Summary (required)

• Resolves [Snyk:High] Out-of-bounds Write Pillow - due (03/27/2026) #6982

This PR upgrades wagtail to v6.3.8 to remediate a security vulnerability. There is one breaking change where notification messages created through django.contrib.messages cannot contain HTML unless it is passed through a safe string. I did not find any instances of us using this in our code.

Required reviewers 1 front end dev

Impacted areas of the application

General components of the application that this PR will affect:

• wagtail

How to test

• checkout this branch
• activate a virtual env
• pip install -r requirements.txt
• run snyk test --file=requirements.txt You should not see a pillow vulnerability
• verify that wagtail is upgraded to 6.3.8 by running server and logging into Wagtail admin. Version is visible under settings
• Ensure that notification messages are working correctly by creating a test page and then deleting it