git.openstreetmap.org Git

Merge remote-tracking branch 'upstream/pull/7491'

Bump the dependencies group across 1 directory with 27 updates

Bumps the dependencies group with 27 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [pg](https://github.com/ged/ruby-pg) | `1.6.3` | `1.7.0` |
| [autoprefixer-rails](https://github.com/ai/autoprefixer-rails) | `10.4.21.0` | `10.6.1.0` |
| [dalli](https://github.com/petergoldstein/dalli) | `5.1.1` | `5.2.2` |
| [opentelemetry-exporter-otlp](https://github.com/open-telemetry/opentelemetry-ruby) | `0.36.0` | `0.37.0` |
| [opentelemetry-instrumentation-all](https://github.com/open-telemetry/opentelemetry-ruby-contrib) | `0.96.0` | `0.97.0` |
| [sentry-delayed_job](https://github.com/getsentry/sentry-ruby) | `7.0.0` | `7.1.0` |
| [sentry-rails](https://github.com/getsentry/sentry-ruby) | `7.0.0` | `7.1.0` |
| [sentry-ruby](https://github.com/getsentry/sentry-ruby) | `7.0.0` | `7.1.0` |
| [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) | `1.232.2` | `1.233.1` |
| [image_processing](https://github.com/janko/image_processing) | `2.1.0` | `2.2.0` |
| [noticed](https://github.com/excid3/noticed) | `3.0.0` | `3.1.0` |
| [listen](https://github.com/guard/listen) | `3.10.0` | `3.10.1` |
| [brakeman](https://github.com/presidentbeef/brakeman) | `8.0.6` | `8.1.0` |
| [pg_query](https://github.com/pganalyze/pg_query) | `6.2.2` | `6.2.5` |
| [selenium-webdriver](https://github.com/SeleniumHQ/selenium) | `4.49.0` | `4.50.0` |
| [database_consistency](https://github.com/djezzzl/database_consistency) | `3.0.13` | `3.0.14` |
| [aws-partitions](https://github.com/aws/aws-sdk-ruby) | `1.1291.0` | `1.1293.0` |
| [date](https://github.com/ruby/date) | `3.5.1` | `3.6.0` |
| [googleapis-common-protos-types](https://github.com/googleapis/common-protos-ruby) | `1.20.0` | `1.23.0` |
| [opentelemetry-common](https://github.com/open-telemetry/opentelemetry-ruby) | `0.25.1` | `0.25.2` |
| [opentelemetry-exporter-otlp-common](https://github.com/open-telemetry/opentelemetry-ruby) | `0.2.0` | `0.3.0` |
| [opentelemetry-instrumentation-aws_lambda](https://github.com/open-telemetry/opentelemetry-ruby-contrib) | `0.7.0` | `0.7.1` |
| [opentelemetry-instrumentation-base](https://github.com/open-telemetry/opentelemetry-ruby-contrib) | `0.26.1` | `0.27.0` |
| [opentelemetry-instrumentation-lmdb](https://github.com/open-telemetry/opentelemetry-ruby-contrib) | `0.26.1` | `0.27.0` |
| [opentelemetry-instrumentation-net_http](https://github.com/open-telemetry/opentelemetry-ruby-contrib) | `0.29.1` | `0.29.2` |
| [opentelemetry-instrumentation-rack](https://github.com/open-telemetry/opentelemetry-ruby-contrib) | `0.31.1` | `0.31.2` |
| [opentelemetry-instrumentation-sinatra](https://github.com/open-telemetry/opentelemetry-ruby-contrib) | `0.30.0` | `0.30.1` |

Updates `pg` from 1.6.3 to 1.7.0
- [Changelog](https://github.com/ged/ruby-pg/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ged/ruby-pg/compare/v1.6.3...v1.7.0)

Updates `autoprefixer-rails` from 10.4.21.0 to 10.6.1.0
- [Changelog](https://github.com/ai/autoprefixer-rails/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ai/autoprefixer-rails/compare/10.4.21.0...10.6.1.0)

