Add comment on known permission issue

* API: make bundle_variation optional when creating items with bundles

* Add test

pyproject.toml

@@ -82,9 +82,9 @@ dependencies = [
   "protobuf==7.36.*",
   "psycopg2-binary",
   "pycountry",
-  "pycparser==3.0",
+  "pycparser==3.11",
   "pycryptodome==3.24.*",
-  "pypdf==6.19.*",
+  "pypdf==6.20.*",
   "python-bidi==0.6.*",  # Support for Arabic in reportlab
   "python-dateutil==2.9.*",
   "pytz",

src/pretix/api/serializers/item.py

@@ -378,7 +378,7 @@ class ItemSerializer(SalesChannelMigrationMixin, I18nAwareModelSerializer):
     def validate_bundles(self, value):
         if not self.instance:
             for b_data in value:
-                ItemBundle.clean_itemvar(self.context['event'], b_data['bundled_item'], b_data['bundled_variation'])
+                ItemBundle.clean_itemvar(self.context['event'], b_data.get('bundled_item'), b_data.get('bundled_variation'))
         return value
 
     def validate_addons(self, value):

src/pretix/locale/de/LC_MESSAGES/django.po

@@ -5,8 +5,8 @@ msgstr ""
 "Project-Id-Version: 1\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-09-30 07:26+0000\n"
-"PO-Revision-Date: 2026-09-30 08:06+0000\n"
-"Last-Translator: Phin Wolkwitz <wolkwitz@pretix.eu>\n"
+"PO-Revision-Date: 2026-10-13 14:40+0000\n"
+"Last-Translator: Martin Gross <gross@rami.io>\n"
 "Language-Team: German <https://translate.pretix.eu/projects/pretix/pretix/"
 "de/>\n"
 "Language: de\n"
@@ -14,7 +14,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 2026.9.1\n"
+"X-Generator: Weblate 2026.10\n"
 "X-Poedit-Bookmarks: -1,-1,904,-1,-1,-1,-1,-1,-1,-1\n"
 
 #: pretix/_base_settings.py
@@ -34449,7 +34449,7 @@ msgstr ""
 
 #: pretix/presale/forms/customer.py
 msgid "Forgot your password?"
-msgstr "Passwort zurücksetzen"
+msgstr "Passwort vergessen?"
 
 #: pretix/presale/forms/customer.py
 msgid ""

src/pretix/locale/de/LC_MESSAGES/djangojs.po

@@ -8,8 +8,8 @@ msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-09-30 07:26+0000\n"
-"PO-Revision-Date: 2026-07-06 02:00+0000\n"
-"Last-Translator: Benedikt Bormann <mail@bbormann.de>\n"
+"PO-Revision-Date: 2026-10-13 14:40+0000\n"
+"Last-Translator: Martin Gross <gross@rami.io>\n"
 "Language-Team: German <https://translate.pretix.eu/projects/pretix/pretix-js/"
 "de/>\n"
 "Language: de\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 2026.6.1\n"
+"X-Generator: Weblate 2026.10\n"
 
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js
 msgid "Marked as paid"

src/pretix/locale/de_Informal/LC_MESSAGES/django.po

@@ -8,8 +8,8 @@ msgstr ""
 "Project-Id-Version: 1\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-09-30 07:26+0000\n"
-"PO-Revision-Date: 2026-09-30 08:09+0000\n"
-"Last-Translator: Raphael Michel <michel@rami.io>\n"
+"PO-Revision-Date: 2026-10-13 14:40+0000\n"
+"Last-Translator: Martin Gross <gross@rami.io>\n"
 "Language-Team: German (informal) <https://translate.pretix.eu/projects/"
 "pretix/pretix/de_Informal/>\n"
 "Language: de_Informal\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 2026.9.1\n"
+"X-Generator: Weblate 2026.10\n"
 
