Enable PostGIS

Merge pull request #7047 from tomhughes/message-rate-limit

Include deleted messages when checking the rate limit

Merge pull request #7046 from tomhughes/object-src

Block object-src in security policy

Merge pull request #7045 from tomhughes/totp-cookie

Set secure and httponly attributes for TOTP cookie

Merge remote-tracking branch 'upstream/pull/7043'

Include deleted messages when checking the rate limit

Reported-by: Jorge Gonzalez Milla <jorge@jmilla.es>

Block object-src in security policy

This is ancient history from when we had a flash based editor
though I'm not sure this rule was really needed even then.

Reported-by: Jorge Gonzalez Milla <jorge@jmilla.es>

Set secure and httponly attributes for TOTP cookie

Reported-by: Jorge Gonzalez Milla <jorge@jmilla.es>

Merge pull request #7036 from tomhughes/bundler4

Update bundler to v4

Reuse 0s and 1s for arm textures

Expand text gradient mask

Merge remote-tracking branch 'upstream/pull/7042'

Merge remote-tracking branch 'upstream/pull/7041'

Fix string that was not translatable

Fix string that was not translatable

Merge pull request #7040 from openstreetmap/translatewiki

Localisation updates from https://translatewiki.net.

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/7033'

Remove dead css

Signed-off-by: Frank Elsinga <frank@elsinga.de>

Merge remote-tracking branch 'upstream/pull/7035'

Update bundler to v4

Merge remote-tracking branch 'upstream/pull/7009'

Merge remote-tracking branch 'upstream/pull/7002'

Bump postcss from 8.5.6 to 8.5.10

Bumps [postcss](https://github.com/postcss/postcss) from 8.5.6 to 8.5.10.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/8.5.6...8.5.10)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.10
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/7032'

Merge remote-tracking branch 'upstream/pull/7034'

Bump erb from 6.0.2 to 6.0.4

Bumps [erb](https://github.com/ruby/erb) from 6.0.2 to 6.0.4.
- [Release notes](https://github.com/ruby/erb/releases)
- [Changelog](https://github.com/ruby/erb/blob/master/NEWS.md)
- [Commits](https://github.com/ruby/erb/compare/v6.0.2...v6.0.4)

---
updated-dependencies:
- dependency-name: erb
  dependency-version: 6.0.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #7017 from lonvia/entrances-for-routing

Take entrances into account for routing start and end points

take entrances into account for routing start and end points

Merge pull request #7031 from openstreetmap/dependabot/npm_and_yarn/dependencies-53e8d04f7f

Bump maplibre-gl from 5.23.0 to 5.24.0 in the dependencies group

Bump the dependencies group with 2 updates

Bumps the dependencies group with 2 updates: [dalli](https://github.com/petergoldstein/dalli) and [opentelemetry-instrumentation-all](https://github.com/open-telemetry/opentelemetry-ruby-contrib).

Updates `dalli` from 4.3.3 to 5.0.2
- [Changelog](https://github.com/petergoldstein/dalli/blob/main/CHANGELOG.md)
- [Commits](https://github.com/petergoldstein/dalli/compare/v4.3.3...v5.0.2)

Updates `opentelemetry-instrumentation-all` from 0.91.0 to 0.92.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-ruby-contrib/releases)
- [Commits](https://github.com/open-telemetry/opentelemetry-ruby-contrib/compare/opentelemetry-instrumentation-all/v0.91.0...opentelemetry-instrumentation-all/v0.92.0)

---
updated-dependencies:
- dependency-name: dalli
  dependency-version: 5.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: opentelemetry-instrumentation-all
  dependency-version: 0.92.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump maplibre-gl from 5.23.0 to 5.24.0 in the dependencies group

Bumps the dependencies group with 1 update: [maplibre-gl](https://github.com/maplibre/maplibre-gl-js).

Updates `maplibre-gl` from 5.23.0 to 5.24.0
- [Release notes](https://github.com/maplibre/maplibre-gl-js/releases)
- [Changelog](https://github.com/maplibre/maplibre-gl-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/maplibre/maplibre-gl-js/compare/v5.23.0...v5.24.0)

---
updated-dependencies:
- dependency-name: maplibre-gl
  dependency-version: 5.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge pull request #6994 from tomhughes/ruby33

Move minium ruby version to 3.3

Update bundle

Move minimum ruby version to 3.3

Merge remote-tracking branch 'upstream/pull/6939'

Use Noticed to deliver notifications on GPX import failure

The previous code relied on `#deliver` (alias for `#deliver_now`) to
immediately deliver the email so that the trace could be deleted. To
work around this, we pass the details of the trace instead of the trace
record, which won't be available by the time the notifications are
ultimately delivered.