Updates `dalli` from 5.1.1 to 5.2.2
- [Release notes](https://github.com/petergoldstein/dalli/releases)
- [Changelog](https://github.com/petergoldstein/dalli/blob/main/CHANGELOG.md)
- [Commits](https://github.com/petergoldstein/dalli/compare/v5.1.1...v5.2.2)

Updates `opentelemetry-exporter-otlp` from 0.36.0 to 0.37.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-ruby/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-ruby/compare/opentelemetry-exporter-otlp/v0.36.0...opentelemetry-exporter-otlp/v0.37.0)

Updates `opentelemetry-instrumentation-all` from 0.96.0 to 0.97.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-ruby-contrib/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-ruby-contrib/compare/opentelemetry-instrumentation-all/v0.96.0...opentelemetry-instrumentation-all/v0.97.0)

Updates `sentry-delayed_job` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/getsentry/sentry-ruby/releases)
- [Changelog](https://github.com/getsentry/sentry-ruby/blob/master/CHANGELOG.md)
- [Commits](https://github.com/getsentry/sentry-ruby/compare/7.0.0...7.1.0)

Updates `sentry-rails` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/getsentry/sentry-ruby/releases)
- [Changelog](https://github.com/getsentry/sentry-ruby/blob/master/CHANGELOG.md)
- [Commits](https://github.com/getsentry/sentry-ruby/compare/7.0.0...7.1.0)

Updates `sentry-ruby` from 7.0.0 to 7.1.0
- [Release notes](https://github.com/getsentry/sentry-ruby/releases)
- [Changelog](https://github.com/getsentry/sentry-ruby/blob/master/CHANGELOG.md)
- [Commits](https://github.com/getsentry/sentry-ruby/compare/7.0.0...7.1.0)

Updates `aws-sdk-s3` from 1.232.2 to 1.233.1
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Updates `image_processing` from 2.1.0 to 2.2.0
- [Changelog](https://github.com/janko/image_processing/blob/master/CHANGELOG.md)
- [Commits](https://github.com/janko/image_processing/compare/v2.1.0...v2.2.0)

Updates `noticed` from 3.0.0 to 3.1.0
- [Release notes](https://github.com/excid3/noticed/releases)
- [Changelog](https://github.com/excid3/noticed/blob/main/CHANGELOG.md)
- [Commits](https://github.com/excid3/noticed/compare/v3.0.0...v3.1.0)

Updates `listen` from 3.10.0 to 3.10.1
- [Release notes](https://github.com/guard/listen/releases)
- [Commits](https://github.com/guard/listen/compare/v3.10.0...v3.10.1)

Updates `brakeman` from 8.0.6 to 8.1.0
- [Release notes](https://github.com/presidentbeef/brakeman/releases)
- [Changelog](https://github.com/presidentbeef/brakeman/blob/main/CHANGES.md)
- [Commits](https://github.com/presidentbeef/brakeman/compare/v8.0.6...v8.1.0)

Updates `pg_query` from 6.2.2 to 6.2.5
- [Changelog](https://github.com/pganalyze/pg_query/blob/main/CHANGELOG.md)
- [Commits](https://github.com/pganalyze/pg_query/compare/v6.2.2...v6.2.5)

Updates `selenium-webdriver` from 4.49.0 to 4.50.0
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Changelog](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES)
- [Commits](https://github.com/SeleniumHQ/selenium/compare/selenium-4.49.0...selenium-4.50.0)

Updates `database_consistency` from 3.0.13 to 3.0.14
- [Changelog](https://github.com/djezzzl/database_consistency/blob/master/CHANGELOG.md)
- [Commits](https://github.com/djezzzl/database_consistency/compare/v3.0.13...v3.0.14)

Updates `aws-partitions` from 1.1291.0 to 1.1293.0
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-partitions/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Updates `date` from 3.5.1 to 3.6.0
- [Release notes](https://github.com/ruby/date/releases)
- [Commits](https://github.com/ruby/date/compare/v3.5.1...v3.6.0)