 #: pretix/_base_settings.py
 msgid "English"

src/pretix/locale/lb/LC_MESSAGES/django.po

@@ -8,8 +8,8 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-09-30 07:26+0000\n"
-"PO-Revision-Date: 2025-10-28 17:00+0000\n"
-"Last-Translator: Sven Muhlen <sven.muhlen@bnl.etat.lu>\n"
+"PO-Revision-Date: 2026-10-13 14:40+0000\n"
+"Last-Translator: Martin Gross <gross@rami.io>\n"
 "Language-Team: Luxembourgish <https://translate.pretix.eu/projects/pretix/"
 "pretix/lb/>\n"
 "Language: lb\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 5.14\n"
+"X-Generator: Weblate 2026.10\n"
 
 #: pretix/_base_settings.py
 msgid "English"

src/pretix/locale/nl/LC_MESSAGES/django.po

@@ -7,16 +7,16 @@ msgstr ""
 "Project-Id-Version: 1\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-09-30 07:26+0000\n"
-"PO-Revision-Date: 2026-05-05 13:26+0000\n"
-"Last-Translator: Ruud Hendrickx <ruud@leckxicon.eu>\n"
-"Language-Team: Dutch <https://translate.pretix.eu/projects/pretix/pretix/nl/"
-">\n"
+"PO-Revision-Date: 2026-10-19 02:00+0000\n"
+"Last-Translator: Christiaan de Die le Clercq <contact@techwolf12.nl>\n"
+"Language-Team: Dutch <https://translate.pretix.eu/projects/pretix/pretix/nl/>"
+"\n"
 "Language: nl\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 5.17.1\n"
+"X-Generator: Weblate 2026.10.1\n"
 
 #: pretix/_base_settings.py
 msgid "English"
@@ -92,7 +92,7 @@ msgstr "Hebreeuws"
 
 #: pretix/_base_settings.py
 msgid "Hungarian"
-msgstr ""
+msgstr "Hongaars"
 
 #: pretix/_base_settings.py
 msgid "Indonesian"
@@ -152,7 +152,7 @@ msgstr "Spaans (Latijns-Amerika)"
 
 #: pretix/_base_settings.py
 msgid "Thai"
-msgstr ""
+msgstr "Thais"
 
 #: pretix/_base_settings.py
 msgid "Turkish"
@@ -412,7 +412,7 @@ msgstr ""
 #: pretix/api/serializers/organizer.py pretix/control/views/organizer.py
 #, python-format
 msgid "You've been invited to join %(organizer)s"
-msgstr ""
+msgstr "Je bent uitgenodigd voor %(organizer)s"
 
 #: pretix/api/serializers/organizer.py pretix/control/views/organizer.py
 msgid "This user already has been invited for this team."
@@ -432,16 +432,12 @@ msgid "Medium connected to other event"
 msgstr "Het medium is verbonden met een ander evenement"
 
 #: pretix/api/views/checkin.py
-#, fuzzy
-#| msgid "You cannot change this order."
 msgid "You cannot exchange a medium for a medium."
-msgstr "U kunt deze bestelling niet wijzigen."
+msgstr "Je kunt geen medium inwisselen voor een medium."
 
 #: pretix/api/views/checkin.py
-#, fuzzy
-#| msgid "You cannot change this order."
 msgid "You cannot simulate a medium exchange."
-msgstr "U kunt deze bestelling niet wijzigen."
+msgstr "Je kunt een wisseling van medium niet simuleren."
 
 #: pretix/api/views/oauth.py pretix/control/logdisplay.py
 #, python-brace-format
@@ -599,16 +595,17 @@ msgstr ""
 "objecten zoals varianten of bundels."
 
 #: pretix/api/webhooks.py
-#, fuzzy
-#| msgid "Quota handling"
 msgid "Quota changed"
-msgstr "Quotabeheer"
+msgstr "Quotum gewijzigd"
 
 #: pretix/api/webhooks.py
 msgid ""
 "This includes related events like creation, deletion, opening or closing of "
 "quotas. No webhook is sent for changes to the resulting availability."
 msgstr ""
+"Dit omvat gerelateerde gebeurtenissen zoals het aanmaken, verwijderen, "
+"openen of sluiten van quota. Er wordt geen webhook verzonden voor "
+"wijzigingen in de resulterende beschikbaarheid."
 
