Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Changes for 1.5.0 #2962

Open
wants to merge 114 commits into
base: main
Choose a base branch
from
Open

Changes for 1.5.0 #2962

wants to merge 114 commits into from

Conversation

thomasleese
Copy link
Contributor

@thomasleese thomasleese commented Feb 12, 2025

The plan is to deploy 1.4.0 to production on Monday (17th), so we're in a position where we can get the changes for 1.5.0 ready to merge in to main.

This branch represents all the work that was done for 1.5.0 (also visible using the milestone) which was necessary as we hadn't yet deployed the previous release and wants to leave main open for any last minute fixes that needed to be added to 1.4.0.

misaka and others added 29 commits February 7, 2025 12:27
Bumps the bundler group with 1 update: [net-imap](https://github.com/ruby/net-imap).


Updates `net-imap` from 0.5.2 to 0.5.6
- [Release notes](https://github.com/ruby/net-imap/releases)
- [Commits](ruby/net-imap@v0.5.2...v0.5.6)

---
updated-dependencies:
- dependency-name: net-imap
  dependency-type: indirect
  dependency-group: bundler
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [sass](https://github.com/sass/dart-sass) from 1.83.4 to 1.84.0.
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](sass/dart-sass@1.83.4...1.84.0)

---
updated-dependencies:
- dependency-name: sass
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [esbuild](https://github.com/evanw/esbuild) from 0.24.2 to 0.25.0.
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.24.2...v0.25.0)

---
updated-dependencies:
- dependency-name: esbuild
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [prettier](https://github.com/prettier/prettier) from 3.4.2 to 3.5.0.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.4.2...3.5.0)

---
updated-dependencies:
- dependency-name: prettier
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [phonelib](https://github.com/daddyz/phonelib) from 0.10.3 to 0.10.4.
- [Release notes](https://github.com/daddyz/phonelib/releases)
- [Changelog](https://github.com/daddyz/phonelib/blob/master/CHANGELOG.md)
- [Commits](daddyz/phonelib@v0.10.3...v0.10.4)

---
updated-dependencies:
- dependency-name: phonelib
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [aws-sdk-rds](https://github.com/aws/aws-sdk-ruby) from 1.264.0 to 1.269.0.
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-rds/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

---
updated-dependencies:
- dependency-name: aws-sdk-rds
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [stackprof](https://github.com/tmm1/stackprof) from 0.2.26 to 0.2.27.
- [Changelog](https://github.com/tmm1/stackprof/blob/master/CHANGELOG.md)
- [Commits](tmm1/stackprof@v0.2.26...v0.2.27)

---
updated-dependencies:
- dependency-name: stackprof
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [webmock](https://github.com/bblimke/webmock) from 3.24.0 to 3.25.0.
- [Changelog](https://github.com/bblimke/webmock/blob/master/CHANGELOG.md)
- [Commits](bblimke/webmock@v3.24.0...v3.25.0)

---
updated-dependencies:
- dependency-name: webmock
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
This adds the two new programme types needed for doubles and updates the
various parts of the code that rely on the programme type to work for
Td/IPV and MenACWY.

