Merge remote-tracking branch 'upstream/pull/7459'

Merge remote-tracking branch 'upstream/pull/7458'

Merge pull request #7460 from tomhughes/validate-note-params

Validate status parameter to notes#index

Validate status parameter to notes#index

Fix N+1 queries for comment authors in the notes API

Preload the authors of note comments, and of the notes themselves for
the RSS feeds, when rendering notes from the API.

The tests now use notes with comments by at least three different
users, as prosopite doesn't always detect an N+1 query with only two
records - the first query in a process can have a different call stack
while the association's statement cache is built.

Detect N+1 queries in tests using prosopite

Each request handled by the tests (controllers, integration and system)
is scanned separately for N+1 queries using prosopite's rack middleware,
as is each job performed outside of a request. The test fails if any are found.

Jobs performed during a request aren't scanned, as their queries would
otherwise count towards the request's. That would make a request that triggers
three email notifications look like an N+1 query, whereas in reality each job
is performed separately.

Existing N+1 queries are allowed when any of the files listed in
test/prosopite_todo.yml are in the call stack. This means we can work
through that list, but avoid adding new N+1 queries in other parts of our code.

Merge remote-tracking branch 'upstream/pull/7456'

Merge pull request #7457 from tomhughes/json-3

Drop lock on json version now that rails supports json 3

Drop lock on json version now that rails supports json 3

Merge remote-tracking branch 'upstream/pull/7453'

Bump the dependencies group across 1 directory with 10 updates

Bumps the dependencies group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [activerecord-postgis](https://github.com/seuros/activerecord-postgis) | `0.6.0` | `0.6.1` |
| [actionpack-page_caching](https://github.com/rails/actionpack-page_caching) | `1.2.4` | `1.2.5` |
| [doorkeeper](https://github.com/doorkeeper-gem/doorkeeper) | `5.9.7` | `5.9.9` |
| [doorkeeper-openid_connect](https://github.com/doorkeeper-gem/doorkeeper-openid_connect) | `1.10.5` | `2.0.0` |
| [dalli](https://github.com/petergoldstein/dalli) | `5.1.0` | `5.1.1` |
| [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) | `1.232.1` | `1.232.2` |
| [herb](https://github.com/marcoroth/herb) | `0.10.4` | `0.11.0` |
| [database_consistency](https://github.com/djezzzl/database_consistency) | `3.0.12` | `3.0.13` |
| [aws-partitions](https://github.com/aws/aws-sdk-ruby) | `1.1289.0` | `1.1291.0` |
| [bindata](https://github.com/dmendel/bindata) | `3.0.0` | `3.0.1` |

Updates `activerecord-postgis` from 0.6.0 to 0.6.1
- [Release notes](https://github.com/seuros/activerecord-postgis/releases)
- [Changelog](https://github.com/seuros/activerecord-postgis/blob/master/CHANGELOG.md)
- [Commits](https://github.com/seuros/activerecord-postgis/compare/activerecord-postgis/v0.6.0...activerecord-postgis/v0.6.1)

Updates `actionpack-page_caching` from 1.2.4 to 1.2.5
- [Release notes](https://github.com/rails/actionpack-page_caching/releases)
- [Changelog](https://github.com/rails/actionpack-page_caching/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rails/actionpack-page_caching/compare/v1.2.4...v1.2.5)

Updates `doorkeeper` from 5.9.7 to 5.9.9
- [Release notes](https://github.com/doorkeeper-gem/doorkeeper/releases)
- [Changelog](https://github.com/doorkeeper-gem/doorkeeper/blob/main/CHANGELOG.md)
- [Commits](https://github.com/doorkeeper-gem/doorkeeper/compare/v5.9.7...v5.9.9)

Updates `doorkeeper-openid_connect` from 1.10.5 to 2.0.0
- [Release notes](https://github.com/doorkeeper-gem/doorkeeper-openid_connect/releases)
- [Changelog](https://github.com/doorkeeper-gem/doorkeeper-openid_connect/blob/master/CHANGELOG.md)
- [Commits](https://github.com/doorkeeper-gem/doorkeeper-openid_connect/compare/v1.10.5...v2.0.0)