This means the trace is not there to be the `record`, so we are not
passing one. Since we can't get the recipient from the non-existing
record, we give the recipient explicitly to `#deliver_later`.

Additionally, the mailer method now needs to receive the recipient
directly, instead of extracting it from the trace record.

Use Noticed to deliver notifications on GPX import success

The mailer method now needs to receive the recipient directly, instead
of extracting it from the trace record.

Merge remote-tracking branch 'upstream/pull/7029'

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/7026'

Merge remote-tracking branch 'upstream/pull/7025'

Merge remote-tracking branch 'upstream/pull/7024'

Bump the dependencies group with 5 updates

Bumps the dependencies group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [mini_racer](https://github.com/discourse/mini_racer) | `0.20.0` | `0.21.0` |
| [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) | `1.219.0` | `1.220.0` |
| [herb](https://github.com/marcoroth/herb) | `0.9.6` | `0.9.7` |
| [minitest](https://github.com/minitest/minitest) | `6.0.4` | `6.0.5` |
| [database_consistency](https://github.com/djezzzl/database_consistency) | `3.0.2` | `3.0.3` |

Updates `mini_racer` from 0.20.0 to 0.21.0
- [Changelog](https://github.com/rubyjs/mini_racer/blob/main/CHANGELOG)
- [Commits](https://github.com/discourse/mini_racer/compare/v0.20.0...v0.21.0)

Updates `aws-sdk-s3` from 1.219.0 to 1.220.0
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Updates `herb` from 0.9.6 to 0.9.7
- [Release notes](https://github.com/marcoroth/herb/releases)
- [Commits](https://github.com/marcoroth/herb/compare/v0.9.6...v0.9.7)

Updates `minitest` from 6.0.4 to 6.0.5
- [Changelog](https://github.com/minitest/minitest/blob/master/History.rdoc)
- [Commits](https://github.com/minitest/minitest/compare/v6.0.4...v6.0.5)

Updates `database_consistency` from 3.0.2 to 3.0.3
- [Changelog](https://github.com/djezzzl/database_consistency/blob/master/CHANGELOG.md)
- [Commits](https://github.com/djezzzl/database_consistency/compare/v3.0.2...v3.0.3)

---
updated-dependencies:
- dependency-name: mini_racer
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: aws-sdk-s3
  dependency-version: 1.220.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: herb
  dependency-version: 0.9.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: minitest
  dependency-version: 6.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: database_consistency
  dependency-version: 3.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump the dependencies group with 2 updates

Bumps the dependencies group with 2 updates: [@herb-tools/linter](https://github.com/marcoroth/herb/tree/HEAD/javascript/packages/linter) and [eslint](https://github.com/eslint/eslint).

Updates `@herb-tools/linter` from 0.9.6 to 0.9.7
- [Release notes](https://github.com/marcoroth/herb/releases)
- [Commits](https://github.com/marcoroth/herb/commits/v0.9.7/javascript/packages/linter)

Updates `eslint` from 10.2.0 to 10.2.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/compare/v10.2.0...v10.2.1)

---
updated-dependencies:
- dependency-name: "@herb-tools/linter"
  dependency-version: 0.9.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: eslint
  dependency-version: 10.2.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump the dependencies group with 3 updates

Bumps the dependencies group with 3 updates: [ruby/setup-ruby](https://github.com/ruby/setup-ruby), [devcontainers/ci](https://github.com/devcontainers/ci) and [actions/setup-node](https://github.com/actions/setup-node).

Updates `ruby/setup-ruby` from 1.302.0 to 1.305.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](https://github.com/ruby/setup-ruby/compare/7372622e62b60b3cb750dcd2b9e32c247ffec26a...0cb964fd540e0a24c900370abf38a33466142735)

Updates `devcontainers/ci` from 0.3.1900000417 to 0.3.1900000449
- [Release notes](https://github.com/devcontainers/ci/releases)
- [Commits](https://github.com/devcontainers/ci/compare/8bf61b26e9c3a98f69cb6ce2f88d24ff59b785c6...b63b30de439b47a52267f241112c5b453b673db5)

Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/53b83947a5a98c8d113130e565377fae1a50d02f...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e)

---
updated-dependencies:
- dependency-name: ruby/setup-ruby
  dependency-version: 1.305.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: devcontainers/ci
  dependency-version: 0.3.1900000449
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: actions/setup-node
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/7022'

Merge remote-tracking branch 'upstream/pull/7021'

Add color scheme ranking logic

Merge pull request #7020 from openstreetmap/translatewiki

Localisation updates from https://translatewiki.net.

use admin_level from extratags when classifying Nominatim search results

Localisation updates from https://translatewiki.net.

