Update djangorestframework requirement from ==3.17.* to ==3.18.* (#6470)

* Update djangorestframework requirement from ==3.17.* to ==3.18.*

Updates the requirements on [djangorestframework](https://github.com/encode/django-rest-framework) to permit the latest version.
- [Release notes](https://github.com/encode/django-rest-framework/releases)
- [Commits](https://github.com/encode/django-rest-framework/compare/3.17.0...3.18.0)

---
updated-dependencies:
- dependency-name: djangorestframework
  dependency-version: 3.18.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* RestFramework: use LIST_SERIALIZER_ERRORS_AS_DICT compatibility option

* set lower bound for djangorestframework

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Lukas Bockstaller <bockstaller@pretix.eu>

pyproject.toml

@@ -57,7 +57,7 @@ dependencies = [
   "django-redis==7.0.*",
   "django-scopes==2.1.*",
   "django-statici18n==2.8.*",
-  "djangorestframework==3.17.*",
+  "djangorestframework>=3.18.2",
   "dnspython==2.8.*",
   "drf_ujson2==1.7.*",
   "geoip2==5.*",
@@ -77,14 +77,14 @@ dependencies = [
   "paypal-checkout-serversdk==1.0.*",
   "PyJWT==2.15.*",
   "phonenumberslite==9.0.*",
-  "Pillow==12.3.*",
+  "Pillow==13.0.*",
   "pretix-plugin-build",
   "protobuf==7.36.*",
   "psycopg2-binary",
   "pycountry",
-  "pycparser==3.0",
+  "pycparser==3.11",
   "pycryptodome==3.24.*",
-  "pypdf==6.19.*",
+  "pypdf==6.20.*",
   "python-bidi==0.6.*",  # Support for Arabic in reportlab
   "python-dateutil==2.9.*",
   "pytz",

src/pretix/api/auth/device.py

@@ -76,7 +76,7 @@ class DeviceTokenAuthentication(TokenAuthentication):
             except DeviceLastSeen.DoesNotExist:
                 # First request from device, create model, ignore result. Use get_or_create to be safe
                 # against concurrent create requests
-                DeviceLastSeen.objects.get_or_create(device=device, last_seen=now())
+                DeviceLastSeen.objects.get_or_create(device=device, defaults={"last_seen": now()})
             else:
                 if now() - last_seen_obj.last_seen < timedelta(seconds=10):
                     # We don't need to know the last seen info of a device to more precision than this,

src/pretix/api/serializers/item.py

@@ -378,7 +378,7 @@ class ItemSerializer(SalesChannelMigrationMixin, I18nAwareModelSerializer):
     def validate_bundles(self, value):
         if not self.instance:
             for b_data in value:
-                ItemBundle.clean_itemvar(self.context['event'], b_data['bundled_item'], b_data['bundled_variation'])
+                ItemBundle.clean_itemvar(self.context['event'], b_data.get('bundled_item'), b_data.get('bundled_variation'))
         return value
 
     def validate_addons(self, value):

src/pretix/control/forms/organizer.py

@@ -1198,7 +1198,7 @@ OrganizerFooterLinkFormset = inlineformset_factory(
 class SSOProviderForm(I18nModelForm):
 
     config_oidc_base_url = forms.URLField(
-        label=pgettext_lazy('sso_oidc', 'Base URL'),
+        label=pgettext_lazy('sso_oidc', 'Base URL / issuer'),
         required=False,
     )
     config_oidc_client_id = forms.CharField(
@@ -1295,6 +1295,14 @@ class SSOProviderForm(I18nModelForm):
 
 
 class SSOClientForm(I18nModelForm):
+    disp_base_url = forms.CharField(
+        label=_('Base URL / issuer'),
+        disabled=True,
+    )
+    disp_client_id = forms.CharField(
+        label=_('Client ID'),
+        disabled=True,
+    )
     regenerate_client_secret = forms.BooleanField(
         label=_('Invalidate old client secret and generate a new one'),
         required=False,
@@ -1302,7 +1310,8 @@ class SSOClientForm(I18nModelForm):
 
     class Meta:
         model = CustomerSSOClient
-        fields = ['is_active', 'name', 'client_id', 'client_type', 'authorization_grant_type', 'redirect_uris',
+        fields = ['is_active', 'name', 'disp_base_url', 'disp_client_id', 'regenerate_client_secret',
+                  'client_type', 'authorization_grant_type', 'redirect_uris',
                   'allowed_scopes', 'require_pkce']
         widgets = {
             'authorization_grant_type': forms.RadioSelect,
@@ -1317,13 +1326,15 @@ class SSOClientForm(I18nModelForm):
             help_text=self.fields['allowed_scopes'].help_text,
             required=self.fields['allowed_scopes'].required,
             initial=self.fields['allowed_scopes'].initial,
-            choices=CustomerSSOClient.SCOPE_CHOICES,
+            choices=[(val, format_html('<code>{}</code> &ndash; {}', val, label)) for val, label in CustomerSSOClient.SCOPE_CHOICES],
             widget=forms.CheckboxSelectMultiple
         )
+        organizer = kwargs['event']
+        self.initial['disp_base_url'] = eventreverse_absolute(organizer, 'presale:organizer.index', {}).strip('/')
         if self.instance and self.instance.pk:
-            self.fields['client_id'].disabled = True
+            self.initial['disp_client_id'] = self.instance.client_id
         else:
-            del self.fields['client_id']
+            self.initial['disp_client_id'] = _('(will be generated)')
             del self.fields['regenerate_client_secret']
 