Updates `dalli` from 5.1.0 to 5.1.1
- [Release notes](https://github.com/petergoldstein/dalli/releases)
- [Changelog](https://github.com/petergoldstein/dalli/blob/main/CHANGELOG.md)
- [Commits](https://github.com/petergoldstein/dalli/compare/v5.1.0...v5.1.1)

Updates `aws-sdk-s3` from 1.232.1 to 1.232.2
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Updates `herb` from 0.10.4 to 0.11.0
- [Release notes](https://github.com/marcoroth/herb/releases)
- [Commits](https://github.com/marcoroth/herb/compare/v0.10.4...v0.11.0)

Updates `database_consistency` from 3.0.12 to 3.0.13
- [Changelog](https://github.com/djezzzl/database_consistency/blob/master/CHANGELOG.md)
- [Commits](https://github.com/djezzzl/database_consistency/compare/v3.0.12...v3.0.13)

Updates `aws-partitions` from 1.1289.0 to 1.1291.0
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-partitions/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Updates `bindata` from 3.0.0 to 3.0.1
- [Changelog](https://github.com/dmendel/bindata/blob/master/ChangeLog.rdoc)
- [Commits](https://github.com/dmendel/bindata/compare/v3.0.0...v3.0.1)

---
updated-dependencies:
- dependency-name: actionpack-page_caching
  dependency-version: 1.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: activerecord-postgis
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: aws-partitions
  dependency-version: 1.1291.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: aws-sdk-s3
  dependency-version: 1.232.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: bindata
  dependency-version: 3.0.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: dalli
  dependency-version: 5.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: database_consistency
  dependency-version: 3.0.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: doorkeeper
  dependency-version: 5.9.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: doorkeeper-openid_connect
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: herb
  dependency-version: 0.11.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #7454 from tomhughes/doorkeeper-authorize

Complete authorization before doorkeeper sees the request

Merge pull request #7455 from openstreetmap/translatewiki

Localisation updates from https://translatewiki.net.

Replace SotM 2026 banner with 31 Day OSM Challenge

Localisation updates from https://translatewiki.net.

Complete authorization before doorkeeper sees the request

Merge remote-tracking branch 'upstream/pull/7444'

Bump rails from 8.1.3.1 to 8.1.4 in the rails group across 1 directory

Bumps the rails group with 1 update in the / directory: [rails](https://github.com/rails/rails).

Updates `rails` from 8.1.3.1 to 8.1.4
- [Release notes](https://github.com/rails/rails/releases)
- [Commits](https://github.com/rails/rails/compare/v8.1.3.1...v8.1.4)

---
updated-dependencies:
- dependency-name: rails
  dependency-version: 8.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rails
...

Signed-off-by: dependabot[bot] <support@github.com>

Update simplecov to 1.3.2 for rails 8.1.4 support

Merge pull request #7448 from tomhughes/old-tag-tests

Avoid trying to detach a record connected by a composite key

Merge pull request #7449 from tomhughes/dependabot-rails

Exclude all rails gems from the main dependabot group

Exclude all rails gems from the main dependabot group

Set attributes during record build where possible

Avoid persisting test records unecessarily

Merge pull request #7442 from tomhughes/email-restricted-chars

Prevent percent characters being used in email addresses

Merge remote-tracking branch 'upstream/pull/7447'

Bump brace-expansion from 5.0.8 to 5.0.12

Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 5.0.8 to 5.0.12.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v5.0.8...v5.0.12)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 5.0.12
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/7445'

Merge remote-tracking branch 'upstream/pull/7443'

Bump the dependencies group with 2 updates

Bumps the dependencies group with 2 updates: [tag2link](https://github.com/JOSM/tag2link) and [@herb-tools/linter](https://github.com/marcoroth/herb/tree/HEAD/javascript/packages/linter).