In a future commit we'll need to add the vaccines for these two
programmes, and then the health questions.
Bumps [sass](https://github.com/sass/dart-sass) from 1.83.4 to 1.84.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/sass/dart-sass/blob/main/CHANGELOG.md">sass's
changelog</a>.</em></p>
<blockquote>
<h2>1.84.0</h2>
<ul>
<li>
<p>Allow newlines in whitespace in the indented syntax.</p>
</li>
<li>
<p><strong>Potentially breaking bug fix</strong>: Selectors with
unmatched brackets now always
produce a parser error. Previously, some edge cases like
<code>[foo#{&quot;]:is(bar&quot;}) {a: b}</code> would compile without
error, but this was an unintentional bug.</p>
</li>
<li>
<p>Fix a bug in which various Color Level 4 functions weren't allowed in
plain
CSS.</p>
</li>
<li>
<p>Fix the error message for <code>@extend</code> without a selector and
possibly other
parsing edge-cases in contexts that allow interpolation.</p>
</li>
</ul>
<h3>Embedded Host</h3>
<ul>
<li>Fixed the implementation of the <code>SassBoolean</code> type to
adhere to the spec,
now using a class instead of an interface.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sass/dart-sass/commit/ae4b757e5889166e7a716d8015e8b0baf6540fb9"><code>ae4b757</code></a>
[Indented syntax improvements] Dart implementation (<a
href="https://redirect.github.com/sass/dart-sass/issues/2467">#2467</a>)</li>
<li><a
href="https://github.com/sass/dart-sass/commit/d973e3eaf3f976d06de479b1eee3c281449ba07f"><code>d973e3e</code></a>
Allow Color 4 functions in plain CSS (<a
href="https://redirect.github.com/sass/dart-sass/issues/2505">#2505</a>)</li>
<li><a
href="https://github.com/sass/dart-sass/commit/aed783938ff422d82e452b6fbfcd56ccea693ffb"><code>aed7839</code></a>
Add support for the <code>@content</code> rule (<a
href="https://redirect.github.com/sass/dart-sass/issues/2501">#2501</a>)</li>
<li><a
href="https://github.com/sass/dart-sass/commit/3b46880c9d25da0c36f202552b8aeda6f96affcd"><code>3b46880</code></a>
Add changelog for embedded host fix (<a
href="https://redirect.github.com/sass/dart-sass/issues/2500">#2500</a>)</li>
<li><a
href="https://github.com/sass/dart-sass/commit/2cedc62a9c04c370ba6b76b2d5bcd245f6c8c5ed"><code>2cedc62</code></a>
Add support for <code>@import</code> (<a
href="https://redirect.github.com/sass/dart-sass/issues/2498">#2498</a>)</li>
<li><a
href="https://github.com/sass/dart-sass/commit/f4908e78792d4b37c418e218c2fde9d812fa0b3b"><code>f4908e7</code></a>
Fix a crash when writing <code>@extend</code> without a selector (<a
href="https://redirect.github.com/sass/dart-sass/issues/2499">#2499</a>)</li>
<li><a
href="https://github.com/sass/dart-sass/commit/870ba061a3d0a1bbcf95eae71e29610a512b5915"><code>870ba06</code></a>
Bump bufbuild/buf-setup-action in /.github/util/initialize (<a
href="https://redirect.github.com/sass/dart-sass/issues/2495">#2495</a>)</li>
<li><a
href="https://github.com/sass/dart-sass/commit/aba11b86d5d390a4261dfbe96f179bf9a5203b93"><code>aba11b8</code></a>
Bump postcss from 8.4.49 to 8.5.1 in /pkg/sass-parser (<a
href="https://redirect.github.com/sass/dart-sass/issues/2496">#2496</a>)</li>
<li>See full diff in <a
href="https://github.com/sass/dart-sass/compare/1.83.4...1.84.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sass&package-manager=npm_and_yarn&previous-version=1.83.4&new-version=1.84.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
Bumps the bundler group with 1 update:
[net-imap](https://github.com/ruby/net-imap).

