Merge remote-tracking branch 'upstream/pull/4867'

Merge remote-tracking branch 'upstream/pull/4866'

Merge remote-tracking branch 'upstream/pull/4863'

Write closed note controls using submit_tag

Increase font size in search form

Replace search button text with svg icon

Bump eslint from 9.3.0 to 9.4.0

Bumps [eslint](https://github.com/eslint/eslint) from 9.3.0 to 9.4.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v9.3.0...v9.4.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/4843'

Merge remote-tracking branch 'upstream/pull/4857'

Merge remote-tracking branch 'upstream/pull/4847'

Localisation updates from https://translatewiki.net.

Fixed "or divider" issue described in #4773 by adding mb-2 below "or" divider

Social sign-in: avoid re-authorization in `users_controller#create`

It does not add any additional guards against malicious users:

Malicious user may attempt to invoke `POST /users/new` with bogus
values for `auth_provider` and `auth_uid` resulting
with a new account to which user would have a way to login, other than
sending a password reset request.

In some cases, re-authorization would introduce additional
"Please login to your social account", or "Are you sure you want to be logged in"
popup triggered by identity provider.

This PR removes the re-authorization request from `POST /users/new` in authorization flow.

Merge remote-tracking branch 'upstream/pull/4860'

Re-enable autocomplete for passwords

Regression for c4347c8d9a10bf5c141ad7d355594b93e20545f6

Thankfully browsers ignore this for login fields, but it shouldn't
be turned off anyway.

Re-enable translations for password field

Fixes regression introduced in c4347c8d9a10bf5c141ad7d355594b93e20545f6

Merge remote-tracking branch 'upstream/pull/4859'

Merge remote-tracking branch 'upstream/pull/4853'

Merge remote-tracking branch 'upstream/pull/4849'

Move check_api_readable to api_controller

It's easier to skip the check in the two places that we need to, and
include it by default everywhere else.

Test the versions and capabilities api in various statuses

These both need to keep working, even when the rest of the api is
unavailable, since that's how we communicate that status with the
api clients.

Standardise on avoiding except lists for check_api_readable

Although this is technically duplicative, it's much easier to read
and therefore to maintain, particularly if you put the _readable one
first.

Remove duplicate database status checks

These are already done as part of the api checks

Add api_status checks for user preferences API

Merge pull request #4856 from tyrasd/patch-2

reintroduce unsafe-eval CSP rule for iD (Mapillary layer)

reintroduce unsafe-eval CSP rule for iD

fixes https://github.com/openstreetmap/iD/issues/10265

Fixed "auth_button_preferred alignment" issue described in #4773

Bump osm-community-index from 5.7.0 to 5.7.1

Bumps [osm-community-index](https://github.com/osmlab/osm-community-index) from 5.7.0 to 5.7.1.
- [Release notes](https://github.com/osmlab/osm-community-index/releases)
- [Changelog](https://github.com/osmlab/osm-community-index/blob/main/CHANGELOG.md)
- [Commits](https://github.com/osmlab/osm-community-index/compare/v5.7.0...v5.7.1)

---
updated-dependencies:
- dependency-name: osm-community-index
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Fix new rubocop warnings

Update bundle

Merge remote-tracking branch 'upstream/pull/4848'

Added gps.tile.openstreetmap.org as allowed source for images

Resolves #4845

Merge remote-tracking branch 'upstream/pull/4842'

Merge remote-tracking branch 'upstream/pull/4828'

Merge remote-tracking branch 'upstream/pull/4846'

Add proper referrer for authorization scenario

Fixes the following:
- `users_controller#new` loses referer in authorization scenario, when it was invoked after social signup succeded
- the second invocation of `auth_success`, triggered by re-authorization initiated from `users_controller#create`
  does not have referrer field set
- as a result, the final welcome screen does not offer final authorization, and drops into ID instead

Introduced by #4758.