Update bundle

to include the new revision of toy/image_optim#224

Merge remote-tracking branch 'upstream/pull/7012'

Merge remote-tracking branch 'upstream/pull/7006'

Merge remote-tracking branch 'upstream/pull/7015'

Bump protocol-buffers-schema from 3.6.0 to 3.6.1

Bumps [protocol-buffers-schema](https://github.com/mafintosh/protocol-buffers-schema) from 3.6.0 to 3.6.1.
- [Commits](https://github.com/mafintosh/protocol-buffers-schema/compare/v3.6.0...v3.6.1)

---
updated-dependencies:
- dependency-name: protocol-buffers-schema
  dependency-version: 3.6.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Update OSMF links to canonical URLs

Merge remote-tracking branch 'upstream/pull/7011'

Bump the dependencies group with 3 updates

Bumps the dependencies group with 3 updates: [herb](https://github.com/marcoroth/herb), [minitest](https://github.com/minitest/minitest) and [selenium-webdriver](https://github.com/SeleniumHQ/selenium).

Updates `herb` from 0.9.5 to 0.9.6
- [Release notes](https://github.com/marcoroth/herb/releases)
- [Commits](https://github.com/marcoroth/herb/compare/v0.9.5...v0.9.6)

Updates `minitest` from 6.0.3 to 6.0.4
- [Changelog](https://github.com/minitest/minitest/blob/master/History.rdoc)
- [Commits](https://github.com/minitest/minitest/compare/v6.0.3...v6.0.4)

Updates `selenium-webdriver` from 4.42.0 to 4.43.0
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Changelog](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES)
- [Commits](https://github.com/SeleniumHQ/selenium/compare/selenium-4.42.0...selenium-4.43.0)

---
updated-dependencies:
- dependency-name: herb
  dependency-version: 0.9.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: minitest
  dependency-version: 6.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: selenium-webdriver
  dependency-version: 4.43.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Block all opentelemerty updates

Block opentelemetry-api 1.9 as it needs ruby 3.3

Merge remote-tracking branch 'upstream/pull/7010'

Merge remote-tracking branch 'upstream/pull/7008'

No clever assistance in input intended for URIs

Automatically provide a language in diary entries factory

Describe burger menu as expanded/collapsed to assistive tech

Merge pull request #7007 from openstreetmap/translatewiki

Localisation updates from https://translatewiki.net.

Localisation updates from https://translatewiki.net.

Search text only in list

Merge pull request #6998 from tomhughes/optimise-notes-search

Split text search of notes and note comments in two

Merge pull request #7004 from openstreetmap/dependabot/npm_and_yarn/dependencies-cc13a5cea7

Bump the dependencies group across 1 directory with 3 updates

Getting data-language-code to search language by code

Bump the dependencies group with 3 updates

Bumps the dependencies group with 3 updates: [maplibre-gl](https://github.com/maplibre/maplibre-gl-js), [@herb-tools/linter](https://github.com/marcoroth/herb/tree/HEAD/javascript/packages/linter) and [globals](https://github.com/sindresorhus/globals).

Updates `maplibre-gl` from 5.22.0 to 5.23.0
- [Release notes](https://github.com/maplibre/maplibre-gl-js/releases)
- [Changelog](https://github.com/maplibre/maplibre-gl-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/maplibre/maplibre-gl-js/compare/v5.22.0...v5.23.0)

Updates `@herb-tools/linter` from 0.9.5 to 0.9.6
- [Release notes](https://github.com/marcoroth/herb/releases)
- [Commits](https://github.com/marcoroth/herb/commits/v0.9.6/javascript/packages/linter)

Updates `globals` from 17.4.0 to 17.5.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](https://github.com/sindresorhus/globals/compare/v17.4.0...v17.5.0)

---
updated-dependencies:
- dependency-name: maplibre-gl
  dependency-version: 5.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@herb-tools/linter"
  dependency-version: 0.9.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: globals
  dependency-version: 17.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Update herb config to 0.9.6

Merge pull request #7003 from openstreetmap/dependabot/github_actions/dependencies-a6024488e2

Bump the dependencies group with 2 updates

Bump the dependencies group with 2 updates

Bumps the dependencies group with 2 updates: [ruby/setup-ruby](https://github.com/ruby/setup-ruby) and [actions/upload-artifact](https://github.com/actions/upload-artifact).