Updates `tag2link` from 2026.8.21 to 2026.9.21
- [Release notes](https://github.com/JOSM/tag2link/releases)
- [Commits](https://github.com/JOSM/tag2link/compare/2026.8.21...2026.9.21)

Updates `@herb-tools/linter` from 0.10.4 to 0.11.0
- [Release notes](https://github.com/marcoroth/herb/releases)
- [Commits](https://github.com/marcoroth/herb/commits/v0.11.0/javascript/packages/linter)

---
updated-dependencies:
- dependency-name: tag2link
  dependency-version: 2026.9.21
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@herb-tools/linter"
  dependency-version: 0.11.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump ruby/setup-ruby from 1.324.0 to 1.327.0 in the dependencies group

Bumps the dependencies group with 1 update: [ruby/setup-ruby](https://github.com/ruby/setup-ruby).

Updates `ruby/setup-ruby` from 1.324.0 to 1.327.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](https://github.com/ruby/setup-ruby/compare/a0102e0972be65f351c307e2d64b9314a57c8073...14594264cd68ce8a2345dd349bc3d138a4ef85c8)

---
updated-dependencies:
- dependency-name: ruby/setup-ruby
  dependency-version: 1.327.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Prevent percent characters being used in email addresses

Merge pull request #7425 from tomhughes/invalid-email

Validate the user record before trying to check the email

Test creating an account with an invalid email

Co-Authored-By: Tom Hughes <tom@compton.nu>

Validate the user record before trying to check the email

Rework the rate limiter API to improve test coverage

Co-Authored-By: Tom Hughes <tom@compton.nu>

Merge remote-tracking branch 'upstream/pull/7434'

Merge remote-tracking branch 'upstream/pull/7439'

Separate `current_user` from @user

Merge remote-tracking branch 'upstream/pull/7436'

Merge remote-tracking branch 'upstream/pull/7428'

rerun script/misc/update-wiki-pages

Merge pull request #7435 from openstreetmap/translatewiki

Localisation updates from https://translatewiki.net.

Localisation updates from https://translatewiki.net.

Don't break when a notification record goes missing

Merge pull request #7424 from tomhughes/validate-editor

Validate any explicitly requested editor name

Merge pull request #7423 from tomhughes/test-reverse-json

Test json responses to nominatim reverse searches

Merge remote-tracking branch 'upstream/pull/7426'

Keep auth provider logos styleable after SVG optimisation

Give the Apple and GitHub logo background/foreground svgo-stable bg/fg
classes and style those instead of rect/path, and drop the svg
width/height from apple, github and microsoft so their viewBox survives.

Validate any explicitly requested editor name

Test json responses to nominatim reverse searches

Merge remote-tracking branch 'upstream/pull/7416'

Merge remote-tracking branch 'upstream/pull/7410'

Merge pull request #7422 from openstreetmap/translatewiki

Localisation updates from https://translatewiki.net.

Localisation updates from https://translatewiki.net.

Avoid regexp not supported in old browsers

This comes after a user reported that the slippy map doesn't work on iOS 15,
which we have been able to reproduce with an old iPhone.

MapLibre's translation string keys are in CapitalisedCamelCase, as opposed to
our usual snake_case. This also conflicts with Leaflet's keys which are
also in snake_case. This creates a weird scenario where a translation key
is duplicated: `GeolocateControl` for MapLibre and `geolocate_control` for
leaflet.

The original translation strings can be seen at:
- https://github.com/maplibre/maplibre-gl-js/blob/8ebe6a085e934f1b136ead624a92abdf6399f7e2/src/ui/default_locale.ts
- https://github.com/domoritz/leaflet-locatecontrol/blob/a122fb1bfe1ad39d20382e1545eaa8cb367c48fd/src/L.Control.Locate.js

Update model annotations

Merge remote-tracking branch 'upstream/pull/7421'

Merge remote-tracking branch 'upstream/pull/7418'

Merge remote-tracking branch 'upstream/pull/7419'

Merge remote-tracking branch 'upstream/pull/7420'