 

src/pretix/control/templates/pretixcontrol/organizers/ssoclient_edit.html

@@ -1,12 +1,29 @@
 {% extends "pretixcontrol/organizers/base.html" %}
 {% load i18n %}
 {% load bootstrap3 %}
+{% block title %}
+    {% if client %}
+        {% trans "SSO client:" %} {{ client.name }}
+    {% else %}
+        {% trans "Create credentials for a new SSO client" %}
+    {% endif %}
+{% endblock %}
 {% block inner %}
     {% if client %}
         <h1>{% trans "SSO client:" %} {{ client.name }}</h1>
     {% else %}
-        <h1>{% trans "Create a new SSO client" %}</h1>
+        <h1>{% trans "Create credentials for a new SSO client" %}</h1>
+        <p>
+            {% blocktrans trimmed %}
+                After submitting this form, client credentials for your SSO client will be generated.
+            {% endblocktrans %}
+        </p>
     {% endif %}
+    <p>
+        {% blocktrans trimmed with url="https://docs.pretix.eu/guides/customer-accounts/#using-pretix-as-an-sso-provider" %}
+            For more information, refer to our documentation on <a href="{{ url }}">Using pretix as an SSO provider with external SSO clients</a>.
+        {% endblocktrans %}
+    </p>
     <form class="form-horizontal" action="" method="post">
         {% csrf_token %}
         {% bootstrap_form form layout="control" %}

src/pretix/control/templates/pretixcontrol/organizers/ssoclients.html

@@ -3,16 +3,23 @@
 {% load bootstrap3 %}
 {% block title %}{% trans "SSO clients" %}{% endblock %}
 {% block inner %}
-    <h1>{% trans "SSO clients" %}</h1>
+    <h1>{% trans "SSO clients" %}  <small> &mdash; {% blocktrans %}
+    	"Login with pretix" in external systems
+    {% endblocktrans %}</small></h1>
     <p>
         {% blocktrans trimmed %}
             You can allow your customers to log into other systems using their customer account credentials by setting up
             your other systems as a Single-Sign-On (SSO) client based on OpenID Connect.
         {% endblocktrans %}
     </p>
+    <p>
+        {% blocktrans trimmed with url="https://docs.pretix.eu/guides/customer-accounts/#using-pretix-as-an-sso-provider" %}
+            For more information, refer to our documentation on <a href="{{ url }}">Using pretix as an SSO provider with external SSO clients</a>.
+        {% endblocktrans %}
+    </p>
     <a href="{% url "control:organizer.ssoclient.add" organizer=request.organizer.slug %}" class="btn btn-default">
         <span class="fa fa-plus"></span>
-        {% trans "Create a new SSO client" %}
+        {% trans "Create credentials for a new SSO client" %}
     </a>
     <table class="table table-condensed table-hover">
         <thead>

src/pretix/control/templates/pretixcontrol/organizers/ssoprovider_edit.html

@@ -1,12 +1,24 @@
 {% extends "pretixcontrol/organizers/base.html" %}
 {% load i18n %}
 {% load bootstrap3 %}
+{% block title %}
+    {% if provider %}
+        {% trans "External SSO provider:" %} {{ provider.name }}
+    {% else %}
+        {% trans "Connect to an external SSO provider" %}
+    {% endif %}
+{% endblock %}
 {% block inner %}
     {% if provider %}
-        <h1>{% trans "SSO provider:" %} {{ provider.name }}</h1>
+        <h1>{% trans "External SSO provider:" %} {{ provider.name }}</h1>
     {% else %}
-        <h1>{% trans "Create a new SSO provider" %}</h1>
+        <h1>{% trans "Connect to an external SSO provider" %}</h1>
     {% endif %}
+    <p>
+        {% blocktrans trimmed with url="https://docs.pretix.eu/guides/customer-accounts/#using-pretix-as-an-sso-client" %}
+            For more information, refer to our documentation on <a href="{{ url }}" target="_blank">Using pretix as an SSO client</a>.
+        {% endblocktrans %}
+    </p>
     <form class="form-horizontal" action="" method="post">
         {% csrf_token %}
         {% bootstrap_form form layout="control" %}