Updates `googleapis-common-protos-types` from 1.20.0 to 1.23.0
- [Release notes](https://github.com/googleapis/common-protos-ruby/releases)
- [Commits](https://github.com/googleapis/common-protos-ruby/compare/googleapis-common-protos-types/v1.20.0...googleapis-common-protos-types/v1.23.0)

Updates `opentelemetry-common` from 0.25.1 to 0.25.2
- [Release notes](https://github.com/open-telemetry/opentelemetry-ruby/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-ruby/compare/opentelemetry-common/v0.25.1...opentelemetry-common/v0.25.2)

Updates `opentelemetry-exporter-otlp-common` from 0.2.0 to 0.3.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-ruby/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-ruby/compare/opentelemetry-exporter-otlp-common/v0.2.0...opentelemetry-exporter-otlp-common/v0.3.0)

Updates `opentelemetry-instrumentation-aws_lambda` from 0.7.0 to 0.7.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-ruby-contrib/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-ruby-contrib/compare/opentelemetry-instrumentation-aws_lambda/v0.7.0...opentelemetry-instrumentation-aws_lambda/v0.7.1)

Updates `opentelemetry-instrumentation-base` from 0.26.1 to 0.27.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-ruby-contrib/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-ruby-contrib/compare/opentelemetry-instrumentation-base/v0.26.1...opentelemetry-instrumentation-base/v0.27.0)

Updates `opentelemetry-instrumentation-lmdb` from 0.26.1 to 0.27.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-ruby-contrib/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-ruby-contrib/compare/opentelemetry-instrumentation-lmdb/v0.26.1...opentelemetry-instrumentation-lmdb/v0.27.0)

Updates `opentelemetry-instrumentation-net_http` from 0.29.1 to 0.29.2
- [Release notes](https://github.com/open-telemetry/opentelemetry-ruby-contrib/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-ruby-contrib/compare/opentelemetry-instrumentation-net_http/v0.29.1...opentelemetry-instrumentation-net_http/v0.29.2)

Updates `opentelemetry-instrumentation-rack` from 0.31.1 to 0.31.2
- [Release notes](https://github.com/open-telemetry/opentelemetry-ruby-contrib/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-ruby-contrib/compare/opentelemetry-instrumentation-rack/v0.31.1...opentelemetry-instrumentation-rack/v0.31.2)

Updates `opentelemetry-instrumentation-sinatra` from 0.30.0 to 0.30.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-ruby-contrib/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-ruby-contrib/compare/opentelemetry-instrumentation-sinatra/v0.30.0...opentelemetry-instrumentation-sinatra/v0.30.1)

---
updated-dependencies:
- dependency-name: pg
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: autoprefixer-rails
  dependency-version: 10.6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: dalli
  dependency-version: 5.2.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: opentelemetry-exporter-otlp
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: opentelemetry-instrumentation-all
  dependency-version: 0.97.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: sentry-delayed_job
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: sentry-rails
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: sentry-ruby
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: aws-sdk-s3
  dependency-version: 1.233.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: image_processing
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: noticed
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: listen
  dependency-version: 3.10.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: brakeman
  dependency-version: 8.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: pg_query
  dependency-version: 6.2.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: selenium-webdriver
  dependency-version: 4.50.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: database_consistency
  dependency-version: 3.0.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: aws-partitions
  dependency-version: 1.1293.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: date
  dependency-version: 3.6.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: googleapis-common-protos-types
  dependency-version: 1.23.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: opentelemetry-common
  dependency-version: 0.25.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: opentelemetry-exporter-otlp-common
  dependency-version: 0.3.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: opentelemetry-instrumentation-aws_lambda
  dependency-version: 0.7.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: opentelemetry-instrumentation-base
  dependency-version: 0.27.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: opentelemetry-instrumentation-lmdb
  dependency-version: 0.27.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: opentelemetry-instrumentation-net_http
  dependency-version: 0.29.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: opentelemetry-instrumentation-rack
  dependency-version: 0.31.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: opentelemetry-instrumentation-sinatra
  dependency-version: 0.30.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #7486 from tomhughes/sass