Bump the dependencies group with 13 updates

Bumps the dependencies group with 13 updates:

| Package | From | To |
| --- | --- | --- |
| [faraday](https://github.com/lostisland/faraday) | `2.14.3` | `2.14.4` |
| [opentelemetry-sdk](https://github.com/open-telemetry/opentelemetry-ruby) | `1.13.0` | `1.13.1` |
| [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) | `1.232.0` | `1.232.1` |
| [unicode-display_width](https://github.com/janlelis/unicode-display_width) | `3.2.0` | `3.3.0` |
| [annotaterb](https://github.com/drwl/annotaterb) | `4.24.0` | `4.25.0` |
| [database_consistency](https://github.com/djezzzl/database_consistency) | `3.0.11` | `3.0.12` |
| [aws-partitions](https://github.com/aws/aws-sdk-ruby) | `1.1287.0` | `1.1289.0` |
| [faraday-http-cache](https://github.com/plataformatec/faraday-http-cache) | `2.7.0` | `2.8.0` |
| [io-console](https://github.com/ruby/io-console) | `0.9.3` | `0.9.4` |
| [net-protocol](https://github.com/ruby/net-protocol) | `0.3.0` | `0.4.0` |
| [opentelemetry-instrumentation-net_http](https://github.com/open-telemetry/opentelemetry-ruby-contrib) | `0.29.0` | `0.29.1` |
| [rubyzip](https://github.com/rubyzip/rubyzip) | `3.6.0` | `3.7.0` |
| [unicode-emoji](https://github.com/janlelis/unicode-emoji) | `4.2.0` | `4.3.0` |

Updates `faraday` from 2.14.3 to 2.14.4
- [Release notes](https://github.com/lostisland/faraday/releases)
- [Changelog](https://github.com/lostisland/faraday/blob/main/CHANGELOG.md)
- [Commits](https://github.com/lostisland/faraday/compare/v2.14.3...v2.14.4)

Updates `opentelemetry-sdk` from 1.13.0 to 1.13.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-ruby/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-ruby/compare/opentelemetry-sdk/v1.13.0...opentelemetry-sdk/v1.13.1)

Updates `aws-sdk-s3` from 1.232.0 to 1.232.1
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Updates `unicode-display_width` from 3.2.0 to 3.3.0
- [Changelog](https://github.com/janlelis/unicode-display_width/blob/main/CHANGELOG.md)
- [Commits](https://github.com/janlelis/unicode-display_width/compare/v3.2.0...v3.3.0)

Updates `annotaterb` from 4.24.0 to 4.25.0
- [Changelog](https://github.com/drwl/annotaterb/blob/main/CHANGELOG.md)
- [Commits](https://github.com/drwl/annotaterb/compare/v4.24.0...v4.25.0)

Updates `database_consistency` from 3.0.11 to 3.0.12
- [Changelog](https://github.com/djezzzl/database_consistency/blob/master/CHANGELOG.md)
- [Commits](https://github.com/djezzzl/database_consistency/compare/v3.0.11...v3.0.12)

Updates `aws-partitions` from 1.1287.0 to 1.1289.0
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-partitions/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Updates `faraday-http-cache` from 2.7.0 to 2.8.0
- [Release notes](https://github.com/plataformatec/faraday-http-cache/releases)
- [Changelog](https://github.com/sourcelevel/faraday-http-cache/blob/master/CHANGELOG.md)
- [Commits](https://github.com/plataformatec/faraday-http-cache/compare/v2.7.0...v2.8.0)

Updates `io-console` from 0.9.3 to 0.9.4
- [Release notes](https://github.com/ruby/io-console/releases)
- [Commits](https://github.com/ruby/io-console/compare/v0.9.3...v0.9.4)

Updates `net-protocol` from 0.3.0 to 0.4.0
- [Release notes](https://github.com/ruby/net-protocol/releases)
- [Commits](https://github.com/ruby/net-protocol/compare/v0.3.0...v0.4.0)