src/pretix/control/templates/pretixcontrol/organizers/ssoproviders.html

@@ -3,16 +3,23 @@
 {% load bootstrap3 %}
 {% block title %}{% trans "SSO providers" %}{% endblock %}
 {% block inner %}
-    <h1>{% trans "SSO providers" %}</h1>
+    <h1>{% trans "SSO providers" %} <small> &mdash; {% blocktrans %}
+    	Connect to an external login provider
+    {% endblocktrans %}</small></h1>
     <p>
         {% blocktrans trimmed %}
             You can connect existing Single-Sign-On (SSO) providers to allow your customers to log in using your own
             account system.
         {% endblocktrans %}
     </p>
+    <p>
+        {% blocktrans trimmed with url="https://docs.pretix.eu/guides/customer-accounts/#using-pretix-as-an-sso-client" %}
+            For more information, refer to our documentation on <a href="{{ url }}" target="_blank">Using pretix as an SSO client</a>.
+        {% endblocktrans %}
+    </p>
     <a href="{% url "control:organizer.ssoprovider.add" organizer=request.organizer.slug %}" class="btn btn-default">
         <span class="fa fa-plus"></span>
-        {% trans "Create a new SSO provider" %}
+        {% trans "Connect to an external SSO provider" %}
     </a>
     <table class="table table-condensed table-hover">
         <thead>

src/pretix/control/views/organizer.py

@@ -2817,10 +2817,15 @@ class SSOProviderCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequire
         return get_object_or_404(CustomerSSOProvider, organizer=self.request.organizer, pk=self.kwargs.get('provider'))
 
     def get_success_url(self):
-        return reverse('control:organizer.ssoproviders', kwargs={
-            'organizer': self.request.organizer.slug,
+        return reverse('control:organizer.ssoprovider.edit', kwargs={
+            'organizer': self.request.organizer.slug, 'provider': self.object.pk,
         })
 
+    def get_context_data(self, **kwargs):
+        ctx = super().get_context_data(**kwargs)
+        ctx['redirect_uri'] = _('(will be generated)')
+        return ctx
+
     def get_form_kwargs(self):
         kwargs = super().get_form_kwargs()
         kwargs['event'] = self.request.organizer
@@ -2950,8 +2955,11 @@ class SSOClientCreateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredM
         secret = form.instance.set_client_secret()
         messages.success(
             self.request,
-            _('The SSO client has been created. Please note down the following client secret, it will never be shown '
-              'again: {secret}').format(secret=secret)
+            _('The SSO client has been created.') + ' ' +
+            _('Please note down the following client secret, it will never be shown again.') + '\n\n' +
+            _('Base URL / issuer') + f': {form.initial["disp_base_url"]}\n\n' +
+            _('Client ID') + f': {form.instance.client_id}\n\n' +
+            _('Client secret') + f': {secret}'
         )
         form.instance.organizer = self.request.organizer
         ret = super().form_valid(form)
@@ -3000,8 +3008,9 @@ class SSOClientUpdateView(OrganizerDetailViewMixin, OrganizerPermissionRequiredM
             secret = form.instance.set_client_secret()
             messages.success(
                 self.request,
-                _('Your changes have been saved. Please note down the following client secret, it will never be shown '
-                  'again: {secret}').format(secret=secret)
+                _('Your changes have been saved.') + ' ' +
+                _('Please note down the following client secret, it will never be shown again.') + '\n\n' +
+                _('Client secret') + f': {secret}'
             )
         else:
             messages.success(

src/pretix/locale/de/LC_MESSAGES/django.po

@@ -5,8 +5,8 @@ msgstr ""
 "Project-Id-Version: 1\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-09-30 07:26+0000\n"
-"PO-Revision-Date: 2026-09-30 08:06+0000\n"
-"Last-Translator: Phin Wolkwitz <wolkwitz@pretix.eu>\n"
+"PO-Revision-Date: 2026-10-13 14:40+0000\n"
+"Last-Translator: Martin Gross <gross@rami.io>\n"
 "Language-Team: German <https://translate.pretix.eu/projects/pretix/pretix/"
 "de/>\n"
 "Language: de\n"
@@ -14,7 +14,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 2026.9.1\n"
+"X-Generator: Weblate 2026.10\n"
 "X-Poedit-Bookmarks: -1,-1,904,-1,-1,-1,-1,-1,-1,-1\n"
 
 #: pretix/_base_settings.py
@@ -34449,7 +34449,7 @@ msgstr ""
 
 #: pretix/presale/forms/customer.py
 msgid "Forgot your password?"
-msgstr "Passwort zurücksetzen"
+msgstr "Passwort vergessen?"
 
