Widget: Pass consent and utm query parameters in 429 fallback

Updates the requirements on [cryptography](https://github.com/pyca/cryptography) to permit the latest version.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/48.0.0...48.0.1)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 48.0.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

pyproject.toml

@@ -33,7 +33,7 @@ dependencies = [
   "bleach==6.4.*",
   "celery==5.6.*",
   "chardet==5.2.*",
-  "cryptography>=48.0.0",
+  "cryptography>=48.0.1",
   "css-inline==0.20.*",
   "defusedcsv>=3.0.0",
   "dnspython==2.*",
@@ -90,7 +90,7 @@ dependencies = [
   "pytz-deprecation-shim==0.1.*",
   "pyuca",
   "qrcode==8.2",
-  "redis==8.0.*",
+  "redis==7.4.*",
   "reportlab==4.5.*",
   "requests==2.32.*",
   "sentry-sdk==2.62.*",

src/pretix/locale/de/LC_MESSAGES/django.po

@@ -5,16 +5,16 @@ msgstr ""
 "Project-Id-Version: 1\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-05-27 15:47+0000\n"
-"PO-Revision-Date: 2026-05-27 15:20+0000\n"
-"Last-Translator: Raphael Michel <michel@rami.io>\n"
-"Language-Team: German <https://translate.pretix.eu/projects/pretix/pretix/de/"
-">\n"
+"PO-Revision-Date: 2026-06-09 20:00+0000\n"
+"Last-Translator: Mira <weller@rami.io>\n"
+"Language-Team: German <https://translate.pretix.eu/projects/pretix/pretix/"
+"de/>\n"
 "Language: de\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 2026.5\n"
+"X-Generator: Weblate 2026.6.1\n"
 "X-Poedit-Bookmarks: -1,-1,904,-1,-1,-1,-1,-1,-1,-1\n"
 
 #: htmlcov/d_daa1541d0cbf5e2b_dashboards_py.html:670
@@ -11353,7 +11353,7 @@ msgid ""
 msgstr ""
 "Wenn diese Option deaktiviert ist, werden Tickets nur für Produkte "
 "aktiviert, bei denen die Option \"Berechtigt zum Eintritt\" gesetzt ist. Sie "
-"können die Ticketgenerierung auch in den Einstellungen von jedes Produktes "
+"können die Ticketgenerierung auch in den Einstellungen jedes Produktes "
 "einzeln abschalten."
 
 #: pretix/base/settings.py:1813

src/pretix/locale/de_Informal/LC_MESSAGES/django.po

@@ -8,8 +8,8 @@ msgstr ""
 "Project-Id-Version: 1\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-05-27 15:47+0000\n"
-"PO-Revision-Date: 2026-05-27 15:20+0000\n"
-"Last-Translator: Raphael Michel <michel@rami.io>\n"
+"PO-Revision-Date: 2026-06-09 20:00+0000\n"
+"Last-Translator: Mira <weller@rami.io>\n"
 "Language-Team: German (informal) <https://translate.pretix.eu/projects/"
 "pretix/pretix/de_Informal/>\n"
 "Language: de_Informal\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 2026.5\n"
+"X-Generator: Weblate 2026.6.1\n"
 
 #: htmlcov/d_daa1541d0cbf5e2b_dashboards_py.html:670
 #: pretix/control/templates/pretixcontrol/events/index.html:166
@@ -11339,8 +11339,8 @@ msgid ""
 "issuing in every product separately."
 msgstr ""
 "Wenn diese Option deaktiviert ist, werden Tickets nur für Produkte "
-"aktiviert, bei denen die Option \"Berechtigt zum Eintritt\" gesetzt ist. Sie "
-"können die Ticketgenerierung auch in den Einstellungen von jedes Produktes "
+"aktiviert, bei denen die Option \"Berechtigt zum Eintritt\" gesetzt ist. Du "
+"kannst die Ticketgenerierung auch in den Einstellungen jedes Produktes "
 "einzeln abschalten."
 
 #: pretix/base/settings.py:1813

src/pretix/locale/fr/LC_MESSAGES/django.po

@@ -4,8 +4,8 @@ msgstr ""
 "Project-Id-Version: 1\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-05-27 15:47+0000\n"
-"PO-Revision-Date: 2026-05-29 17:00+0000\n"
-"Last-Translator: CVZ-es <damien.bremont@casadevelazquez.org>\n"
+"PO-Revision-Date: 2026-06-08 17:00+0000\n"
+"Last-Translator: Sébastien BRUNEAU <s.bruneau@beauvaisis.fr>\n"
 "Language-Team: French <https://translate.pretix.eu/projects/pretix/pretix/"
 "fr/>\n"
 "Language: fr\n"
@@ -13,7 +13,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n > 1;\n"
-"X-Generator: Weblate 2026.5\n"
+"X-Generator: Weblate 2026.6.1\n"
 
 #: htmlcov/d_daa1541d0cbf5e2b_dashboards_py.html:670
 #: pretix/control/templates/pretixcontrol/events/index.html:166
@@ -35123,7 +35123,7 @@ msgstr "Vous devez cocher toutes les cases en bas de la page."
 