Unpin sass gems

Merge remote-tracking branch 'upstream/pull/7488'

Restore missing controller reference in changeset discussion actions

Merge remote-tracking branch 'upstream/pull/7487'

Use concise object return patterns in index modules

Use 'this' context page load method initialization calls

Flatten single use functions

Merge remote-tracking branch 'upstream/pull/7485'

Silence deprecation warnings from bootstrap stylesheets

Release pinning of dartsass-sprockets and related gems

We keep sass-embedded pinned to a version below 3.0.0 as some
of the deprecation warnings from bootstrap are for things which
are planned to be removed in that version.

Deduplicate user image helper method internals

Fetch Wikidata preview thumbnails at a fixed height (#7433)

Fix typos in comments (#7484)

Fixes 10 spelling mistakes in comments, CONTRIBUTING.md and two test assertion messages. No behaviour changes.

Merge remote-tracking branch 'origin/translatewiki'

Merge remote-tracking branch 'shubham/fix/dashboard-popup-above-markers'

Localisation updates from https://translatewiki.net.

Merge pull request #7469 from tomhughes/invalid-images

Improve handling of invalid user avatars

Pin google-protobuf to stop sass-embedded upgrading

Merge remote-tracking branch 'upstream/pull/7479'

Pin dartsass-sprockets to avoid sass-embedded upgrade

Bump source-map-js from 1.2.1 to 1.2.2

Bumps [source-map-js](https://github.com/7rulnik/source-map-js) from 1.2.1 to 1.2.2.
- [Release notes](https://github.com/7rulnik/source-map-js/releases)
- [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/7rulnik/source-map-js/compare/v1.2.1...v1.2.2)

---
updated-dependencies:
- dependency-name: source-map-js
dependency-version: 1.2.2
dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/7477'

Merge remote-tracking branch 'upstream/pull/7476'

Bump the dependencies group with 3 updates

Bumps the dependencies group with 3 updates: [terra-draw](https://github.com/JamesLMilner/terra-draw), [eslint](https://github.com/eslint/eslint) and [globals](https://github.com/sindresorhus/globals).

Updates `terra-draw` from 1.35.0 to 1.36.0
- [Release notes](https://github.com/JamesLMilner/terra-draw/releases)
- [Changelog](https://github.com/JamesLMilner/terra-draw/blob/main/release.js)
- [Commits](https://github.com/JamesLMilner/terra-draw/compare/terra-draw@1.35.0...terra-draw@1.36.0)

Updates `eslint` from 10.11.0 to 10.12.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v10.11.0...v10.12.0)

Updates `globals` from 17.12.0 to 17.13.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](https://github.com/sindresorhus/globals/compare/v17.12.0...v17.13.0)

---
updated-dependencies:
- dependency-name: terra-draw
  dependency-version: 1.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: eslint
  dependency-version: 10.12.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: globals
  dependency-version: 17.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump rubocop-minitest from 0.40.0 to 0.41.0 in the rubocop group

Bumps the rubocop group with 1 update: [rubocop-minitest](https://github.com/rubocop/rubocop-minitest).

Updates `rubocop-minitest` from 0.40.0 to 0.41.0
- [Release notes](https://github.com/rubocop/rubocop-minitest/releases)
- [Changelog](https://github.com/rubocop/rubocop-minitest/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop-minitest/compare/v0.40.0...v0.41.0)

---
updated-dependencies:
- dependency-name: rubocop-minitest
  dependency-version: 0.41.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: rubocop
...