 #: pretix/presale/forms/customer.py
 msgid ""

src/pretix/locale/de/LC_MESSAGES/djangojs.po

@@ -8,8 +8,8 @@ msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-09-30 07:26+0000\n"
-"PO-Revision-Date: 2026-07-06 02:00+0000\n"
-"Last-Translator: Benedikt Bormann <mail@bbormann.de>\n"
+"PO-Revision-Date: 2026-10-13 14:40+0000\n"
+"Last-Translator: Martin Gross <gross@rami.io>\n"
 "Language-Team: German <https://translate.pretix.eu/projects/pretix/pretix-js/"
 "de/>\n"
 "Language: de\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 2026.6.1\n"
+"X-Generator: Weblate 2026.10\n"
 
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js
 msgid "Marked as paid"

src/pretix/locale/de_Informal/LC_MESSAGES/django.po

@@ -8,8 +8,8 @@ msgstr ""
 "Project-Id-Version: 1\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-09-30 07:26+0000\n"
-"PO-Revision-Date: 2026-09-30 08:09+0000\n"
-"Last-Translator: Raphael Michel <michel@rami.io>\n"
+"PO-Revision-Date: 2026-10-13 14:40+0000\n"
+"Last-Translator: Martin Gross <gross@rami.io>\n"
 "Language-Team: German (informal) <https://translate.pretix.eu/projects/"
 "pretix/pretix/de_Informal/>\n"
 "Language: de_Informal\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 2026.9.1\n"
+"X-Generator: Weblate 2026.10\n"
 
 #: pretix/_base_settings.py
 msgid "English"

src/pretix/locale/eu/LC_MESSAGES/django.po

@@ -8,16 +8,16 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-09-30 07:26+0000\n"
-"PO-Revision-Date: 2026-09-04 14:29+0000\n"
-"Last-Translator: Albizuri <oier@puntu.eus>\n"
-"Language-Team: Basque <https://translate.pretix.eu/projects/pretix/pretix/eu/"
-">\n"
+"PO-Revision-Date: 2026-10-23 13:02+0000\n"
+"Last-Translator: Martin Gross <gross@rami.io>\n"
+"Language-Team: Basque <https://translate.pretix.eu/projects/pretix/pretix/"
+"eu/>\n"
 "Language: eu\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 2026.9\n"
+"X-Generator: Weblate 2026.10.1\n"
 
 #: pretix/_base_settings.py
 msgid "English"
@@ -36,8 +36,9 @@ msgid "Arabic"
 msgstr "Arabiera"
 
 #: pretix/_base_settings.py
+#, fuzzy
 msgid "Basque"
-msgstr ""
+msgstr "Euskera"
 
 #: pretix/_base_settings.py
 msgid "Catalan"
@@ -1171,10 +1172,9 @@ msgid "Check-in datetime on list {}"
 msgstr "Izen-emate zerrendak"
 
 #: pretix/base/datasync/sourcefields.py
-#, fuzzy, python-brace-format
-#| msgid "Question {val}"
+#, python-brace-format
 msgid "Question: {name}"
-msgstr "Galdera {val}"
+msgstr "Galdera {name}"
 
 #: pretix/base/datasync/sourcefields.py pretix/base/settings.py
 msgid "Given name"
@@ -1295,7 +1295,7 @@ msgstr ""
 #: pretix/control/navigation.py
 #: pretix/control/templates/pretixcontrol/organizers/customers.html
 msgid "Customers"
-msgstr ""
+msgstr "Bezeroak"
 
 #: pretix/base/exporters/customers.py pretix/control/forms/filter.py
 #: pretix/control/templates/pretixcontrol/organizers/customer.html
@@ -3096,7 +3096,7 @@ msgstr "Helbide elektronikoa"
 #: pretix/base/forms/auth.py pretix/control/forms/orders.py
 #: pretix/control/templates/pretixcontrol/shredder/download.html
 msgid "Confirmation code"
-msgstr ""
+msgstr "Baieztatze kodea"
 
 #: pretix/base/forms/questions.py
 #, fuzzy
@@ -3162,7 +3162,7 @@ msgstr ""
 
 #: pretix/base/forms/questions.py
 msgid "Street"
-msgstr ""
+msgstr "Kalea"
 
 #: pretix/base/forms/questions.py
 msgid "State"
@@ -3430,11 +3430,9 @@ msgid "Exchange System (SdI)"
 msgstr ""
 
 #: pretix/base/invoicing/national.py
-#, fuzzy
-#| msgid "Gift card code"
 msgctxt "italian_invoice"
 msgid "Fiscal code"
-msgstr "Opari-txartelaren kodea"
+msgstr "Kode fiskala"
 
 #: pretix/base/invoicing/national.py
 msgctxt "italian_invoice"
@@ -3761,10 +3759,8 @@ msgid "The relevant plugin is currently not active."
 msgstr "Produktu hau ez dago eskuragarri."
 
