chore(deps): bump django-webpack-loader from 0.7.0 to 3.2.4

[dependabot]

Bumps django-webpack-loader from 0.7.0 to 3.2.4.

Release notes

Sourced from django-webpack-loader's releases.

3.2.4

What's Changed

• fix: catch AttributeError in config check for non-dict WEBPACK_LOADER by @​saschabuehrle in django-webpack/django-webpack-loader#433
• Handle Detail issues by @​rvlb in django-webpack/django-webpack-loader#434

New Contributors

• @​saschabuehrle made their first contribution in django-webpack/django-webpack-loader#433

Full Changelog: django-webpack/django-webpack-loader@3.2.3...3.2.4

3.2.3

What's Changed

• Add warning for default timeout in webpack_loader by @​luki009 in django-webpack/django-webpack-loader#422

New Contributors

• @​luki009 made their first contribution in django-webpack/django-webpack-loader#422

Full Changelog: django-webpack/django-webpack-loader@3.2.2...3.2.3

3.2.2

What's Changed

• V3.2.2 by @​rvlb in django-webpack/django-webpack-loader#417

Full Changelog: django-webpack/django-webpack-loader@3.2.1...3.2.2

3.2.1

What's Changed

• Update trove classifiers to reflect actual suport by @​browniebroke in django-webpack/django-webpack-loader#415

Full Changelog: django-webpack/django-webpack-loader@3.2.0...3.2.1

3.2.0

What's Changed

• Add CROSSORIGIN and django-csp handling by @​hugobessa + @​karolyi in django-webpack/django-webpack-loader#413

New Contributors

• @​hugobessa made their first contribution in django-webpack/django-webpack-loader#413

Full Changelog: django-webpack/django-webpack-loader@3.1.1...3.2.0

3.1.1

What's Changed

• Disable dependabot updates for old webpack 4 tests by @​pamella in django-webpack/django-webpack-loader#403
• Update dependencies by @​pamella in django-webpack/django-webpack-loader#404
• Support for Django 5.1 by @​kimihito in django-webpack/django-webpack-loader#406
• Bump webpack from 5.92.0 to 5.94.0 in /tests_webpack5 by @​dependabot in django-webpack/django-webpack-loader#407
• Update to v3.1.1 by @​rvlb in django-webpack/django-webpack-loader#408

New Contributors

... (truncated)

Changelog

Sourced from django-webpack-loader's changelog.

[3.2.4] -- 2026-05-13

• Refactor get_as_url_to_tag_dict when dealing with extra arguments in elements
• Fix skip_common_chunks usage at get_files to add parity with render_bundle (#431)
• Add integrity and CSP nonce to preload script tags (#432)
• Fix hanging or broken stats file (#430)
• Handle issue when webpack stats change mid-request (#429)
• Fix AttributeError in config check for non-dict WEBPACK_LOADER (#427)

[3.2.3] -- 2025-12-09

• Add warning for default timeout usage

[3.2.2] -- 2025-10-30

• Ensure parity with webpack-bundle-tracker
• Update examples to always perform integrity calculation

[3.2.1] -- 2025-06-16

• Update supported versions on Trove classifiers

[3.2.0] -- 2025-05-19

• Automatically add crossorigin attributes to tags with integrity attributes when necessary
• Use request.csp_nonce from django-csp if available and configured
• Remove support for Django 3.x (LTS is EOL)

[3.1.1] -- 2024-08-30

• Add support for Django 5.1

[3.1.0] -- 2024-04-04

Support webpack_asset template tag to render transformed assets URL: {% webpack_asset 'path/to/original/file' %} == "/static/assets/resource-3c9e4020d3e3c7a09c68.txt"

[3.0.1] -- 2024-01-16

Added skip_common_chunks option to the get_files() template tag.

[3.0.0] -- 2023-12-19

• Fix support for publicPath: auto in Webpack config, check updated examples at https://github.com/django-webpack/django-webpack-loader/tree/master/examples
• Add support for Python 3.12
• Add support for Django 5.0

[2.0.1] -- 2023-06-14

• Add support for Django 4.2

[2.0.0] -- 2023-05-22

... (truncated)

Commits

• 8bf16ad v3.2.4
• cd16b8e Refactor get_as_url_to_tag_dict when dealing with extra arguments in the elem...
• d445315 Use find_packages
• cc4a74f Revert readme.rst on gitignore
• fe833ae Fix skip_common_chunks usage at get_files to add parity with render_bundle #431
• 895adc2 Add integrity and csp nonce to preload script tags #432
• 60da34d Fix hanging or broken stats file #430
• dc4e0a6 Handle issue when webpack stats change mid-request #429
• 69f60ab Fix issue on setup.py #426
• 6cdb146 test: cover invalid WEBPACK_LOADER type in config check
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[rtibblesbot]