Updates `opentelemetry-instrumentation-net_http` from 0.29.0 to 0.29.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-ruby-contrib/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-ruby-contrib/compare/opentelemetry-instrumentation-net_http/v0.29.0...opentelemetry-instrumentation-net_http/v0.29.1)

Updates `rubyzip` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/rubyzip/rubyzip/releases)
- [Changelog](https://github.com/rubyzip/rubyzip/blob/main/Changelog.md)
- [Commits](https://github.com/rubyzip/rubyzip/compare/v3.6.0...v3.7.0)

Updates `unicode-emoji` from 4.2.0 to 4.3.0
- [Changelog](https://github.com/janlelis/unicode-emoji/blob/main/CHANGELOG.md)
- [Commits](https://github.com/janlelis/unicode-emoji/compare/v4.2.0...v4.3.0)

---
updated-dependencies:
- dependency-name: faraday
  dependency-version: 2.14.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: opentelemetry-sdk
  dependency-version: 1.13.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: aws-sdk-s3
  dependency-version: 1.232.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: unicode-display_width
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: annotaterb
  dependency-version: 4.25.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: database_consistency
  dependency-version: 3.0.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: aws-partitions
  dependency-version: 1.1289.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: faraday-http-cache
  dependency-version: 2.8.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io-console
  dependency-version: 0.9.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: net-protocol
  dependency-version: 0.4.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: opentelemetry-instrumentation-net_http
  dependency-version: 0.29.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: rubyzip
  dependency-version: 3.7.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: unicode-emoji
  dependency-version: 4.3.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump the dependencies group with 2 updates

Bumps the dependencies group with 2 updates: [terra-draw](https://github.com/JamesLMilner/terra-draw) and [eslint](https://github.com/eslint/eslint).

Updates `terra-draw` from 1.33.0 to 1.35.0
- [Release notes](https://github.com/JamesLMilner/terra-draw/releases)
- [Changelog](https://github.com/JamesLMilner/terra-draw/blob/main/release.js)
- [Commits](https://github.com/JamesLMilner/terra-draw/compare/terra-draw@1.33.0...terra-draw@1.35.0)

Updates `eslint` from 10.10.0 to 10.11.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v10.10.0...v10.11.0)

---
updated-dependencies:
- dependency-name: terra-draw
  dependency-version: 1.35.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: eslint
  dependency-version: 10.11.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump rubocop-rails from 2.37.0 to 2.38.0 in the rubocop group

Bumps the rubocop group with 1 update: [rubocop-rails](https://github.com/rubocop/rubocop-rails).

Updates `rubocop-rails` from 2.37.0 to 2.38.0
- [Release notes](https://github.com/rubocop/rubocop-rails/releases)
- [Changelog](https://github.com/rubocop/rubocop-rails/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop-rails/compare/v2.37.0...v2.38.0)

---
updated-dependencies:
- dependency-name: rubocop-rails
  dependency-version: 2.38.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: rubocop
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump ruby/setup-ruby from 1.321.0 to 1.324.0 in the dependencies group

Bumps the dependencies group with 1 update: [ruby/setup-ruby](https://github.com/ruby/setup-ruby).

Updates `ruby/setup-ruby` from 1.321.0 to 1.324.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](https://github.com/ruby/setup-ruby/compare/95ef2b042f9d7a56d8268cba8559e2842e2ad01b...a0102e0972be65f351c307e2d64b9314a57c8073)

---
updated-dependencies:
- dependency-name: ruby/setup-ruby
  dependency-version: 1.324.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/7413'

Validate the bbox parameters when exporting

A missing parameter raised OSM::APIBadUserInput, which isn't handled
by web controllers and so resulted in a 500 error, and a non-numeric
one was silently treated as zero. Validate them with param! instead
so that both get a bad request response.

Return a JSON error when reverse geocoding fails for a JSON request

There is no JSON error template, so a nominatim error resulted in a
missing template exception. Return the error as JSON instead, and
ignore error responses when setting the home location name so that
the existing name is kept.

