Merge remote-tracking branch 'upstream/pull/7060'

Merge remote-tracking branch 'upstream/pull/7059'

Fix GPX import mailers, which expected different tag objects

Embrace bug, which will be future behaviour

Merge remote-tracking branch 'upstream/pull/7057'

Bump net-imap from 0.6.3 to 0.6.4

Bumps [net-imap](https://github.com/ruby/net-imap) from 0.6.3 to 0.6.4.
- [Release notes](https://github.com/ruby/net-imap/releases)
- [Commits](https://github.com/ruby/net-imap/compare/v0.6.3...v0.6.4)

---
updated-dependencies:
- dependency-name: net-imap
  dependency-version: 0.6.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/7053'

Merge remote-tracking branch 'upstream/pull/7056'

Add kw to UI languages

Localisation updates from https://translatewiki.net.

Move hash and title sync logic from iframe to parent

Merge remote-tracking branch 'upstream/pull/6713'

Merge pull request #7055 from lonvia/patch-1

Fix link to FAQ

fix link to FAQ

Cache social link platform and name at save time (#6950)

Cache rendered HTML fragment for social links using Rails.cache.fetch
instead of re-parsing URLs on every page load. This avoids repeated
regex matching and HTTP calls to resolve platform metadata.

Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>

Merge pull request #7048 from tomhughes/md5-passwords

Drop support for legacy MD5 passwords

Block creation of notes within moderation zones

Add table+model to store geoblock zones

Add PostGIS adapter for ActiveRecord

Enable PostGIS

Drop support for MD5 legacy passwords

Remove support for validating MD5 passwords and migrate any such
passwords in the database to an invalid password.

Reported-by: Jorge Gonzalez Milla <jorge@jmilla.es>

Redirect users with invalid password to the reset flow

Test login error cases for sessions controller

Drop unused require of securerandom

Merge remote-tracking branch 'upstream/pull/7051'

Merge pull request #7052 from openstreetmap/translatewiki

Localisation updates from https://translatewiki.net.

Localisation updates from https://translatewiki.net.

Merge pull request #7049 from openstreetmap/dependabot/github_actions/dependencies-4a0b9de8bd

Bump ruby/setup-ruby from 1.305.0 to 1.306.0 in the dependencies group

Merge pull request #7050 from openstreetmap/dependabot/npm_and_yarn/dependencies-e2ab990367

Bump @herb-tools/linter from 0.9.7 to 0.10.1 in the dependencies group

Bump the dependencies group with 6 updates

Bumps the dependencies group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [bootsnap](https://github.com/rails/bootsnap) | `1.23.0` | `1.24.1` |
| [strong_migrations](https://github.com/ankane/strong_migrations) | `2.6.0` | `2.7.0` |
| [opentelemetry-instrumentation-all](https://github.com/open-telemetry/opentelemetry-ruby-contrib) | `0.92.0` | `0.93.0` |
| [herb](https://github.com/marcoroth/herb) | `0.9.7` | `0.10.1` |
| [puma](https://github.com/puma/puma) | `8.0.0` | `8.0.1` |
| [database_consistency](https://github.com/djezzzl/database_consistency) | `3.0.3` | `3.0.4` |

Updates `bootsnap` from 1.23.0 to 1.24.1
- [Release notes](https://github.com/rails/bootsnap/releases)
- [Changelog](https://github.com/rails/bootsnap/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rails/bootsnap/compare/v1.23.0...v1.24.1)

Updates `strong_migrations` from 2.6.0 to 2.7.0
- [Changelog](https://github.com/ankane/strong_migrations/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ankane/strong_migrations/compare/v2.6.0...v2.7.0)

Updates `opentelemetry-instrumentation-all` from 0.92.0 to 0.93.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-ruby-contrib/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-ruby-contrib/compare/opentelemetry-instrumentation-all/v0.92.0...opentelemetry-instrumentation-all/v0.93.0)

Updates `herb` from 0.9.7 to 0.10.1
- [Release notes](https://github.com/marcoroth/herb/releases)
- [Commits](https://github.com/marcoroth/herb/compare/v0.9.7...v0.10.1)

Updates `puma` from 8.0.0 to 8.0.1
- [Release notes](https://github.com/puma/puma/releases)
- [Changelog](https://github.com/puma/puma/blob/main/History.md)
- [Commits](https://github.com/puma/puma/compare/v8.0.0...v8.0.1)