Updates `net-imap` from 0.5.2 to 0.5.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ruby/net-imap/releases">net-imap's
releases</a>.</em></p>
<blockquote>
<h2>v0.5.6</h2>
<h2>What's Changed</h2>
<h3>🔒 Security Fix</h3>
<p>Fixes CVE-2025-25186 (GHSA-7fc5-f82f-cx69): A malicious server can
exhaust client memory by sending <code>APPENDUID</code> or
<code>COPYUID</code> responses with very large <code>uid-set</code>
ranges. <code>Net::IMAP::UIDPlusData</code> expands these ranges into
arrays of integers.</p>
<h4>Fix with minor API changes</h4>
<p>Set <code>config.parser_use_deprecated_uidplus_data</code> to
<code>false</code> to replace <code>UIDPlusData</code> with
<code>AppendUIDData</code> and <code>CopyUIDData</code>. These classes
store their UIDs as <code>Net::IMAP::SequenceSet</code> objects
(<em>not</em> expanded into arrays of integers). Code that does not
handle <code>APPENDUID</code> or <code>COPYUID</code> responses should
not see any difference. Code that does handle these responses
<em>may</em> need to be updated.</p>
<p>For v0.3.8, this option is not available
For v0.4.19, the default value is <code>true</code>.
For v0.5.6, the default value is <code>:up_to_max_size</code>.
For v0.6.0, the only allowed value will be <code>false</code>
<em>(<code>UIDPlusData</code> will be removed from v0.6)</em>.</p>
<h4>Mitigate with backward compatible API</h4>
<p>Adjust <code>config.parser_max_deprecated_uidplus_data_size</code> to
limit the maximum <code>UIDPlusData</code> UID set size.
When <code>config.parser_use_deprecated_uidplus_data == true</code>,
larger sets will crash.
When <code>config.parser_use_deprecated_uidplus_data ==
:up_to_max_size</code>, larger sets will use <code>AppendUIDData</code>
or <code>CopyUIDData</code>.</p>
<p>For v0.3,8, this limit is <em>hard-coded</em> to 10,000.
For v0.4.19, this limit defaults to 1000.
For v0.5.6, this limit defaults to 100.
For v0.6.0, the only allowed value will be <code>0</code>
<em>(<code>UIDPlusData</code> will be removed from v0.6)</em>.</p>
<h4>Please Note: unhandled responses</h4>
<p>If the client does not add response handlers to prune unhandled
responses, a malicious server can still eventually exhaust all client
memory, by repeatedly sending malicious responses. However,
<code>net-imap</code> has always retained unhandled responses, and it
has always been necessary for long-lived connections to prune these
responses. This is not significantly different from connecting to a
trusted server with a long-lived connection. To limit the maximum number
of retained responses, a simple handler might look something like the
following:</p>
<pre lang="ruby"><code>limit = 1000
imap.add_response_handler do |resp|
  next unless resp.respond_to?(:name) &amp;&amp; resp.respond_to?(:data)
  name = resp.name
code = resp.data.code&amp;.name if
resp.data.is_a?(Net::IMAP::ResponseText)
  imap.responses(name) { _1.slice!(0...-limit) }
  imap.responses(code) { _1.slice!(0...-limit) }
end
</code></pre>
<h3>Added</h3>
<ul>
<li>🔧 Ensure ResponseParser config is mutable and non-global by <a
href="https://github.com/nevans"><code>@​nevans</code></a> in <a
href="https://redirect.github.com/ruby/net-imap/pull/381">ruby/net-imap#381</a></li>
<li>✨ Add SequenceSet methods for querying about duplicates by <a
href="https://github.com/nevans"><code>@​nevans</code></a> in <a
href="https://redirect.github.com/ruby/net-imap/pull/384">ruby/net-imap#384</a></li>
<li>✨ Add <code>SequenceSet#each_ordered_number</code> by <a
href="https://github.com/nevans"><code>@​nevans</code></a> in <a
href="https://redirect.github.com/ruby/net-imap/pull/386">ruby/net-imap#386</a></li>
<li>✨ Add <code>SequenceSet#find_ordered_index</code> by <a
href="https://github.com/nevans"><code>@​nevans</code></a> in <a
href="https://redirect.github.com/ruby/net-imap/pull/396">ruby/net-imap#396</a></li>
<li>✨ Add <code>SequenceSet#ordered_at</code> by <a
href="https://github.com/nevans"><code>@​nevans</code></a> in <a
href="https://redirect.github.com/ruby/net-imap/pull/397">ruby/net-imap#397</a></li>
<li>✨ Add AppendUIDData and CopyUIDData classes by <a
href="https://github.com/nevans"><code>@​nevans</code></a> in <a
href="https://redirect.github.com/ruby/net-imap/pull/400">ruby/net-imap#400</a></li>
<li>🔧 Add parser config for <code>APPENDUID</code>/<code>COPYUID</code>,
🗑️ Deprecate UIDPlusData by <a
href="https://github.com/nevans"><code>@​nevans</code></a> in <a
href="https://redirect.github.com/ruby/net-imap/pull/401">ruby/net-imap#401</a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>🐛 Fix <code>SequenceSet#append</code> when its <code>@string</code>
is nil by <a href="https://github.com/nevans"><code>@​nevans</code></a>
in <a
href="https://redirect.github.com/ruby/net-imap/pull/376">ruby/net-imap#376</a></li>
<li>🐛 Fix SequenceSet merging in another SequenceSet by <a
href="https://github.com/nevans"><code>@​nevans</code></a> in <a
href="https://redirect.github.com/ruby/net-imap/pull/377">ruby/net-imap#377</a></li>
<li>🐛 Fix SequenceSet count dups with multiple &quot;*&quot; by <a
href="https://github.com/nevans"><code>@​nevans</code></a> in <a
href="https://redirect.github.com/ruby/net-imap/pull/387">ruby/net-imap#387</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ruby/net-imap/commit/62710b905d5672dc3dcc6d6774c1863a46e4be2b"><code>62710b9</code></a>
🔖 Bump version to 0.5.6</li>
<li><a
href="https://github.com/ruby/net-imap/commit/70e3ddd071a94e450b3238570af482c296380b35"><code>70e3ddd</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/ruby/net-imap/commit/e58aff64d55dda4215fa0cfd7f4d1ea7b9ca51ba"><code>e58aff6</code></a>
🔧 Add <code>:up_to_max_size</code> config for UIDPlusData</li>
<li><a
href="https://github.com/ruby/net-imap/commit/2f58d020580176ed13fcd1e571ab7bc0e1e8f155"><code>2f58d02</code></a>
🔧 Add config option for max UIDPlusData size</li>
<li><a
href="https://github.com/ruby/net-imap/commit/c67470092e53d5f8d1f8d47c80450dd7b5995302"><code>c674700</code></a>
🔒 Limit exponential memory usage to parse uid-set</li>
<li><a
href="https://github.com/ruby/net-imap/commit/60f577690d80dd2593edaeb1d09b7681bedac368"><code>60f5776</code></a>
🔧🗑️ Deprecate UIDPlusData, with config to upgrade</li>
<li><a
href="https://github.com/ruby/net-imap/commit/8f41dea368f456ee502c5eaf80491e924691010a"><code>8f41dea</code></a>
🔀 Merge pull request <a
href="https://redirect.github.com/ruby/net-imap/issues/400">#400</a>
from ruby/add-appenduid-copyuid-classes</li>
<li><a
href="https://github.com/ruby/net-imap/commit/bcb261d12e9911eaf89d35db314c626501c92b72"><code>bcb261d</code></a>
✨ Add CopyUIDData (to replace UIDPlusData)</li>
<li><a
href="https://github.com/ruby/net-imap/commit/01bb49f4ae3220a695e21314ba4d92a84fe64b35"><code>01bb49f</code></a>
✨ Add AppendUIDData (to replace UIDPlusData)</li>
<li><a
href="https://github.com/ruby/net-imap/commit/85d0aa264daa682106c73bd4a33d047888b3eee7"><code>85d0aa2</code></a>
🚚 Rename UIDPLUS test file for consistency</li>
<li>Additional commits viewable in <a
href="https://github.com/ruby/net-imap/compare/v0.5.2...v0.5.6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=net-imap&package-manager=bundler&previous-version=0.5.2&new-version=0.5.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/nhsuk/manage-vaccinations-in-schools/network/alerts).