 #: pretix/base/logentrytypes.py
-#, fuzzy
-#| msgid "Order deleted"
 msgid "(deleted)"
-msgstr "Ezabatutako eskaera"
+msgstr "(Ezabatutako eskaera)"
 
 #: pretix/base/logentrytypes.py
 #, python-brace-format
@@ -6234,13 +6230,13 @@ msgstr "Amaiera"
 #: pretix/control/templates/pretixcontrol/organizers/outgoing_mail.html
 #: pretix/control/templates/pretixcontrol/organizers/outgoing_mails.html
 msgid "queued"
-msgstr ""
+msgstr "zerrendan"
 
 #: pretix/base/models/mail.py
 #: pretix/control/templates/pretixcontrol/organizers/outgoing_mail.html
 #: pretix/control/templates/pretixcontrol/organizers/outgoing_mails.html
 msgid "being sent"
-msgstr ""
+msgstr "bidaltzen"
 
 #: pretix/base/models/mail.py
 #, fuzzy
@@ -6264,7 +6260,7 @@ msgstr ""
 #: pretix/control/templates/pretixcontrol/organizers/outgoing_mail.html
 #: pretix/control/templates/pretixcontrol/organizers/outgoing_mails.html
 msgid "sent"
-msgstr ""
+msgstr "bidalita"
 
 #: pretix/base/models/mail.py
 #: pretix/control/templates/pretixcontrol/organizers/outgoing_mail.html
@@ -6642,7 +6638,7 @@ msgstr "Egiaztatzeak huts egin du"
 #: pretix/base/models/orders.py pretix/control/views/event.py
 #: pretix/control/views/organizer.py
 msgid "Other"
-msgstr ""
+msgstr "Beste bat"
 
 #: pretix/base/models/organizer.py
 msgid ""
@@ -6799,7 +6795,7 @@ msgstr "Ordainketa itzuli"
 #, fuzzy
 #| msgid "Tax rate"
 msgid "Tax free"
-msgstr "Zerga-tasa"
+msgstr "Zergarik ez"
 
 #: pretix/base/models/tax.py
 msgctxt "tax_code"
@@ -14807,7 +14803,7 @@ msgstr ""
 
 #: pretix/control/forms/event.py
 msgid "European Union"
-msgstr ""
+msgstr "Europar Batasuna"
 
 #: pretix/control/forms/event.py
 msgid "Any customer"
@@ -18749,7 +18745,7 @@ msgstr ""
 #: pretix/control/templates/pretixcontrol/auth/login.html
 #: pretix/control/templates/pretixcontrol/auth/register.html
 msgid "Register"
-msgstr ""
+msgstr "Berretsi"
 
 #: pretix/control/templates/pretixcontrol/auth/login.html
 msgid ""
@@ -21609,7 +21605,7 @@ msgstr ""
 #: pretix/control/templates/pretixcontrol/fragment_quota_box_paid.html
 #, python-format
 msgid "Currently available: %(num)s"
-msgstr ""
+msgstr "Eskuragarri gaur egun: %(num)s"
 
 #: pretix/control/templates/pretixcontrol/global_license.html
 msgid ""

src/pretix/locale/eu/LC_MESSAGES/djangojs.po

@@ -8,8 +8,8 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-09-30 07:26+0000\n"
-"PO-Revision-Date: 2026-07-29 11:04+0000\n"
-"Last-Translator: Albizuri <oier@puntu.eus>\n"
+"PO-Revision-Date: 2026-10-23 13:02+0000\n"
+"Last-Translator: Martin Gross <gross@rami.io>\n"
 "Language-Team: Basque <https://translate.pretix.eu/projects/pretix/pretix-js/"
 "eu/>\n"
 "Language: eu\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 2026.7.1\n"
+"X-Generator: Weblate 2026.10.1\n"
 
 #: pretix/plugins/banktransfer/static/pretixplugins/banktransfer/ui.js
 msgid "Marked as paid"
@@ -870,7 +870,7 @@ msgstr ""
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "Register"
-msgstr ""
+msgstr "Erregistratu"
 
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
@@ -917,7 +917,7 @@ msgstr ""
 #, javascript-format
 msgctxt "widget"
 msgid "currently available: %s"
-msgstr ""
+msgstr "Eskuragarri gaur egun: %s"
 
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
@@ -1054,32 +1054,32 @@ msgstr ""
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "Choose a different date"
-msgstr ""
+msgstr "Beste data bat aukera"
 
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "Back"
-msgstr ""
+msgstr "Atzera"
 
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "Next month"
-msgstr ""
+msgstr "Hurrengo hilabetea"
 
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "Previous month"
-msgstr ""
+msgstr "Aurreko hilabetea"
 
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "Next week"
-msgstr ""
+msgstr "Hurrengo astea"
 
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"
 msgid "Previous week"
-msgstr ""
+msgstr "Aurreko astea"
 
 #: pretix/static/pretixpresale/widget/src/i18n.ts
 msgctxt "widget"

src/pretix/locale/lb/LC_MESSAGES/django.po

@@ -8,8 +8,8 @@ msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-09-30 07:26+0000\n"
-"PO-Revision-Date: 2025-10-28 17:00+0000\n"
-"Last-Translator: Sven Muhlen <sven.muhlen@bnl.etat.lu>\n"
+"PO-Revision-Date: 2026-10-13 14:40+0000\n"
+"Last-Translator: Martin Gross <gross@rami.io>\n"
 "Language-Team: Luxembourgish <https://translate.pretix.eu/projects/pretix/"
 "pretix/lb/>\n"
 "Language: lb\n"
@@ -17,7 +17,7 @@ msgstr ""
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 5.14\n"
+"X-Generator: Weblate 2026.10\n"
 