Signed-off-by: dependabot[bot] <support@github.com>

Add a task to remove invalid user avatars

Add test for using an invalid avatar image

Require use avatars to be valid images

Revert any avatar change if we fail to save the new image

Merge remote-tracking branch 'upstream/pull/7473'

Merge remote-tracking branch 'upstream/pull/7475'

Merge remote-tracking branch 'upstream/pull/7474'

Fixes #7472

Render way node refs from way_nodes instead of loading nodes

Given that we only need the node ids, we only need to preload the
way_nodes and use the ids from there.

Replace OSM.MapLibre.defaultHomeZoom with defaultHomeZoom

Fix crashes in mailers due to missing record

Merge pull request #7470 from tomhughes/prosopite-fixes

More N+1 query fixes

Fix N+1 queries in issues view

Fix N+1 queries in node/way/relation api views

Merge pull request #7466 from openstreetmap/translatewiki

Localisation updates from https://translatewiki.net.

Localisation updates from https://translatewiki.net.

Merge pull request #7465 from tomhughes/prosopite-fixes

Fix some N+1 queries

Fix N+1 queries with user block views

Fix N+1 queries with trace views

Fix N+1 queries in user blocks controller

Fix N+1 queries with moderation zones

Fix N+1 queries in messages controller

Merge remote-tracking branch 'upstream/pull/7459'

Merge remote-tracking branch 'upstream/pull/7458'

Merge pull request #7460 from tomhughes/validate-note-params

Validate status parameter to notes#index

Validate status parameter to notes#index

Fix N+1 queries for comment authors in the notes API

Preload the authors of note comments, and of the notes themselves for
the RSS feeds, when rendering notes from the API.

The tests now use notes with comments by at least three different
users, as prosopite doesn't always detect an N+1 query with only two
records - the first query in a process can have a different call stack
while the association's statement cache is built.

Detect N+1 queries in tests using prosopite

Each request handled by the tests (controllers, integration and system)
is scanned separately for N+1 queries using prosopite's rack middleware,
as is each job performed outside of a request. The test fails if any are found.

Jobs performed during a request aren't scanned, as their queries would
otherwise count towards the request's. That would make a request that triggers
three email notifications look like an N+1 query, whereas in reality each job
is performed separately.

Existing N+1 queries are allowed when any of the files listed in
test/prosopite_todo.yml are in the call stack. This means we can work
through that list, but avoid adding new N+1 queries in other parts of our code.

Merge remote-tracking branch 'upstream/pull/7456'

Merge pull request #7457 from tomhughes/json-3

Drop lock on json version now that rails supports json 3

Drop lock on json version now that rails supports json 3

Merge remote-tracking branch 'upstream/pull/7453'

Bump the dependencies group across 1 directory with 10 updates

Bumps the dependencies group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [activerecord-postgis](https://github.com/seuros/activerecord-postgis) | `0.6.0` | `0.6.1` |
| [actionpack-page_caching](https://github.com/rails/actionpack-page_caching) | `1.2.4` | `1.2.5` |
| [doorkeeper](https://github.com/doorkeeper-gem/doorkeeper) | `5.9.7` | `5.9.9` |
| [doorkeeper-openid_connect](https://github.com/doorkeeper-gem/doorkeeper-openid_connect) | `1.10.5` | `2.0.0` |
| [dalli](https://github.com/petergoldstein/dalli) | `5.1.0` | `5.1.1` |
| [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) | `1.232.1` | `1.232.2` |
| [herb](https://github.com/marcoroth/herb) | `0.10.4` | `0.11.0` |
| [database_consistency](https://github.com/djezzzl/database_consistency) | `3.0.12` | `3.0.13` |
| [aws-partitions](https://github.com/aws/aws-sdk-ruby) | `1.1289.0` | `1.1291.0` |
| [bindata](https://github.com/dmendel/bindata) | `3.0.0` | `3.0.1` |

Updates `activerecord-postgis` from 0.6.0 to 0.6.1
- [Release notes](https://github.com/seuros/activerecord-postgis/releases)
- [Changelog](https://github.com/seuros/activerecord-postgis/blob/master/CHANGELOG.md)
- [Commits](https://github.com/seuros/activerecord-postgis/compare/activerecord-postgis/v0.6.0...activerecord-postgis/v0.6.1)