</details>
Bumps [esbuild](https://github.com/evanw/esbuild) from 0.24.2 to 0.25.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/releases">esbuild's
releases</a>.</em></p>
<blockquote>
<h2>v0.25.0</h2>
<p><strong>This release deliberately contains backwards-incompatible
changes.</strong> To avoid automatically picking up releases like this,
you should either be pinning the exact version of <code>esbuild</code>
in your <code>package.json</code> file (recommended) or be using a
version range syntax that only accepts patch upgrades such as
<code>^0.24.0</code> or <code>~0.24.0</code>. See npm's documentation
about <a
href="https://docs.npmjs.com/cli/v6/using-npm/semver/">semver</a> for
more information.</p>
<ul>
<li>
<p>Restrict access to esbuild's development server (<a
href="https://github.com/evanw/esbuild/security/advisories/GHSA-67mh-4wv8-2f99">GHSA-67mh-4wv8-2f99</a>)</p>
<p>This change addresses esbuild's first security vulnerability report.
Previously esbuild set the <code>Access-Control-Allow-Origin</code>
header to <code>*</code> to allow esbuild's development server to be
flexible in how it's used for development. However, this allows the
websites you visit to make HTTP requests to esbuild's local development
server, which gives read-only access to your source code if the website
were to fetch your source code's specific URL. You can read more
information in <a
href="https://github.com/evanw/esbuild/security/advisories/GHSA-67mh-4wv8-2f99">the
report</a>.</p>
<p>Starting with this release, <a
href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS">CORS</a>
will now be disabled, and requests will now be denied if the host does
not match the one provided to <code>--serve=</code>. The default host is
<code>0.0.0.0</code>, which refers to all of the IP addresses that
represent the local machine (e.g. both <code>127.0.0.1</code> and
<code>192.168.0.1</code>). If you want to customize anything about
esbuild's development server, you can <a
href="https://esbuild.github.io/api/#serve-proxy">put a proxy in front
of esbuild</a> and modify the incoming and/or outgoing requests.</p>
<p>In addition, the <code>serve()</code> API call has been changed to
return an array of <code>hosts</code> instead of a single
<code>host</code> string. This makes it possible to determine all of the
hosts that esbuild's development server will accept.</p>
<p>Thanks to <a
href="https://github.com/sapphi-red"><code>@​sapphi-red</code></a> for
reporting this issue.</p>
</li>
<li>
<p>Delete output files when a build fails in watch mode (<a
href="https://redirect.github.com/evanw/esbuild/issues/3643">#3643</a>)</p>
<p>It has been requested for esbuild to delete files when a build fails
in watch mode. Previously esbuild left the old files in place, which
could cause people to not immediately realize that the most recent build
failed. With this release, esbuild will now delete all output files if a
rebuild fails. Fixing the build error and triggering another rebuild
will restore all output files again.</p>
</li>
<li>
<p>Fix correctness issues with the CSS nesting transform (<a
href="https://redirect.github.com/evanw/esbuild/issues/3620">#3620</a>,
<a
href="https://redirect.github.com/evanw/esbuild/issues/3877">#3877</a>,
<a
href="https://redirect.github.com/evanw/esbuild/issues/3933">#3933</a>,
<a
href="https://redirect.github.com/evanw/esbuild/issues/3997">#3997</a>,
<a
href="https://redirect.github.com/evanw/esbuild/issues/4005">#4005</a>,
<a href="https://redirect.github.com/evanw/esbuild/pull/4037">#4037</a>,
<a
href="https://redirect.github.com/evanw/esbuild/pull/4038">#4038</a>)</p>
<p>This release fixes the following problems:</p>
<ul>
<li>
<p>Naive expansion of CSS nesting can result in an exponential blow-up
of generated CSS if each nesting level has multiple selectors.
Previously esbuild sometimes collapsed individual nesting levels using
<code>:is()</code> to limit expansion. However, this collapsing wasn't
correct in some cases, so it has been removed to fix correctness
issues.</p>
<pre lang="css"><code>/* Original code */
.parent {
  &gt; .a,
  &gt; .b1 &gt; .b2 {
    color: red;
  }
}
<p>/* Old output (with --supported:nesting=false) */<br />
.parent &gt; :is(.a, .b1 &gt; .b2) {<br />
color: red;<br />
}</p>
<p>/* New output (with --supported:nesting=false) */<br />
.parent &gt; .a,<br />
.parent &gt; .b1 &gt; .b2 {<br />
color: red;<br />
}<br />
</code></pre></p>
<p>Thanks to <a
href="https://github.com/tim-we"><code>@​tim-we</code></a> for working
on a fix.</p>
</li>
<li>
<p>The <code>&amp;</code> CSS nesting selector can be repeated multiple
times to increase CSS specificity. Previously esbuild ignored this
possibility and incorrectly considered <code>&amp;&amp;</code> to have
the same specificity as <code>&amp;</code>. With this release, this
should now work correctly:</p>
<pre lang="css"><code>/* Original code (color should be red) */
</code></pre>