 #: pretix/_base_settings.py
 msgid "English"

src/pretix/locale/nl/LC_MESSAGES/django.po

@@ -7,16 +7,16 @@ msgstr ""
 "Project-Id-Version: 1\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2026-09-30 07:26+0000\n"
-"PO-Revision-Date: 2026-05-05 13:26+0000\n"
-"Last-Translator: Ruud Hendrickx <ruud@leckxicon.eu>\n"
-"Language-Team: Dutch <https://translate.pretix.eu/projects/pretix/pretix/nl/"
-">\n"
+"PO-Revision-Date: 2026-10-19 02:00+0000\n"
+"Last-Translator: Christiaan de Die le Clercq <contact@techwolf12.nl>\n"
+"Language-Team: Dutch <https://translate.pretix.eu/projects/pretix/pretix/nl/>"
+"\n"
 "Language: nl\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=2; plural=n != 1;\n"
-"X-Generator: Weblate 5.17.1\n"
+"X-Generator: Weblate 2026.10.1\n"
 
 #: pretix/_base_settings.py
 msgid "English"
@@ -92,7 +92,7 @@ msgstr "Hebreeuws"
 
 #: pretix/_base_settings.py
 msgid "Hungarian"
-msgstr ""
+msgstr "Hongaars"
 
 #: pretix/_base_settings.py
 msgid "Indonesian"
@@ -152,7 +152,7 @@ msgstr "Spaans (Latijns-Amerika)"
 
 #: pretix/_base_settings.py
 msgid "Thai"
-msgstr ""
+msgstr "Thais"
 
 #: pretix/_base_settings.py
 msgid "Turkish"
@@ -412,7 +412,7 @@ msgstr ""
 #: pretix/api/serializers/organizer.py pretix/control/views/organizer.py
 #, python-format
 msgid "You've been invited to join %(organizer)s"
-msgstr ""
+msgstr "Je bent uitgenodigd voor %(organizer)s"
 
 #: pretix/api/serializers/organizer.py pretix/control/views/organizer.py
 msgid "This user already has been invited for this team."
@@ -432,16 +432,12 @@ msgid "Medium connected to other event"
 msgstr "Het medium is verbonden met een ander evenement"
 
 #: pretix/api/views/checkin.py
-#, fuzzy
-#| msgid "You cannot change this order."
 msgid "You cannot exchange a medium for a medium."
-msgstr "U kunt deze bestelling niet wijzigen."
+msgstr "Je kunt geen medium inwisselen voor een medium."
 
 #: pretix/api/views/checkin.py
-#, fuzzy
-#| msgid "You cannot change this order."
 msgid "You cannot simulate a medium exchange."
-msgstr "U kunt deze bestelling niet wijzigen."
+msgstr "Je kunt een wisseling van medium niet simuleren."
 
 #: pretix/api/views/oauth.py pretix/control/logdisplay.py
 #, python-brace-format
@@ -599,16 +595,17 @@ msgstr ""
 "objecten zoals varianten of bundels."
 
 #: pretix/api/webhooks.py
-#, fuzzy
-#| msgid "Quota handling"
 msgid "Quota changed"
-msgstr "Quotabeheer"
+msgstr "Quotum gewijzigd"
 
 #: pretix/api/webhooks.py
 msgid ""
 "This includes related events like creation, deletion, opening or closing of "
 "quotas. No webhook is sent for changes to the resulting availability."
 msgstr ""
+"Dit omvat gerelateerde gebeurtenissen zoals het aanmaken, verwijderen, "
+"openen of sluiten van quota. Er wordt geen webhook verzonden voor "
+"wijzigingen in de resulterende beschikbaarheid."
 
 #: pretix/api/webhooks.py
 msgid "Shop taken live"
@@ -1395,10 +1392,8 @@ msgid "Membership type"
 msgstr "Lidmaatschapstype"
 
 #: pretix/base/exporters/customers.py
-#, fuzzy
-#| msgid "Purchase time"
 msgid "Purchase ticket"
-msgstr "Aankooptijd"
+msgstr "Ticket kopen"
 
 #: pretix/base/exporters/customers.py pretix/base/exporters/orderlist.py
 #: pretix/base/exporters/waitinglist.py pretix/base/forms/questions.py
@@ -1415,10 +1410,8 @@ msgid "Start date"
 msgstr "Startdatum"
 
 #: pretix/base/exporters/customers.py
-#, fuzzy
-#| msgid "Start time from"
 msgid "Start time"
-msgstr "Starttijd vanaf"
+msgstr "Starttijd"
 