Merge remote-tracking branch 'upstream/pull/7414'

Render reverse geocoding results once, after all have been collected

The respond_to block was inside the loop, so nothing was
rendered when nominatim found no results. JSON requests then got a 406
error, and the home location name wasn't cleared when choosing a
location that has no name.

Fix typo in lrbt bbox check

This didn't have any negative effects, since API::NotesController#index
also checks these params and there's no typo there.

Validate the bbox parameter when listing changesets

An invalid bbox raised OSM::APIBadUserInput, which isn't handled by
web controllers and so resulted in a 500 error. Validate it with
param! instead so that it gets a bad request response.

Merge remote-tracking branch 'upstream/pull/7412'

Merge pull request #7399 from tomhughes/bad-compression

Convert gzip decoding errors to a bad request error

Disable live asset compilation in production

The Rails 8.0 update dropped config.assets.compile = false, as the
new framework template assumes Propshaft. This left sprockets-rails
defaulting to compiling assets on demand in production, and requests
for /assets/ raise Sprockets::FileOutsidePaths, giving a 500 error.

Convert zlib decoding errors to a bad request error

Merge pull request #7397 from tomhughes/search-format

Stop search calls with a format parameter throwing an error

Merge pull request #7398 from tomhughes/sentry-data

Send request parameter to any configured sentry endpoint

Send request parameters to any configured sentry endpoint

Remove no-longer used xhr parameter from tests

Stop search calls with a format parameter throwing an error

Merge pull request #7403 from tomhughes/docker

Use Debian 13 for docker

Use Debian 13 for docker

Merge remote-tracking branch 'upstream/pull/7406'

Localisation updates from https://translatewiki.net.

Merge pull request #7400 from tomhughes/sentry-delayed-job

Use custom DelayedJob sentry integration

Use custom DelayedJob sentry integration

Merge remote-tracking branch 'upstream/pull/7391'

Merge remote-tracking branch 'upstream/pull/7395'

Merge pull request #7393 from openstreetmap/dependabot/bundler/rubocop-70ebabdb35

Bump rubocop from 1.90.0 to 1.91.0 in the rubocop group

Merge pull request #7394 from openstreetmap/dependabot/npm_and_yarn/dependencies-45d869f03e

Bump @herb-tools/linter from 0.10.3 to 0.10.4 in the dependencies group

Merge pull request #7396 from openstreetmap/translatewiki

Localisation updates from https://translatewiki.net.

Localisation updates from https://translatewiki.net.

Bump the dependencies group with 19 updates

Bumps the dependencies group with 19 updates:

| Package | From | To |
| --- | --- | --- |
| [doorkeeper](https://github.com/doorkeeper-gem/doorkeeper) | `5.9.6` | `5.9.7` |
| [opentelemetry-exporter-otlp](https://github.com/open-telemetry/opentelemetry-ruby) | `0.35.1` | `0.36.0` |
| [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) | `1.229.0` | `1.232.0` |
| [herb](https://github.com/marcoroth/herb) | `0.10.3` | `0.10.4` |
| [selenium-webdriver](https://github.com/SeleniumHQ/selenium) | `4.48.0` | `4.49.0` |
| [simplecov](https://github.com/simplecov-ruby/simplecov) | `1.2.0` | `1.3.0` |
| [aws-partitions](https://github.com/aws/aws-sdk-ruby) | `1.1284.0` | `1.1287.0` |
| [aws-sdk-core](https://github.com/aws/aws-sdk-ruby) | `3.254.1` | `3.257.0` |
| [aws-sdk-kms](https://github.com/aws/aws-sdk-ruby) | `1.130.0` | `1.132.0` |
| [bigdecimal](https://github.com/ruby/bigdecimal) | `4.1.2` | `4.1.3` |
| [git](https://github.com/ruby-git/ruby-git) | `5.4.1` | `5.6.0` |
| [io-console](https://github.com/ruby/io-console) | `0.9.2` | `0.9.3` |
| [msgpack](https://github.com/msgpack/msgpack-ruby) | `1.8.4` | `1.8.5` |
| [net-imap](https://github.com/ruby/net-imap) | `0.6.6` | `0.6.7` |
| [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-ruby) | `1.11.0` | `1.11.1` |
| [opentelemetry-instrumentation-grpc](https://github.com/open-telemetry/opentelemetry-ruby-contrib) | `0.5.2` | `0.5.3` |
| [opentelemetry-instrumentation-gruf](https://github.com/open-telemetry/opentelemetry-ruby-contrib) | `0.6.2` | `0.6.3` |
| [opentelemetry-instrumentation-http_client](https://github.com/open-telemetry/opentelemetry-ruby-contrib) | `0.29.0` | `0.29.1` |
| [opentelemetry-instrumentation-lmdb](https://github.com/open-telemetry/opentelemetry-ruby-contrib) | `0.26.0` | `0.26.1` |