Updates `actionpack-page_caching` from 1.2.4 to 1.2.5
- [Release notes](https://github.com/rails/actionpack-page_caching/releases)
- [Changelog](https://github.com/rails/actionpack-page_caching/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rails/actionpack-page_caching/compare/v1.2.4...v1.2.5)

Updates `doorkeeper` from 5.9.7 to 5.9.9
- [Release notes](https://github.com/doorkeeper-gem/doorkeeper/releases)
- [Changelog](https://github.com/doorkeeper-gem/doorkeeper/blob/main/CHANGELOG.md)
- [Commits](https://github.com/doorkeeper-gem/doorkeeper/compare/v5.9.7...v5.9.9)

Updates `doorkeeper-openid_connect` from 1.10.5 to 2.0.0
- [Release notes](https://github.com/doorkeeper-gem/doorkeeper-openid_connect/releases)
- [Changelog](https://github.com/doorkeeper-gem/doorkeeper-openid_connect/blob/master/CHANGELOG.md)
- [Commits](https://github.com/doorkeeper-gem/doorkeeper-openid_connect/compare/v1.10.5...v2.0.0)

Updates `dalli` from 5.1.0 to 5.1.1
- [Release notes](https://github.com/petergoldstein/dalli/releases)
- [Changelog](https://github.com/petergoldstein/dalli/blob/main/CHANGELOG.md)
- [Commits](https://github.com/petergoldstein/dalli/compare/v5.1.0...v5.1.1)

Updates `aws-sdk-s3` from 1.232.1 to 1.232.2
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Updates `herb` from 0.10.4 to 0.11.0
- [Release notes](https://github.com/marcoroth/herb/releases)
- [Commits](https://github.com/marcoroth/herb/compare/v0.10.4...v0.11.0)

Updates `database_consistency` from 3.0.12 to 3.0.13
- [Changelog](https://github.com/djezzzl/database_consistency/blob/master/CHANGELOG.md)
- [Commits](https://github.com/djezzzl/database_consistency/compare/v3.0.12...v3.0.13)

Updates `aws-partitions` from 1.1289.0 to 1.1291.0
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-partitions/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Updates `bindata` from 3.0.0 to 3.0.1
- [Changelog](https://github.com/dmendel/bindata/blob/master/ChangeLog.rdoc)
- [Commits](https://github.com/dmendel/bindata/compare/v3.0.0...v3.0.1)

---
updated-dependencies:
- dependency-name: actionpack-page_caching
  dependency-version: 1.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: activerecord-postgis
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: aws-partitions
  dependency-version: 1.1291.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: aws-sdk-s3
  dependency-version: 1.232.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: bindata
  dependency-version: 3.0.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: dalli
  dependency-version: 5.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: database_consistency
  dependency-version: 3.0.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: doorkeeper
  dependency-version: 5.9.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: doorkeeper-openid_connect
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: herb
  dependency-version: 0.11.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #7454 from tomhughes/doorkeeper-authorize

Complete authorization before doorkeeper sees the request

Merge pull request #7455 from openstreetmap/translatewiki

Localisation updates from https://translatewiki.net.

Replace SotM 2026 banner with 31 Day OSM Challenge

Localisation updates from https://translatewiki.net.

Complete authorization before doorkeeper sees the request

Merge remote-tracking branch 'upstream/pull/7444'

Bump rails from 8.1.3.1 to 8.1.4 in the rails group across 1 directory

Bumps the rails group with 1 update in the / directory: [rails](https://github.com/rails/rails).

Updates `rails` from 8.1.3.1 to 8.1.4
- [Release notes](https://github.com/rails/rails/releases)
- [Commits](https://github.com/rails/rails/compare/v8.1.3.1...v8.1.4)

---
updated-dependencies:
- dependency-name: rails
  dependency-version: 8.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rails
...