 #: pretix/base/exporters/customers.py pretix/base/exporters/orderlist.py
 #: pretix/base/exporters/waitinglist.py pretix/base/models/memberships.py
@@ -1431,10 +1424,8 @@ msgid "End date"
 msgstr "Einddatum"
 
 #: pretix/base/exporters/customers.py
-#, fuzzy
-#| msgid "End: %(time)s"
 msgid "End time"
-msgstr "Einde: %(time)s"
+msgstr "Eindtijd"
 
 #: pretix/base/exporters/dekodi.py pretix/base/exporters/invoices.py
 msgctxt "export_category"
@@ -1794,16 +1785,12 @@ msgid "Transmission type"
 msgstr "Verzendingstype"
 
 #: pretix/base/exporters/invoices.py
-#, fuzzy
-#| msgid "Transmission type"
 msgid "Transmission status"
-msgstr "Verzendingstype"
+msgstr "Verzendstatus"
 
 #: pretix/base/exporters/invoices.py
-#, fuzzy
-#| msgid "Transmission type"
 msgid "Transmission date"
-msgstr "Verzendingstype"
+msgstr "Verzendingsdatum"
 
 #: pretix/base/exporters/invoices.py
 msgid "Cancellation"
@@ -3041,11 +3028,12 @@ msgid ""
 "The field \"%(label)s\" may not contain special characters such as "
 "\"%(chars)s\"."
 msgstr ""
+"Het veld \"%(label)s\" mag geen speciale tekens zoals \"%(chars)s\" bevatten."
 
 #: pretix/base/forms/questions.py
 #, python-format
 msgid "The field \"%(label)s\" may not contain an URL (%(url)s)."
-msgstr ""
+msgstr "Het veld \"%(label)s\" mag geen URL (%(url)s) bevatten."
 
 #: pretix/base/forms/questions.py
 msgctxt "phonenumber"
@@ -4107,10 +4095,8 @@ msgid "Users"
 msgstr "Gebruikers"
 
 #: pretix/base/models/auth.py
-#, fuzzy
-#| msgid "Changes to your account at {organizer}"
 msgid "Changes to your account"
-msgstr "Wijzigingen in uw account bij {organizer}"
+msgstr "Wijzigingen in uw account"
 
 #: pretix/base/models/auth.py
 #, fuzzy, python-brace-format
@@ -4136,8 +4122,6 @@ msgstr ""
 "naar {new_email}, gebruikt u de volgende code:"
 
 #: pretix/base/models/auth.py
-#, fuzzy
-#| msgid "Enter confirmation code"
 msgid "Your confirmation code"
 msgstr "Voer bevestigingscode in"
 

src/pretix/plugins/banktransfer/views.py

@@ -633,6 +633,9 @@ class ImportView(ListView):
 
 class OrganizerBanktransferView:
     def dispatch(self, request, *args, **kwargs):
+        # Users can use the bank transfer views if they have sufficient permission for at least one event.
+        # Yes, this allows them to cauase changes in events they don't have access to. This is an accepted
+        # risk because every other way, the bank transfer feature becomes basically unusable.
         has_any_event_perm = request.user.get_events_with_permission(
             "event.orders:write", request=request
         ).filter(organizer=request.organizer).exists()

src/pretix/plugins/paypal2/static/pretixplugins/paypal2/pretix-paypal.js

@@ -97,7 +97,7 @@ var pretixpaypal = {
 
 		let sdk_url = 'https://www.paypal.com/sdk/js'
 			+ '?client-id=' + pretixpaypal.client_id
-			+ '&components=buttons,funding-eligibility'
+			+ '&components=buttons,funding-eligibility,messages'
 			+ '&currency=' + pretixpaypal.currency
 
 		if (pretixpaypal.locale) {
@@ -195,6 +195,12 @@ var pretixpaypal = {
 				label: 'pay',
 				tagline: false
 			},
+			message: {
+				amount: undefined,
+				align: 'center',
+				color: 'black',
+				position: 'bottom'
+			},
 			createOrder: function (data, actions) {
 				if (pretixpaypal.order_id) {
 					return pretixpaypal.order_id
@@ -285,6 +291,18 @@ var pretixpaypal = {
 
 			if (button.isEligible()) {
 				eligibles.push(gettext(pretixpaypal.apm_map[fundingSource] || fundingSource))
+
+				if (fundingSource === 'paylater') {
+					pretixpaypal.paypal.Messages({
+						pageType: 'payment',
+						style: {
+							layout: 'text',
+							logo: {
+								type: 'none',
+							}
+						}
+					}).render('.pp-message');
+				}
 			}
 		})
 

src/pretix/plugins/paypal2/templates/pretixplugins/paypal2/checkout_payment_form.html