Updates `doorkeeper` from 5.9.6 to 5.9.7
- [Release notes](https://github.com/doorkeeper-gem/doorkeeper/releases)
- [Changelog](https://github.com/doorkeeper-gem/doorkeeper/blob/main/CHANGELOG.md)
- [Commits](https://github.com/doorkeeper-gem/doorkeeper/compare/v5.9.6...v5.9.7)

Updates `opentelemetry-exporter-otlp` from 0.35.1 to 0.36.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-ruby/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-ruby/compare/opentelemetry-exporter-otlp/v0.35.1...opentelemetry-exporter-otlp/v0.36.0)

Updates `aws-sdk-s3` from 1.229.0 to 1.232.0
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Updates `herb` from 0.10.3 to 0.10.4
- [Release notes](https://github.com/marcoroth/herb/releases)
- [Commits](https://github.com/marcoroth/herb/compare/v0.10.3...v0.10.4)

Updates `selenium-webdriver` from 4.48.0 to 4.49.0
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Changelog](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES)
- [Commits](https://github.com/SeleniumHQ/selenium/compare/selenium-4.48.0...selenium-4.49.0)

Updates `simplecov` from 1.2.0 to 1.3.0
- [Release notes](https://github.com/simplecov-ruby/simplecov/releases)
- [Changelog](https://github.com/simplecov-ruby/simplecov/blob/main/CHANGELOG.md)
- [Commits](https://github.com/simplecov-ruby/simplecov/compare/v1.2.0...v1.3.0)

Updates `aws-partitions` from 1.1284.0 to 1.1287.0
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-partitions/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Updates `aws-sdk-core` from 3.254.1 to 3.257.0
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-core/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Updates `aws-sdk-kms` from 1.130.0 to 1.132.0
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-kms/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Updates `bigdecimal` from 4.1.2 to 4.1.3
- [Release notes](https://github.com/ruby/bigdecimal/releases)
- [Changelog](https://github.com/ruby/bigdecimal/blob/master/CHANGES.md)
- [Commits](https://github.com/ruby/bigdecimal/compare/v4.1.2...v4.1.3)

Updates `git` from 5.4.1 to 5.6.0
- [Release notes](https://github.com/ruby-git/ruby-git/releases)
- [Changelog](https://github.com/ruby-git/ruby-git/blob/v5.6.0/CHANGELOG.md)
- [Commits](https://github.com/ruby-git/ruby-git/compare/v5.4.1...v5.6.0)

Updates `io-console` from 0.9.2 to 0.9.3
- [Release notes](https://github.com/ruby/io-console/releases)
- [Commits](https://github.com/ruby/io-console/compare/v0.9.2...v0.9.3)

Updates `msgpack` from 1.8.4 to 1.8.5
- [Changelog](https://github.com/msgpack/msgpack-ruby/blob/master/ChangeLog)
- [Commits](https://github.com/msgpack/msgpack-ruby/compare/v1.8.4...v1.8.5)

Updates `net-imap` from 0.6.6 to 0.6.7
- [Release notes](https://github.com/ruby/net-imap/releases)
- [Commits](https://github.com/ruby/net-imap/compare/v0.6.6...v0.6.7)