Dependency Update Review

Package: django-webpack-loader 0.7.0 → 3.2.4
Semver risk: Multi-major (0.x → 3.x), crossing 3 major version boundaries
Dependency type: Production (appears in requirements.in, listed in INSTALLED_APPS)
CI status: In progress (no failures yet at review time)

Changelog Analysis

Sources consulted:

• https://github.com/django-webpack/django-webpack-loader/blob/master/CHANGELOG.md
• https://github.com/django-webpack/django-webpack-loader/releases
• https://pypi.org/pypi/django-webpack-loader/json
• PR body (dependabot embedded release notes)

Breaking changes by major version boundary:

• v1.0.0 (2021-05-12): Loader API refactored to support custom LOADER_CLASS config. Stats file format compatibility tied to webpack-bundle-tracker@1.0.0-alpha.1. The project uses a custom BundleTracker from kolibri-build/src/webpackBundleTracker — whether it produces a compatible format is unverified.
• v2.0.0 (2023-05-22): Stats file format changed again in lockstep with webpack-bundle-tracker@2.0.0. Any project using the old stats file format will fail silently or raise a parse error at runtime.
• v3.0.0 (2023-12-19): Fixed publicPath: auto behavior (behavioral change if project relied on prior broken behavior). Added Python 3.12 and Django 5.0 support.
• v3.2.0 (2025-05-19): Dropped Django 3.x support. Django 4.2, 5.0, 5.1, and 5.2 are the only supported versions. Automatic crossorigin attribute injection for tags with integrity attributes. CSP nonce injection via django-csp.

Deprecations:

• v3.2.3 introduces a warning when TIMEOUT is not explicitly set in WEBPACK_LOADER config. The project's config omits TIMEOUT, so log noise will appear.

Security fixes:

• No CVEs. Security-adjacent additions: SRI support (v1.5.0, additive), CSP nonce injection and crossorigin auto-attribute (v3.2.0, additive).

Other notable changes:

• v1.3.0: Removed type attribute from <script> and <link> tags rendered by the template tag.
• v3.2.0: Django 3.x support explicitly removed.

Compatibility Assessment

• Project uses affected APIs: Yes. The project calls webpack_loader.utils.get_files(bundle_name, extension=..., config=...) in templatetags/translation_tags.py and views/zip.py; subclasses webpack_loader.loader.WebpackLoader overriding get_bundle(self, bundle) in tests/webpack_loader.py; uses {% render_bundle %} template tags in 6 templates; and sets LOADER_CLASS in test_settings.py.
• Django version compatibility: BLOCKED. The project pins Django==3.2.24 in requirements.in. django-webpack-loader>=3.2.0 explicitly dropped Django 3.x support. This is a hard incompatibility — the package will not install or run correctly against Django 3.2 at this version.
• Configuration changes required: Yes — TIMEOUT should be explicitly set to suppress a new warning. No structural config changes are required if the stats file format is compatible.
• Code changes required: Unknown for TestWebpackLoader.get_bundle — the internal call chain in 3.x may have changed its signature or invocation. This requires verification if Django were upgraded first.
• Stats file format risk: High. The project uses a custom BundleTracker from kolibri-build/src/webpackBundleTracker. If it does not produce a stats file format compatible with django-webpack-loader 3.x (which tracks webpack-bundle-tracker@2.x), the app will fail at runtime when resolving bundles.
• Prior failed attempts: None found in PR comments.

Recommendation

REQUEST_CHANGES — This upgrade cannot land without first upgrading Django from 3.2 to 4.2+, since django-webpack-loader 3.2.0 dropped Django 3.x support. Additionally, the stats file format compatibility between the custom kolibri-build/src/webpackBundleTracker and the 3.x-expected format must be verified before merging, and TestWebpackLoader.get_bundle may need updating for the refactored internal loader API.

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

Reviewed the pull request diff checking for:

• Correctness: bugs, edge cases, undocumented behavior, resource leaks, hardcoded values
• Design: unnecessary complexity, naming, readability, comment accuracy, redundant state
• Architecture: duplicated concerns, minimal interfaces, composition over inheritance
• Testing: behavior-based assertions, mocks only at hard boundaries, accurate coverage
• Completeness: missing dependencies, unupdated usages, i18n, accessibility, security
• Principles: DRY (same reason to change), SRP, Rule of Three (no premature abstraction)
• Checked CI status and linked issue acceptance criteria
• For UI changes: inspected screenshots for layout, visual completeness, and consistency