matthias Brück, Sage Abdullah)
 * Fix: Prevent error in usage views when using `gettext_lazy` for a model's `verbose_name` (James Biggs)
 * Fix: Prevent development markdown files from being added to virtual environment root upon installation (Dan Braghis)
 * Fix: Prevent StreamField blocks referenced multiple times from losing their required state after deferred validation (Sage Abdullah)
 * Docs: Add missing `return` in example views for template components (Tibor Leupold)

Commits

• 213059f Update codecov CircleCI Orb to v6.0.0
• 8307b34 Version bump to 7.4.2
• 7f4e492 Release notes for security fixes in 7.4.2
• 74f07e5 Add credits for 7.0.8 changelog
• ce36e59 Release notes for 7.3.3
• b3fbc91 Release notes for 7.0.8
• 6091cb7 Bail early from the URL generator view if frontend serve view is absent
• 314468f Fix reflected XSS by switching URLGeneratorView error handling response to te...
• cbaf6f6 Add tests
• b3eb634 Use the "change" / "can edit" permissions
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)