Updates `opentelemetry-api` from 1.11.0 to 1.11.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-ruby/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-ruby/compare/opentelemetry-api/v1.11.0...opentelemetry-api/v1.11.1)

Updates `opentelemetry-instrumentation-grpc` from 0.5.2 to 0.5.3
- [Release notes](https://github.com/open-telemetry/opentelemetry-ruby-contrib/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-ruby-contrib/compare/opentelemetry-instrumentation-grpc/v0.5.2...opentelemetry-instrumentation-grpc/v0.5.3)

Updates `opentelemetry-instrumentation-gruf` from 0.6.2 to 0.6.3
- [Release notes](https://github.com/open-telemetry/opentelemetry-ruby-contrib/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-ruby-contrib/compare/opentelemetry-instrumentation-gruf/v0.6.2...opentelemetry-instrumentation-gruf/v0.6.3)

Updates `opentelemetry-instrumentation-http_client` from 0.29.0 to 0.29.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-ruby-contrib/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-ruby-contrib/compare/opentelemetry-instrumentation-http_client/v0.29.0...opentelemetry-instrumentation-http_client/v0.29.1)

Updates `opentelemetry-instrumentation-lmdb` from 0.26.0 to 0.26.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-ruby-contrib/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-ruby-contrib/compare/opentelemetry-instrumentation-lmdb/v0.26.0...opentelemetry-instrumentation-lmdb/v0.26.1)

---
updated-dependencies:
- dependency-name: doorkeeper
  dependency-version: 5.9.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: opentelemetry-exporter-otlp
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: aws-sdk-s3
  dependency-version: 1.232.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: herb
  dependency-version: 0.10.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: selenium-webdriver
  dependency-version: 4.49.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: simplecov
  dependency-version: 1.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: aws-partitions
  dependency-version: 1.1287.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: aws-sdk-core
  dependency-version: 3.257.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: aws-sdk-kms
  dependency-version: 1.132.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: bigdecimal
  dependency-version: 4.1.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: git
  dependency-version: 5.6.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io-console
  dependency-version: 0.9.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: msgpack
  dependency-version: 1.8.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: net-imap
  dependency-version: 0.6.7
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: opentelemetry-api
  dependency-version: 1.11.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: opentelemetry-instrumentation-grpc
  dependency-version: 0.5.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: opentelemetry-instrumentation-gruf
  dependency-version: 0.6.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: opentelemetry-instrumentation-http_client
  dependency-version: 0.29.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: opentelemetry-instrumentation-lmdb
  dependency-version: 0.26.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump @herb-tools/linter from 0.10.3 to 0.10.4 in the dependencies group

Bumps the dependencies group with 1 update: [@herb-tools/linter](https://github.com/marcoroth/herb/tree/HEAD/javascript/packages/linter).

Updates `@herb-tools/linter` from 0.10.3 to 0.10.4
- [Release notes](https://github.com/marcoroth/herb/releases)
- [Commits](https://github.com/marcoroth/herb/commits/v0.10.4/javascript/packages/linter)

---
updated-dependencies:
- dependency-name: "@herb-tools/linter"
  dependency-version: 0.10.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump rubocop from 1.90.0 to 1.91.0 in the rubocop group

Bumps the rubocop group with 1 update: [rubocop](https://github.com/rubocop/rubocop).

Updates `rubocop` from 1.90.0 to 1.91.0
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop/compare/v1.90.0...v1.91.0)

---
updated-dependencies:
- dependency-name: rubocop
  dependency-version: 1.91.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: rubocop
...

Signed-off-by: dependabot[bot] <support@github.com>

Add trailing slashes to directories in robots.txt

The standard specifies that /path/ matches anything
under it, but does not specify /path as matching
anything other than exactly it.

Merge remote-tracking branch 'upstream/pull/7349'

Merge remote-tracking branch 'upstream/pull/7351'

Merge pull request #7382 from tomhughes/no-links

Fix some exceptions in user profile updates