Updates `ruby/setup-ruby` from 1.300.0 to 1.302.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](https://github.com/ruby/setup-ruby/compare/e65c17d16e57e481586a6a5a0282698790062f92...7372622e62b60b3cb750dcd2b9e32c247ffec26a)

Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a)

---
updated-dependencies:
- dependency-name: ruby/setup-ruby
  dependency-version: 1.302.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/6990'

Merge pull request #6999 from amire80/patch-3

Change "Sea Food" to "Seafood" in English strings

Change "Sea Food" to "Seafood" in English strings

The spelling "Seafood" is much more common.

Merge remote-tracking branch 'upstream/pull/6996'

Replace vendored leaflet.polyline plugin with @mapbox/polyline

Split text search of notes and note comments in two

Postgres isn't able to figure out how to optimise the text search
using the GIN indexes when presented with an OR that needs to search
both tables but if we split the query in two ourselves and merge them
back together with a union then it can use the indexes which can speed
things up by two orders of magnitude.

Merge remote-tracking branch 'upstream/pull/6997'

Localisation updates from https://translatewiki.net.

Send email replies through notification framework

Merge remote-tracking branch 'upstream/pull/6993'

Center icon in compact header

Fix header button height

Apparently, production environments need this for #6988 to be seamless

Bump connection_pool from 2.5.5 to 3.0.2 in the dependencies group

Bumps the dependencies group with 1 update: [connection_pool](https://github.com/mperham/connection_pool).

Updates `connection_pool` from 2.5.5 to 3.0.2
- [Changelog](https://github.com/mperham/connection_pool/blob/main/Changes.md)
- [Commits](https://github.com/mperham/connection_pool/compare/v2.5.5...v3.0.2)

---
updated-dependencies:
- dependency-name: connection_pool
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Unblock connection_pool now that we are on rails 8.1.3

Merge remote-tracking branch 'upstream/pull/6992'

Block parallel 2.x as it needs rubty 3.3

Bump the dependencies group across 1 directory with 5 updates

Bumps the dependencies group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [libxml-ruby](https://xml4r.github.io/libxml-ruby/) | `5.0.5` | `6.0.0` |
| [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) | `1.218.0` | `1.219.0` |
| [herb](https://github.com/marcoroth/herb) | `0.9.4` | `0.9.5` |
| [puma](https://github.com/puma/puma) | `7.2.0` | `8.0.0` |
| [selenium-webdriver](https://github.com/SeleniumHQ/selenium) | `4.41.0` | `4.42.0` |

Updates `libxml-ruby` from 5.0.5 to 6.0.0

Updates `aws-sdk-s3` from 1.218.0 to 1.219.0
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Updates `herb` from 0.9.4 to 0.9.5
- [Release notes](https://github.com/marcoroth/herb/releases)
- [Commits](https://github.com/marcoroth/herb/compare/v0.9.4...v0.9.5)

Updates `puma` from 7.2.0 to 8.0.0
- [Release notes](https://github.com/puma/puma/releases)
- [Changelog](https://github.com/puma/puma/blob/main/History.md)
- [Commits](https://github.com/puma/puma/compare/v7.2.0...v8.0.0)

Updates `selenium-webdriver` from 4.41.0 to 4.42.0
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Changelog](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES)
- [Commits](https://github.com/SeleniumHQ/selenium/compare/selenium-4.41.0...selenium-4.42.0)

---
updated-dependencies:
- dependency-name: libxml-ruby
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: aws-sdk-s3
  dependency-version: 1.219.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: herb
  dependency-version: 0.9.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: puma
  dependency-version: 8.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: selenium-webdriver
  dependency-version: 4.42.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/6988'

Block opentelemetry-sdk 1.11 as it needs ruby 3.3

Block opentelemetry-exporter-otlp 0.33 as it needs ruby 3.3

Block updates to strong_migrations 2.6 as it needs ruby 3.3

Merge pull request #6966 from openstreetmap/translatewiki

Localisation updates from https://translatewiki.net.

Localisation updates from https://translatewiki.net.