@@ -14,6 +14,7 @@
             After you clicked continue, we will be able to select how you want to pay and to fill in your payment
             details. You will then be redirected back here to review and confirm your order.
         {% endblocktrans %}
+        <div class="pp-message"></div>
     {% endif %}
 </p>
 

src/pretix/plugins/stripe/static/pretixplugins/stripe/pretix-stripe.js

@@ -172,6 +172,9 @@ var pretixstripe = {
 						})
 
 						pretixstripe.affirm.mount('#stripe-affirm')
+						pretixstripe.affirm.on('ready', function () {
+							$('.stripe-container').closest('form').find('.checkout-button-row .btn-primary').prop('disabled', false)
+						})
 					}
 					if ($('#stripe-klarna').length) {
 						try {
@@ -183,6 +186,9 @@ var pretixstripe = {
 							})
 
 							pretixstripe.klarna.mount('#stripe-klarna')
+							pretixstripe.klarna.on('ready', function () {
+								$('.stripe-container').closest('form').find('.checkout-button-row .btn-primary').prop('disabled', false)
+							})
 						} catch (e) {
 							console.error(e)
 							$('#stripe-klarna').html('<div class=\'alert alert-danger\'>Technical error, please contact support: ' + e + '</div>')

src/pretix/settings.py

@@ -506,7 +506,8 @@ REST_FRAMEWORK = {
         'pretix.testutils.api.UploadRenderer',
     ],
     'EXCEPTION_HANDLER': 'pretix.api.exception.custom_exception_handler',
-    'UNICODE_JSON': False
+    'UNICODE_JSON': False,
+    'LIST_SERIALIZER_ERRORS_AS_DICT': False
 }
 
 

src/pretix/static/pretixbase/js/gettextstub.js

@@ -20,7 +20,7 @@ function pgettext (context, msgid) {
 	return msgid
 }
 
-function interpolate (fmt, object, named) {
+function interpolate (fmt, obj, named) {
 	if (named) {
 		return fmt.replace(/%\(\w+\)s/g, function (match) { return String(obj[match.slice(2, -2)]) })
 	} else {

src/pretix/static/pretixpresale/js/ui/main.js

@@ -9,22 +9,6 @@ let form_handlers = function (el) {
 		}
 	})
 
-	// A11y-bug on iOS-26.x Safari/Chrome: select-element loses focus after option has been selected
-	el.find('select').one('touchstart', function (e) {
-		function focusAfterBlur () {
-			this.focus();
-		}
-		// click event seems wrong, but it triggers after select is closed even if no change is made
-		// change event triggers only if a different option than the selected one is selected
-		$(this).on("click", function () {
-			// only focus if element was blurred immediately after change, ie. the bug exists
-			$(this).one("blur", focusAfterBlur);
-			window.setTimeout(function() {
-				$(this).off("blur", focusAfterBlur);
-			}, 1);
-		});
-	});
-
 	el.find('.datetimepicker').each(function () {
 		$(this).datetimepicker({
 			format: $(this).attr('data-format') ? $(this).attr('data-format') : $('body').attr('data-datetimeformat'),

src/setup.cfg

@@ -57,6 +57,7 @@ filterwarnings =
     ignore:teardown:pytest.PytestWarning
     ignore:avoid running initialization queries:RuntimeWarning
     ignore:.*The 'strip_cdata' option of HTMLParser.*:DeprecationWarning:
+    ignore:The list-based error format for `ListSerializer`:rest_framework.deprecation.RemovedInDRF320Warning
 
 
 [coverage:run]

src/tests/api/test_items.py

@@ -1000,7 +1000,6 @@ def test_item_create_with_bundle(token_client, organizer, event, item, category,
             "bundles": [
                 {
                     "bundled_item": i.pk,
-                    "bundled_variation": None,
                     "count": 2,
                     "designated_price": "3.00",
                 }

src/tests/base/test_mail.py

@@ -642,6 +642,8 @@ def assert_mail_connection(res, should_connect, use_ssl):
     True, False
 ])
 def test_private_smtp_ip(res, use_ssl, settings):
+    settings.EMAIL_HOST_USER = ''
+    settings.EMAIL_HOST_PASSWORD = ''
     settings.EMAIL_CUSTOM_SMTP_BACKEND = 'pretix.base.email.CheckPrivateNetworkSmtpBackend'
     settings.MAIL_CUSTOM_SMTP_ALLOW_PRIVATE_NETWORKS = False
     with assert_mail_connection(res=res, should_connect=False, use_ssl=use_ssl), pytest.raises(match="Request to .* blocked"):
@@ -665,6 +667,8 @@ def test_private_smtp_ip(res, use_ssl, settings):
     True, False
 ])
 def test_public_smtp_ip(use_ssl, allow_private, settings):
+    settings.EMAIL_HOST_USER = ''
+    settings.EMAIL_HOST_PASSWORD = ''
     settings.EMAIL_CUSTOM_SMTP_BACKEND = 'pretix.base.email.CheckPrivateNetworkSmtpBackend'
     settings.MAIL_CUSTOM_SMTP_ALLOW_PRIVATE_NETWORKS = allow_private