</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md">esbuild's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog: 2024</h1>
<p>This changelog documents all esbuild versions published in the year
2024 (versions 0.19.12 through 0.24.2).</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/evanw/esbuild/commit/e9174d671b1882758cd32ac5e146200f5bee3e45"><code>e9174d6</code></a>
publish 0.25.0 to npm</li>
<li><a
href="https://github.com/evanw/esbuild/commit/c27dbebb9e7a55dd9a084dd151dddd840787490e"><code>c27dbeb</code></a>
fix <code>hosts</code> in <code>plugin-tests.js</code></li>
<li><a
href="https://github.com/evanw/esbuild/commit/6794f602a453cf0255bcae245871de120a89a559"><code>6794f60</code></a>
fix <code>hosts</code> in <code>node-unref-tests.js</code></li>
<li><a
href="https://github.com/evanw/esbuild/commit/de85afd65edec9ebc44a11e245fd9e9a2e99760d"><code>de85afd</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/evanw/esbuild/commit/da1de1bf77a65f06654b49878d9ec4747ddaa21f"><code>da1de1b</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4065">#4065</a>:
bitwise operators can return bigints</li>
<li><a
href="https://github.com/evanw/esbuild/commit/f4e9d19fb20095a98bf40634f0380f6a16be91e7"><code>f4e9d19</code></a>
switch case liveness: <code>default</code> is always last</li>
<li><a
href="https://github.com/evanw/esbuild/commit/7aa47c3e778ea04849f97f18dd9959df88fa0886"><code>7aa47c3</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4028">#4028</a>:
minify live/dead <code>switch</code> cases better</li>
<li><a
href="https://github.com/evanw/esbuild/commit/22ecd306190b8971ec4474b5485266c20350e266"><code>22ecd30</code></a>
minify: more constant folding for strict equality</li>
<li><a
href="https://github.com/evanw/esbuild/commit/4cdf03c03697128044fa8fb76e5c478e9765b353"><code>4cdf03c</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4053">#4053</a>:
reordering of <code>.tsx</code> in <code>node_modules</code></li>
<li><a
href="https://github.com/evanw/esbuild/commit/dc719775b7140120916bd9e6777ca1cb8a1cdc0e"><code>dc71977</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/3692">#3692</a>:
<code>0</code> now picks a random ephemeral port</li>
<li>Additional commits viewable in <a
href="https://github.com/evanw/esbuild/compare/v0.24.2...v0.25.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=esbuild&package-manager=npm_and_yarn&previous-version=0.24.2&new-version=0.25.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
Bumps [prettier](https://github.com/prettier/prettier) from 3.4.2 to
3.5.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/releases">prettier's
releases</a>.</em></p>
<blockquote>
<h2>3.5.0</h2>
<p><a
href="https://github.com/prettier/prettier/compare/3.4.2...3.5.0">diff</a></p>
<p>🔗 <a href="https://prettier.io/blog/2025/02/09/3.5.0">Release
note</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md">prettier's
changelog</a>.</em></p>
<blockquote>
<h1>3.5.0</h1>
<p><a
href="https://github.com/prettier/prettier/compare/3.4.2...3.5.0">diff</a></p>
<p>🔗 <a href="https://prettier.io/blog/2025/02/09/3.5.0.html">Release
Notes</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/prettier/prettier/commit/7584432401a47a26943dd7a9ca9a8e032ead7285"><code>7584432</code></a>
Release 3.5.0</li>
<li><a
href="https://github.com/prettier/prettier/commit/4797054c3d6ca2273121570316e493422dde978d"><code>4797054</code></a>
Remove blog post</li>
<li><a
href="https://github.com/prettier/prettier/commit/5ed5dc0b8a62650ed1d0a1afddb9ed4a0767582a"><code>5ed5dc0</code></a>
Fix a link in changelog (<a
href="https://redirect.github.com/prettier/prettier/issues/17088">#17088</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/d8c21c58b33cd913c31687806f5fc55543a6fe71"><code>d8c21c5</code></a>
Fix tag notation in changelog (<a
href="https://redirect.github.com/prettier/prettier/issues/17087">#17087</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/0fcd5db0aab8b3cef30eac09b5a7816a58f851ce"><code>0fcd5db</code></a>
Separate license and third-party licenses (<a
href="https://redirect.github.com/prettier/prettier/issues/17073">#17073</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/0c2b4bb3aa946b5b5cfbea322b90ada07236b70e"><code>0c2b4bb</code></a>
chore(deps): update babel to v7.26.8 (<a
href="https://redirect.github.com/prettier/prettier/issues/17084">#17084</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/e3a5595d485d223da01731d9cdd32523d2f17e70"><code>e3a5595</code></a>
chore(deps): update babel to v7.26.8 (<a
href="https://redirect.github.com/prettier/prettier/issues/17083">#17083</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/4a5ad1ffb10ab4e67c3090e0a40d3168b78dab43"><code>4a5ad1f</code></a>
Add <code>disable_search</code> to <code>codecov/codecov-action</code>
(<a
href="https://redirect.github.com/prettier/prettier/issues/17082">#17082</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/b997ce35fe778a82cf47f8488078b56a57b8c2b3"><code>b997ce3</code></a>