Updates `database_consistency` from 3.0.3 to 3.0.4
- [Changelog](https://github.com/djezzzl/database_consistency/blob/master/CHANGELOG.md)
- [Commits](https://github.com/djezzzl/database_consistency/compare/v3.0.3...v3.0.4)

---
updated-dependencies:
- dependency-name: bootsnap
  dependency-version: 1.24.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: strong_migrations
  dependency-version: 2.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: opentelemetry-instrumentation-all
  dependency-version: 0.93.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: herb
  dependency-version: 0.10.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: puma
  dependency-version: 8.0.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: database_consistency
  dependency-version: 3.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump @herb-tools/linter from 0.9.7 to 0.10.1 in the dependencies group

Bumps the dependencies group with 1 update: [@herb-tools/linter](https://github.com/marcoroth/herb/tree/HEAD/javascript/packages/linter).

Updates `@herb-tools/linter` from 0.9.7 to 0.10.1
- [Release notes](https://github.com/marcoroth/herb/releases)
- [Commits](https://github.com/marcoroth/herb/commits/v0.10.1/javascript/packages/linter)

---
updated-dependencies:
- dependency-name: "@herb-tools/linter"
  dependency-version: 0.10.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump ruby/setup-ruby from 1.305.0 to 1.306.0 in the dependencies group

Bumps the dependencies group with 1 update: [ruby/setup-ruby](https://github.com/ruby/setup-ruby).

Updates `ruby/setup-ruby` from 1.305.0 to 1.306.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](https://github.com/ruby/setup-ruby/compare/0cb964fd540e0a24c900370abf38a33466142735...c4e5b1316158f92e3d49443a9d58b31d25ac0f8f)

---
updated-dependencies:
- dependency-name: ruby/setup-ruby
  dependency-version: 1.306.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #7039 from CommanderStorm/coordinate-transfer-system

Refactor more of the internal coordiante usage to `{ lat, lng }`

Merge pull request #7047 from tomhughes/message-rate-limit

Include deleted messages when checking the rate limit

Merge pull request #7046 from tomhughes/object-src

Block object-src in security policy

Merge pull request #7045 from tomhughes/totp-cookie

Set secure and httponly attributes for TOTP cookie

Merge remote-tracking branch 'upstream/pull/7043'

Include deleted messages when checking the rate limit

Reported-by: Jorge Gonzalez Milla <jorge@jmilla.es>

Block object-src in security policy

This is ancient history from when we had a flash based editor
though I'm not sure this rule was really needed even then.

Reported-by: Jorge Gonzalez Milla <jorge@jmilla.es>

Set secure and httponly attributes for TOTP cookie

Reported-by: Jorge Gonzalez Milla <jorge@jmilla.es>

Merge pull request #7036 from tomhughes/bundler4

Update bundler to v4

Reuse 0s and 1s for arm textures

Expand text gradient mask

Merge remote-tracking branch 'upstream/pull/7042'

Merge remote-tracking branch 'upstream/pull/7041'

Fix string that was not translatable

Fix string that was not translatable

Merge pull request #7040 from openstreetmap/translatewiki

Localisation updates from https://translatewiki.net.

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/7033'

Remove dead css

Signed-off-by: Frank Elsinga <frank@elsinga.de>

fix inconsistent method capitalisation

Signed-off-by: Frank Elsinga <frank@elsinga.de>

Migrate to lat, lng coords

Signed-off-by: Frank Elsinga <frank@elsinga.de>

Merge remote-tracking branch 'upstream/pull/7035'

Update bundler to v4

Merge remote-tracking branch 'upstream/pull/7009'

Merge remote-tracking branch 'upstream/pull/7002'

Bump postcss from 8.5.6 to 8.5.10

Bumps [postcss](https://github.com/postcss/postcss) from 8.5.6 to 8.5.10.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/8.5.6...8.5.10)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.10
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/7032'

Merge remote-tracking branch 'upstream/pull/7034'

Bump erb from 6.0.2 to 6.0.4

Bumps [erb](https://github.com/ruby/erb) from 6.0.2 to 6.0.4.
- [Release notes](https://github.com/ruby/erb/releases)
- [Changelog](https://github.com/ruby/erb/blob/master/NEWS.md)
- [Commits](https://github.com/ruby/erb/compare/v6.0.2...v6.0.4)

---
updated-dependencies:
- dependency-name: erb
  dependency-version: 6.0.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #7017 from lonvia/entrances-for-routing

Take entrances into account for routing start and end points

take entrances into account for routing start and end points

Merge pull request #7031 from openstreetmap/dependabot/npm_and_yarn/dependencies-53e8d04f7f

Bump maplibre-gl from 5.23.0 to 5.24.0 in the dependencies group

Bump the dependencies group with 2 updates

Bumps the dependencies group with 2 updates: [dalli](https://github.com/petergoldstein/dalli) and [opentelemetry-instrumentation-all](https://github.com/open-telemetry/opentelemetry-ruby-contrib).