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/4844'

Merge remote-tracking branch 'upstream/pull/4838'

Merge remote-tracking branch 'upstream/pull/4837'

Merge remote-tracking branch 'upstream/pull/4836'

Merge remote-tracking branch 'upstream/pull/4835'

Merge remote-tracking branch 'upstream/pull/4841'

Merge remote-tracking branch 'upstream/pull/4840'

Replace png directions icon with inline svg

Inline welcome/fixthemap sprites

Replace way icon path with line and circles

Round node icon coordinate

Decrease image width and height

Group elements of rules and questions icons

Group elements of tag icon

Group elements of way icon

Group elements of node icon

Group elements of cross icon

Group elements of check icon

Remove outer group

Remove vertical translation

Replace cubic bezier approximations of circles with circles

Remove invisible elements

Remove reference to a missing filter

Truncate username in user menu

Adjust vertical alignment of user button contents

Increase secondary nav item padding to compensate removed whitespace

Use Bootstrap .nav in secondary header navigation

update script-src CSP rules for iD

allow data URIs for images in iD

Remove unused #container css

Replace .btn-wrapper with Bootstrap gutters/gaps

Remove unused .browse_status css class

Remove custom css from "Load Data" button

Merge remote-tracking branch 'upstream/pull/4832'

Merge remote-tracking branch 'upstream/pull/4833'

Merge remote-tracking branch 'upstream/pull/4829'

Merge remote-tracking branch 'upstream/pull/4831'

Merge remote-tracking branch 'upstream/pull/4830'

Remove custom css from note descriptions

Remove custom css from "Enable overlays" text

Bump osm-community-index from 5.6.3 to 5.7.0

Bumps [osm-community-index](https://github.com/osmlab/osm-community-index) from 5.6.3 to 5.7.0.
- [Release notes](https://github.com/osmlab/osm-community-index/releases)
- [Changelog](https://github.com/osmlab/osm-community-index/blob/main/CHANGELOG.md)
- [Commits](https://github.com/osmlab/osm-community-index/compare/v5.6.3...v5.7.0)

---
updated-dependencies:
- dependency-name: osm-community-index
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump leaflet.locatecontrol from 0.81.0 to 0.81.1

Bumps [leaflet.locatecontrol](https://github.com/domoritz/leaflet-locatecontrol) from 0.81.0 to 0.81.1.
- [Changelog](https://github.com/domoritz/leaflet-locatecontrol/blob/gh-pages/CHANGELOG.md)
- [Commits](https://github.com/domoritz/leaflet-locatecontrol/compare/v0.81.0...v0.81.1)

---
updated-dependencies:
- dependency-name: leaflet.locatecontrol
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Keep header h1 height equal to default header height

Adjust vertical alignment of user button contents

Increase secondary nav item padding to compensate removed whitespace

Use Bootstrap .nav in secondary header navigation

Merge remote-tracking branch 'upstream/pull/4826'

Fixed "Tab alignment" issue described in #4773

Fixed "Tab alignment" for "Sign up" button issue described in #4773 and #4826

Merge remote-tracking branch 'upstream/pull/4826'

Fixed "Tab alignment" for "Sign up" button issue described in #4773 and #4826

Fixed "Tab alignment" issue described in #4773

Merge remote-tracking branch 'upstream/pull/4827'

Fixed "Top menu buttons" issue mentioned in the #4773

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/4823'

Merge pull request #4627 from tomhughes/security-policy

Switch to using rails builtin content security policy support

Switch to using rails builtin content security policy support

Merge pull request #4756 from tomhughes/text-muted

Replace deprecated text-muted class with text-body-secondary

Merge pull request #4758 from tomhughes/login-referer

Stop using the session to persist the referer during login

Merge pull request #4816 from tomhughes/login-focus

Make the login and signup screens focus on the first input

Replace deprecated text-muted class with text-body-secondary

Merge pull request #4824 from AntonKhorev/no-user-button

Remove unnecessary user menu wrapper

Remove unnecessary user menu wrapper