 #: pretix/api/webhooks.py
 msgid "Shop taken live"
@@ -1395,10 +1392,8 @@ msgid "Membership type"
 msgstr "Lidmaatschapstype"
 
 #: pretix/base/exporters/customers.py
-#, fuzzy
-#| msgid "Purchase time"
 msgid "Purchase ticket"
-msgstr "Aankooptijd"
+msgstr "Ticket kopen"
 
 #: pretix/base/exporters/customers.py pretix/base/exporters/orderlist.py
 #: pretix/base/exporters/waitinglist.py pretix/base/forms/questions.py
@@ -1415,10 +1410,8 @@ msgid "Start date"
 msgstr "Startdatum"
 
 #: pretix/base/exporters/customers.py
-#, fuzzy
-#| msgid "Start time from"
 msgid "Start time"
-msgstr "Starttijd vanaf"
+msgstr "Starttijd"
 
 #: pretix/base/exporters/customers.py pretix/base/exporters/orderlist.py
 #: pretix/base/exporters/waitinglist.py pretix/base/models/memberships.py
@@ -1431,10 +1424,8 @@ msgid "End date"
 msgstr "Einddatum"
 
 #: pretix/base/exporters/customers.py
-#, fuzzy
-#| msgid "End: %(time)s"
 msgid "End time"
-msgstr "Einde: %(time)s"
+msgstr "Eindtijd"
 
 #: pretix/base/exporters/dekodi.py pretix/base/exporters/invoices.py
 msgctxt "export_category"
@@ -1794,16 +1785,12 @@ msgid "Transmission type"
 msgstr "Verzendingstype"
 
 #: pretix/base/exporters/invoices.py
-#, fuzzy
-#| msgid "Transmission type"
 msgid "Transmission status"
-msgstr "Verzendingstype"
+msgstr "Verzendstatus"
 
 #: pretix/base/exporters/invoices.py
-#, fuzzy
-#| msgid "Transmission type"
 msgid "Transmission date"
-msgstr "Verzendingstype"
+msgstr "Verzendingsdatum"
 
 #: pretix/base/exporters/invoices.py
 msgid "Cancellation"
@@ -3041,11 +3028,12 @@ msgid ""
 "The field \"%(label)s\" may not contain special characters such as "
 "\"%(chars)s\"."
 msgstr ""
+"Het veld \"%(label)s\" mag geen speciale tekens zoals \"%(chars)s\" bevatten."
 
 #: pretix/base/forms/questions.py
 #, python-format
 msgid "The field \"%(label)s\" may not contain an URL (%(url)s)."
-msgstr ""
+msgstr "Het veld \"%(label)s\" mag geen URL (%(url)s) bevatten."
 
 #: pretix/base/forms/questions.py
 msgctxt "phonenumber"
@@ -4107,10 +4095,8 @@ msgid "Users"
 msgstr "Gebruikers"
 
 #: pretix/base/models/auth.py
-#, fuzzy
-#| msgid "Changes to your account at {organizer}"
 msgid "Changes to your account"
-msgstr "Wijzigingen in uw account bij {organizer}"
+msgstr "Wijzigingen in uw account"
 
 #: pretix/base/models/auth.py
 #, fuzzy, python-brace-format
@@ -4136,8 +4122,6 @@ msgstr ""
 "naar {new_email}, gebruikt u de volgende code:"
 
 #: pretix/base/models/auth.py
-#, fuzzy
-#| msgid "Enter confirmation code"
 msgid "Your confirmation code"
 msgstr "Voer bevestigingscode in"
 

src/pretix/plugins/banktransfer/views.py

@@ -633,6 +633,9 @@ class ImportView(ListView):
 
 class OrganizerBanktransferView:
     def dispatch(self, request, *args, **kwargs):
+        # Users can use the bank transfer views if they have sufficient permission for at least one event.
+        # Yes, this allows them to cauase changes in events they don't have access to. This is an accepted
+        # risk because every other way, the bank transfer feature becomes basically unusable.
         has_any_event_perm = request.user.get_events_with_permission(
             "event.orders:write", request=request
         ).filter(organizer=request.organizer).exists()

src/pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js

@@ -97,7 +97,7 @@ var pretixpaypal = {
 
 		let sdk_url = 'https://www.paypal.com/sdk/js'
 			+ '?client-id=' + pretixpaypal.client_id
-			+ '&components=buttons,funding-eligibility'
+			+ '&components=buttons,funding-eligibility,messages'
 			+ '&currency=' + pretixpaypal.currency
 