Signed-off-by: dependabot[bot] <support@github.com>

Update simplecov to 1.3.2 for rails 8.1.4 support

Merge pull request #7448 from tomhughes/old-tag-tests

Avoid trying to detach a record connected by a composite key

Merge pull request #7449 from tomhughes/dependabot-rails

Exclude all rails gems from the main dependabot group

Exclude all rails gems from the main dependabot group

Set attributes during record build where possible

Avoid persisting test records unecessarily

Merge pull request #7442 from tomhughes/email-restricted-chars

Prevent percent characters being used in email addresses

Merge remote-tracking branch 'upstream/pull/7447'

Bump brace-expansion from 5.0.8 to 5.0.12

Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 5.0.8 to 5.0.12.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v5.0.8...v5.0.12)

---
updated-dependencies:
- dependency-name: brace-expansion
dependency-version: 5.0.12
dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/7445'

Merge remote-tracking branch 'upstream/pull/7443'

Bump the dependencies group with 2 updates

Bumps the dependencies group with 2 updates: [tag2link](https://github.com/JOSM/tag2link) and [@herb-tools/linter](https://github.com/marcoroth/herb/tree/HEAD/javascript/packages/linter).

Updates `tag2link` from 2026.8.21 to 2026.9.21
- [Release notes](https://github.com/JOSM/tag2link/releases)
- [Commits](https://github.com/JOSM/tag2link/compare/2026.8.21...2026.9.21)

Updates `@herb-tools/linter` from 0.10.4 to 0.11.0
- [Release notes](https://github.com/marcoroth/herb/releases)
- [Commits](https://github.com/marcoroth/herb/commits/v0.11.0/javascript/packages/linter)

---
updated-dependencies:
- dependency-name: tag2link
  dependency-version: 2026.9.21
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@herb-tools/linter"
  dependency-version: 0.11.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump ruby/setup-ruby from 1.324.0 to 1.327.0 in the dependencies group

Bumps the dependencies group with 1 update: [ruby/setup-ruby](https://github.com/ruby/setup-ruby).

Updates `ruby/setup-ruby` from 1.324.0 to 1.327.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](https://github.com/ruby/setup-ruby/compare/a0102e0972be65f351c307e2d64b9314a57c8073...14594264cd68ce8a2345dd349bc3d138a4ef85c8)

---
updated-dependencies:
- dependency-name: ruby/setup-ruby
  dependency-version: 1.327.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Prevent percent characters being used in email addresses

Merge pull request #7425 from tomhughes/invalid-email

Validate the user record before trying to check the email

Test creating an account with an invalid email

Co-Authored-By: Tom Hughes <tom@compton.nu>

Validate the user record before trying to check the email

Rework the rate limiter API to improve test coverage

Co-Authored-By: Tom Hughes <tom@compton.nu>

Merge remote-tracking branch 'upstream/pull/7434'

Merge remote-tracking branch 'upstream/pull/7439'

Separate `current_user` from @user

Merge remote-tracking branch 'upstream/pull/7436'

Merge remote-tracking branch 'upstream/pull/7428'

rerun script/misc/update-wiki-pages

Merge pull request #7435 from openstreetmap/translatewiki

Localisation updates from https://translatewiki.net.

Localisation updates from https://translatewiki.net.

Don't break when a notification record goes missing

Isolate map markers below popups and controls

Merge pull request #7424 from tomhughes/validate-editor

Validate any explicitly requested editor name

Merge pull request #7423 from tomhughes/test-reverse-json

Test json responses to nominatim reverse searches

Merge remote-tracking branch 'upstream/pull/7426'

Keep auth provider logos styleable after SVG optimisation

Give the Apple and GitHub logo background/foreground svgo-stable bg/fg
classes and style those instead of rect/path, and drop the svg
width/height from apple, github and microsoft so their viewBox survives.

Validate any explicitly requested editor name