chore(deps): update dependency <code>@​glimmer/syntax</code> to v0.94.3
(<a
href="https://redirect.github.com/prettier/prettier/issues/17080">#17080</a>)</li>
<li><a
href="https://github.com/prettier/prettier/commit/7a6273bde750d52f0c0f739e27205f629418f359"><code>7a6273b</code></a>
chore(deps): update dependency esbuild to v0.25.0 (<a
href="https://redirect.github.com/prettier/prettier/issues/17081">#17081</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/prettier/prettier/compare/3.4.2...3.5.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=prettier&package-manager=npm_and_yarn&previous-version=3.4.2&new-version=3.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
Bumps [phonelib](https://github.com/daddyz/phonelib) from 0.10.3 to
0.10.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/daddyz/phonelib/releases">phonelib's
releases</a>.</em></p>
<blockquote>
<h2>v0.10.4</h2>
<ul>
<li>updated data</li>
<li>fixed issue <a
href="https://redirect.github.com/daddyz/phonelib/issues/332">#332</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/daddyz/phonelib/commit/1241e39e4d594c1c80e6c019cb4df764aa8bba6d"><code>1241e39</code></a>
bumped version</li>
<li><a
href="https://github.com/daddyz/phonelib/commit/fdea8d230ce187b46ce1401b917bfaf0be41c9ff"><code>fdea8d2</code></a>
updated data</li>
<li><a
href="https://github.com/daddyz/phonelib/commit/a750ef67081e33df394a398265fcd3370dbca9a9"><code>a750ef6</code></a>
fixed issue <a
href="https://redirect.github.com/daddyz/phonelib/issues/332">#332</a></li>
<li>See full diff in <a
href="https://github.com/daddyz/phonelib/compare/v0.10.3...v0.10.4">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=phonelib&package-manager=bundler&previous-version=0.10.3&new-version=0.10.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
Bumps [webmock](https://github.com/bblimke/webmock) from 3.24.0 to
3.25.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/bblimke/webmock/blob/master/CHANGELOG.md">webmock's
changelog</a>.</em></p>
<blockquote>
<h1>3.25.0</h1>
<ul>
<li>
<p>Resolve net-http adapter deprecation Ruby 3.4</p>
<p>Thanks to <a href="https://github.com/Earlopain">Earlopain</a></p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/bblimke/webmock/commit/8384080b7b5027693a57cc7ec493020d76b8c96a"><code>8384080</code></a>
Version 3.25.0</li>
<li><a
href="https://github.com/bblimke/webmock/commit/dff648875c085bbeb85b491728cb59afbb5b4e83"><code>dff6488</code></a>
Merge pull request <a
href="https://redirect.github.com/bblimke/webmock/issues/1096">#1096</a>
from koic/workaround_for_jruby_ci_matrix_is_failing</li>
<li><a
href="https://github.com/bblimke/webmock/commit/6aacb4032f3de568dc0353a0185557541dac39b1"><code>6aacb40</code></a>
Suspend JRuby CI matrix</li>
<li><a
href="https://github.com/bblimke/webmock/commit/cb65c87e3092941ea65388d5f619a464aa1f9746"><code>cb65c87</code></a>
Merge pull request <a
href="https://redirect.github.com/bblimke/webmock/issues/1097">#1097</a>
from koic/fix_build_error_in_ruby_3_5_ci_matrix</li>
<li><a
href="https://github.com/bblimke/webmock/commit/1e7e9dfd5d221550dc56a995d845d64d52aa3d81"><code>1e7e9df</code></a>
Fix a build error for Ruby 3.5 CI matrix</li>
<li><a
href="https://github.com/bblimke/webmock/commit/ab43ce9b03e18edc4c33fff9abe12fbc953a3b3c"><code>ab43ce9</code></a>
Merge pull request <a
href="https://redirect.github.com/bblimke/webmock/issues/1098">#1098</a>
from koic/add_ostruct_to_gemfile</li>
<li><a
href="https://github.com/bblimke/webmock/commit/3acba799aaf06515421df3b961ad2d80a2b05376"><code>3acba79</code></a>
Add <code>ostruct</code> gem to Gemfile to prevent an error in
development with Ruby 3.5</li>
<li><a
href="https://github.com/bblimke/webmock/commit/d66d1cdf34fc1c582cae77cd81d106ba98feb6fc"><code>d66d1cd</code></a>
Merge pull request <a
href="https://redirect.github.com/bblimke/webmock/issues/1095">#1095</a>
from koic/revert_1091</li>
<li><a
href="https://github.com/bblimke/webmock/commit/7ecd77c78016a154d692cf6e03939a6be0b0d0b5"><code>7ecd77c</code></a>
Revert &quot;Fix included modules on Ruby 3.4&quot;</li>
<li><a
href="https://github.com/bblimke/webmock/commit/e8c5129b29af62bcfbb5e4c685ee711ce3c81f12"><code>e8c5129</code></a>
Merge pull request <a
href="https://redirect.github.com/bblimke/webmock/issues/1091">#1091</a>
from sailor/master</li>
<li>Additional commits viewable in <a
href="https://github.com/bblimke/webmock/compare/v3.24.0...v3.25.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=webmock&package-manager=bundler&previous-version=3.24.0&new-version=3.25.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
Bumps [stackprof](https://github.com/tmm1/stackprof) from 0.2.26 to
0.2.27.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tmm1/stackprof/commit/a4d23d18fe27967da3de8246803fe42cb2f76009"><code>a4d23d1</code></a>
bumping version</li>
<li><a
href="https://github.com/tmm1/stackprof/commit/d90ad352e5cd519f22d2b3e7159e9b1786db2b5a"><code>d90ad35</code></a>