 		if (pretixpaypal.locale) {
@@ -195,6 +195,12 @@ var pretixpaypal = {
 				label: 'pay',
 				tagline: false
 			},
+			message: {
+				amount: undefined,
+				align: 'center',
+				color: 'black',
+				position: 'bottom'
+			},
 			createOrder: function (data, actions) {
 				if (pretixpaypal.order_id) {
 					return pretixpaypal.order_id
@@ -285,6 +291,18 @@ var pretixpaypal = {
 
 			if (button.isEligible()) {
 				eligibles.push(gettext(pretixpaypal.apm_map[fundingSource] || fundingSource))
+
+				if (fundingSource === 'paylater') {
+					pretixpaypal.paypal.Messages({
+						pageType: 'payment',
+						style: {
+							layout: 'text',
+							logo: {
+								type: 'none',
+							}
+						}
+					}).render('.pp-message');
+				}
 			}
 		})
 

src/pretix/plugins/paypal2/templates/pretixplugins/paypal2/checkout_payment_form.html

@@ -14,6 +14,7 @@
             After you clicked continue, we will be able to select how you want to pay and to fill in your payment
             details. You will then be redirected back here to review and confirm your order.
         {% endblocktrans %}
+        <div class="pp-message"></div>
     {% endif %}
 </p>
 

src/pretix/plugins/stripe/static/pretixplugins/stripe/pretix-stripe.js

@@ -172,6 +172,9 @@ var pretixstripe = {
 						})
 
 						pretixstripe.affirm.mount('#stripe-affirm')
+						pretixstripe.affirm.on('ready', function () {
+							$('.stripe-container').closest('form').find('.checkout-button-row .btn-primary').prop('disabled', false)
+						})
 					}
 					if ($('#stripe-klarna').length) {
 						try {
@@ -183,6 +186,9 @@ var pretixstripe = {
 							})
 
 							pretixstripe.klarna.mount('#stripe-klarna')
+							pretixstripe.klarna.on('ready', function () {
+								$('.stripe-container').closest('form').find('.checkout-button-row .btn-primary').prop('disabled', false)
+							})
 						} catch (e) {
 							console.error(e)
 							$('#stripe-klarna').html('<div class=\'alert alert-danger\'>Technical error, please contact support: ' + e + '</div>')

src/pretix/static/pretixbase/js/gettextstub.js

@@ -20,7 +20,7 @@ function pgettext (context, msgid) {
 	return msgid
 }
 
-function interpolate (fmt, object, named) {
+function interpolate (fmt, obj, named) {
 	if (named) {
 		return fmt.replace(/%\(\w+\)s/g, function (match) { return String(obj[match.slice(2, -2)]) })
 	} else {

src/pretix/static/pretixpresale/js/ui/main.js

@@ -9,22 +9,6 @@ let form_handlers = function (el) {
 		}
 	})
 
-	// A11y-bug on iOS-26.x Safari/Chrome: select-element loses focus after option has been selected
-	el.find('select').one('touchstart', function (e) {
-		function focusAfterBlur () {
-			this.focus();
-		}
-		// click event seems wrong, but it triggers after select is closed even if no change is made
-		// change event triggers only if a different option than the selected one is selected
-		$(this).on("click", function () {
-			// only focus if element was blurred immediately after change, ie. the bug exists
-			$(this).one("blur", focusAfterBlur);
-			window.setTimeout(function() {
-				$(this).off("blur", focusAfterBlur);
-			}, 1);
-		});
-	});
-
 	el.find('.datetimepicker').each(function () {
 		$(this).datetimepicker({
 			format: $(this).attr('data-format') ? $(this).attr('data-format') : $('body').attr('data-datetimeformat'),

src/tests/api/test_items.py

@@ -1000,7 +1000,6 @@ def test_item_create_with_bundle(token_client, organizer, event, item, category,
             "bundles": [
                 {
                     "bundled_item": i.pk,
-                    "bundled_variation": None,
                     "count": 2,
                     "designated_price": "3.00",
                 }