Updates `dalli` from 4.3.3 to 5.0.2
- [Changelog](https://github.com/petergoldstein/dalli/blob/main/CHANGELOG.md)
- [Commits](https://github.com/petergoldstein/dalli/compare/v4.3.3...v5.0.2)

Updates `opentelemetry-instrumentation-all` from 0.91.0 to 0.92.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-ruby-contrib/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-ruby-contrib/compare/opentelemetry-instrumentation-all/v0.91.0...opentelemetry-instrumentation-all/v0.92.0)

---
updated-dependencies:
- dependency-name: dalli
  dependency-version: 5.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: opentelemetry-instrumentation-all
  dependency-version: 0.92.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump maplibre-gl from 5.23.0 to 5.24.0 in the dependencies group

Bumps the dependencies group with 1 update: [maplibre-gl](https://github.com/maplibre/maplibre-gl-js).

Updates `maplibre-gl` from 5.23.0 to 5.24.0
- [Release notes](https://github.com/maplibre/maplibre-gl-js/releases)
- [Changelog](https://github.com/maplibre/maplibre-gl-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/maplibre/maplibre-gl-js/compare/v5.23.0...v5.24.0)

---
updated-dependencies:
- dependency-name: maplibre-gl
  dependency-version: 5.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #6994 from tomhughes/ruby33

Move minium ruby version to 3.3

Update bundle

Move minimum ruby version to 3.3

Merge remote-tracking branch 'upstream/pull/6939'

Use Noticed to deliver notifications on GPX import failure

The previous code relied on `#deliver` (alias for `#deliver_now`) to
immediately deliver the email so that the trace could be deleted. To
work around this, we pass the details of the trace instead of the trace
record, which won't be available by the time the notifications are
ultimately delivered.

This means the trace is not there to be the `record`, so we are not
passing one. Since we can't get the recipient from the non-existing
record, we give the recipient explicitly to `#deliver_later`.

Additionally, the mailer method now needs to receive the recipient
directly, instead of extracting it from the trace record.

Use Noticed to deliver notifications on GPX import success

The mailer method now needs to receive the recipient directly, instead
of extracting it from the trace record.

Merge remote-tracking branch 'upstream/pull/7029'

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/7026'

Merge remote-tracking branch 'upstream/pull/7025'

Merge remote-tracking branch 'upstream/pull/7024'

Bump the dependencies group with 5 updates

Bumps the dependencies group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [mini_racer](https://github.com/discourse/mini_racer) | `0.20.0` | `0.21.0` |
| [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) | `1.219.0` | `1.220.0` |
| [herb](https://github.com/marcoroth/herb) | `0.9.6` | `0.9.7` |
| [minitest](https://github.com/minitest/minitest) | `6.0.4` | `6.0.5` |
| [database_consistency](https://github.com/djezzzl/database_consistency) | `3.0.2` | `3.0.3` |

Updates `mini_racer` from 0.20.0 to 0.21.0
- [Changelog](https://github.com/rubyjs/mini_racer/blob/main/CHANGELOG)
- [Commits](https://github.com/discourse/mini_racer/compare/v0.20.0...v0.21.0)

Updates `aws-sdk-s3` from 1.219.0 to 1.220.0
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Updates `herb` from 0.9.6 to 0.9.7
- [Release notes](https://github.com/marcoroth/herb/releases)
- [Commits](https://github.com/marcoroth/herb/compare/v0.9.6...v0.9.7)

Updates `minitest` from 6.0.4 to 6.0.5
- [Changelog](https://github.com/minitest/minitest/blob/master/History.rdoc)
- [Commits](https://github.com/minitest/minitest/compare/v6.0.4...v6.0.5)

Updates `database_consistency` from 3.0.2 to 3.0.3
- [Changelog](https://github.com/djezzzl/database_consistency/blob/master/CHANGELOG.md)
- [Commits](https://github.com/djezzzl/database_consistency/compare/v3.0.2...v3.0.3)

---
updated-dependencies:
- dependency-name: mini_racer
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: aws-sdk-s3
  dependency-version: 1.220.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: herb
  dependency-version: 0.9.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: minitest
  dependency-version: 6.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: database_consistency
  dependency-version: 3.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump the dependencies group with 2 updates

Bumps the dependencies group with 2 updates: [@herb-tools/linter](https://github.com/marcoroth/herb/tree/HEAD/javascript/packages/linter) and [eslint](https://github.com/eslint/eslint).