Merge pull request <a
href="https://redirect.github.com/tmm1/stackprof/issues/226">#226</a>
from froydnj/froydnj-fix-timing-crash</li>
<li><a
href="https://github.com/tmm1/stackprof/commit/078f36566d56a135cb77579f6a99a31fac67b183"><code>078f365</code></a>
Merge pull request <a
href="https://redirect.github.com/tmm1/stackprof/issues/230">#230</a>
from s4na/ruby3.3</li>
<li><a
href="https://github.com/tmm1/stackprof/commit/02b866a30be24b53e0957464bd24f63acde91a08"><code>02b866a</code></a>
Add Ruby 3.3 to CI</li>
<li><a
href="https://github.com/tmm1/stackprof/commit/4e504d37188bb06dfa2ab07b253bedcf4d03ef40"><code>4e504d3</code></a>
be more diligent about atomic operations</li>
<li><a
href="https://github.com/tmm1/stackprof/commit/08b5127b032c3dbffd0e0ce8eac719008658318c"><code>08b5127</code></a>
don't set <code>running</code> until all relevant state is
initialized</li>
<li>See full diff in <a
href="https://github.com/tmm1/stackprof/compare/v0.2.26...v0.2.27">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=stackprof&package-manager=bundler&previous-version=0.2.26&new-version=0.2.27)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
Bumps [aws-sdk-rds](https://github.com/aws/aws-sdk-ruby) from 1.264.0 to
1.269.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-rds/CHANGELOG.md">aws-sdk-rds's
changelog</a>.</em></p>
<blockquote>
<h2>1.269.0 (2025-02-06)</h2>
<ul>
<li>Feature - Code Generated Changes, see <code>./build_tools</code> or
<code>aws-sdk-core</code>'s CHANGELOG.md for details.</li>
</ul>
<h2>1.268.0 (2025-02-05)</h2>
<ul>
<li>Feature - Documentation updates to clarify the description for the
parameter AllocatedStorage for the DB cluster data type, the description
for the parameter DeleteAutomatedBackups for the DeleteDBCluster API
operation, and removing an outdated note for the CreateDBParameterGroup
API operation.</li>
</ul>
<h2>1.267.0 (2025-01-31)</h2>
<ul>
<li>Feature - Updates to Aurora MySQL and Aurora PostgreSQL API pages
with instance log type in the create and modify DB Cluster.</li>
</ul>
<h2>1.266.0 (2025-01-15)</h2>
<ul>
<li>Feature - Code Generated Changes, see <code>./build_tools</code> or
<code>aws-sdk-core</code>'s CHANGELOG.md for details.</li>
</ul>
<h2>1.265.0 (2025-01-08)</h2>
<ul>
<li>Feature - Updates Amazon RDS documentation to clarify the
RestoreDBClusterToPointInTime description.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/aws/aws-sdk-ruby/commits">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=aws-sdk-rds&package-manager=bundler&previous-version=1.264.0&new-version=1.269.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
This adds a new reference to the organisation on the patient model which
adds a direct link between a patient and an organisation rather than
going through the cohort which is going to be removed.
This updates everywhere that sets the cohort on the patient to also set
the organisation so we can start to use this instead of the cohort.
This updates the patient policy to select children according to the
organisation they belong to rather than the cohort as the cohort is
going to be replaced with the organisation.
This updates the component to display the cohort from the organisation
as the cohort is going to be removed.
This adds a convenience method which allows us to easily convert between
a year group and a birth academic year.
This updates the cohorts page to not rely on the `Cohort` instances and
instead go by the `year_group` on the patients.
This updates the school moves to no longer set the cohort on the patient
as this is no longer used and instead we will rely on only the
organisation.
This adds a scope on the patient model which allows us to filter on
patients who are in the programme based on their year group.
This avoids eager loading any cohorts as we're going to stop using this
column and it will be shortly removed.
This removes the cohort reference on patients, and removes any final
bits of code that rely on the cohort reference.
misaka and others added 3 commits February 13, 2025 12:10
When closing a school session, we move all unvaccinated patients to
the clinic so they can be vaccinated outside the school. However, if the
parents have refused consent for the patient to be vaccinated in school,
we don't want to move them to the clinic.
This ensures that when sending emails about vaccination records, the
resulting log entry is attached to the patient.
When validating an immunisation import row we only need to check for
presence if we're not already checking the value is equal to the current
organisation, as that check already checks for the presence of the
value.
When closing a school session, we move all unvaccinated patients to the
clinic so they can be vaccinated outside the school. However, if the
parents have refused consent for the patient to be vaccinated in school,
we don't want to move them to the clinic.