 #: pretix/presale/forms/checkout.py:67
 msgid "Email address (repeated)"
-msgstr "Adresse de courriel (répété)"
+msgstr "Adresse de courriel (répétée)"
 
 #: pretix/presale/forms/checkout.py:68
 msgid ""

src/pretix/static/pretixpresale/js/widget/widget.js

@@ -2051,9 +2051,16 @@ var shared_root_methods = {
             this.$root.set_cart_id(data.cart_id);
             this.$root.overlay.frame_loading = false;
             callback()
-        }, () => {
+        }, (xhr, data) => {
+          if (xhr.status === 429 && typeof xhr.responseURL !== "undefined") {
+            this.$root.overlay.error_message = strings['cart_error_429'];
+            this.$root.overlay.frame_loading = false;
+            this.$root.overlay.error_url_after = this.$root.newTabTarget;
+            this.$root.overlay.error_url_after_new_tab = true;
+          } else {
             this.$root.overlay.error_message = strings['cart_error'];
             this.$root.overlay.frame_loading = false;
+          }
         })
     },
     get_cart_id: function() {
@@ -2142,7 +2149,14 @@ var shared_root_computed = {
         if (this.subevent) {
             target = this.target_url + this.subevent + '/';
         }
-        return target;
+        var parameters = this.$root.consent_parameter
+        if (this.$root.additionalURLParams) {
+          parameters += `&${this.$root.additionalURLParams}`
+        }
+        if (parameters) {
+          target += '?' + parameters.replace(/^&/, '')
+        }
+        return target
     },
     useIframe: function () {
         if (window.crossOriginIsolated === true) {

src/pretix/static/pretixpresale/widget/src/sharedStore.ts

@@ -162,7 +162,15 @@ export function createWidgetStore (config: {
 				return params.toString()
 			},
 			newTabTarget (): string {
-				return this.subevent ? `${this.targetUrl}${this.subevent}/` : this.targetUrl
+				let url = this.subevent ? `${this.targetUrl}${this.subevent}/` : this.targetUrl
+				let parameters = this.consentParameter
+				if (this.additionalURLParams) {
+					parameters += `&${this.additionalURLParams}`
+				}
+				if (parameters) {
+					url += '?' + parameters.replace(/^&/, '')
+				}
+				return url
 			},
 			formTarget (): string {
 				const isFirefox = navigator.userAgent.toLowerCase().includes('firefox')
@@ -441,6 +449,7 @@ export function createWidgetStore (config: {
 							this.overlay.frameLoading = false
 							this.overlay.errorUrlAfter = this.newTabTarget
 							this.overlay.errorUrlAfterNewTab = true
+							return
 						} else if (e.status === 405) {
 							// Likely a redirect!
 							this.targetUrl = e.responseUrl.substring(0, e.responseUrl.indexOf('/cart/add') - 18)
@@ -460,11 +469,18 @@ export function createWidgetStore (config: {
 					this.overlay.frameLoading = true
 					const data = await createCart(url)
 					this.setCartId(data.cart_id)
+					return true
 				} catch (e) {
-					if (e instanceof ApiError && (e.status === 200 || (e.status >= 400 && e.status < 500))) {
+					if (e instanceof ApiError && e.status === 429) {
+						this.overlay.errorMessage = STRINGS.cart_error_429
+						this.overlay.frameLoading = false
+						this.overlay.errorUrlAfter = this.newTabTarget
+						this.overlay.errorUrlAfterNewTab = true
+					} else if (e instanceof ApiError && (e.status === 200 || (e.status >= 400 && e.status < 500))) {
 						this.overlay.errorMessage = STRINGS.cart_error
 						this.overlay.frameLoading = false
 					}
+					return false
 				}
 			},
 			redeem (voucherCode: string, event?: Event) {
@@ -484,7 +500,7 @@ export function createWidgetStore (config: {
 			async resume () {
 				if (!this.cartId && this.keepCart) {
 					// create an empty cart whose id we can persist
-					await this.createCart()
+					if (!await this.createCart()) return
 				}
 				let redirectUrl = `${this.targetUrl}w/${globalWidgetId}/`
 				if (this.subevent && this.isButton && this.items.length === 0) {