Updates `@herb-tools/linter` from 0.9.6 to 0.9.7
- [Release notes](https://github.com/marcoroth/herb/releases)
- [Commits](https://github.com/marcoroth/herb/commits/v0.9.7/javascript/packages/linter)

Updates `eslint` from 10.2.0 to 10.2.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v10.2.0...v10.2.1)

---
updated-dependencies:
- dependency-name: "@herb-tools/linter"
  dependency-version: 0.9.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: eslint
  dependency-version: 10.2.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump the dependencies group with 3 updates

Bumps the dependencies group with 3 updates: [ruby/setup-ruby](https://github.com/ruby/setup-ruby), [devcontainers/ci](https://github.com/devcontainers/ci) and [actions/setup-node](https://github.com/actions/setup-node).

Updates `ruby/setup-ruby` from 1.302.0 to 1.305.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](https://github.com/ruby/setup-ruby/compare/7372622e62b60b3cb750dcd2b9e32c247ffec26a...0cb964fd540e0a24c900370abf38a33466142735)

Updates `devcontainers/ci` from 0.3.1900000417 to 0.3.1900000449
- [Release notes](https://github.com/devcontainers/ci/releases)
- [Commits](https://github.com/devcontainers/ci/compare/8bf61b26e9c3a98f69cb6ce2f88d24ff59b785c6...b63b30de439b47a52267f241112c5b453b673db5)

Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/53b83947a5a98c8d113130e565377fae1a50d02f...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e)

---
updated-dependencies:
- dependency-name: ruby/setup-ruby
  dependency-version: 1.305.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: devcontainers/ci
  dependency-version: 0.3.1900000449
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: actions/setup-node
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/7022'

Merge remote-tracking branch 'upstream/pull/7021'

Add color scheme ranking logic

Merge pull request #7020 from openstreetmap/translatewiki

Localisation updates from https://translatewiki.net.

use admin_level from extratags when classifying Nominatim search results

Localisation updates from https://translatewiki.net.

Update bundle

to include the new revision of toy/image_optim#224

Merge remote-tracking branch 'upstream/pull/7012'

Merge remote-tracking branch 'upstream/pull/7006'

Merge remote-tracking branch 'upstream/pull/7015'

Bump protocol-buffers-schema from 3.6.0 to 3.6.1

Bumps [protocol-buffers-schema](https://github.com/mafintosh/protocol-buffers-schema) from 3.6.0 to 3.6.1.
- [Commits](https://github.com/mafintosh/protocol-buffers-schema/compare/v3.6.0...v3.6.1)

---
updated-dependencies:
- dependency-name: protocol-buffers-schema
  dependency-version: 3.6.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Update OSMF links to canonical URLs

Merge remote-tracking branch 'upstream/pull/7011'

Bump the dependencies group with 3 updates

Bumps the dependencies group with 3 updates: [herb](https://github.com/marcoroth/herb), [minitest](https://github.com/minitest/minitest) and [selenium-webdriver](https://github.com/SeleniumHQ/selenium).

Updates `herb` from 0.9.5 to 0.9.6
- [Release notes](https://github.com/marcoroth/herb/releases)
- [Commits](https://github.com/marcoroth/herb/compare/v0.9.5...v0.9.6)

Updates `minitest` from 6.0.3 to 6.0.4
- [Changelog](https://github.com/minitest/minitest/blob/master/History.rdoc)
- [Commits](https://github.com/minitest/minitest/compare/v6.0.3...v6.0.4)

Updates `selenium-webdriver` from 4.42.0 to 4.43.0
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Changelog](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES)
- [Commits](https://github.com/SeleniumHQ/selenium/compare/selenium-4.42.0...selenium-4.43.0)

---
updated-dependencies:
- dependency-name: herb
  dependency-version: 0.9.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: minitest
  dependency-version: 6.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: selenium-webdriver
  dependency-version: 4.43.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Block all opentelemerty updates

Block opentelemetry-api 1.9 as it needs ruby 3.3

Merge remote-tracking branch 'upstream/pull/7010'

Merge remote-tracking branch 'upstream/pull/7008'

No clever assistance in input intended for URIs

Automatically provide a language in diary entries factory