[Trello
Card](https://trello.com/c/OOVetSlY/1918-children-with-consent-refused-being-mistakenly-proposed-to-move-to-community-clinic-when-closing-session)
thomasleese and others added 3 commits February 13, 2025 16:04
This prevents a bug where a user cannot be merged with a patient that
has been moved out of the cohort as they can't be found by the policy
scope.

To support this, we've slightly updated the logic around the patient
merging to move the patient back in to the cohort if they are not
currently part of any cohort as this is likely to be the expected
behaviour.

There is an outstanding question about what happens if we're merging two
patients from two different organisation's cohorts, it's unclear which
organisation's cohort the merged patient should belong to.
This follows up on #2939 to ensure that vaccination records are filtered
by the current programme. At the moment this is the first programme
administered in a session but in the future this will come from a
selection by the user.

At the same time, this also fixes a bug where vaccination records
administered outside of the current session weren't shown on a patient's
record. Now we show all vaccination records for a particular patient.
This prevents a bug where a user cannot be merged with a patient that
has been moved out of the cohort as they can't be found by the policy
scope.

To support this, we've slightly updated the logic around the patient
merging to move the patient back in to the cohort if they are not
currently part of any cohort as this is likely to be the expected
behaviour.

There is an outstanding question about what happens if we're merging two
patients from two different organisation's cohorts, it's unclear which
organisation's cohort the merged patient should belong to.

[Trello
Card](https://trello.com/c/LIFt9GVO/1821-for-some-patients-when-you-try-to-add-an-nhs-number-to-a-duplicate-record-so-that-you-can-merge-them-you-get-an-error-saying-nhs)
We might not be in a position to release this feature in 1.5.0 but we
can put it behind a feature flag for now.
We might not be in a position to release this feature in 1.5.0 but we
can put it behind a feature flag for now.
@thomasleese thomasleese marked this pull request as ready for review February 14, 2025 16:03
@thomasleese thomasleese changed the title 1.5.0 (work in progress) Changes for 1.5.0 Feb 14, 2025
Copy link
Member

@tvararu tvararu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

YOLO

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants