Bumps
[social-auth-app-django](https://github.com/python-social-auth/social-app-django)
from 5.4.0 to 5.4.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/python-social-auth/social-app-django/releases">social-auth-app-django's
releases</a>.</em></p>
<blockquote>
<h2>Release 5.4.1</h2>
<h3>Changed</h3>
<ul>
<li>Added reverse migration for JSON field</li>
<li>Fixed improper handling of case sensitivity with MySQL/MariaDB (<a
href="https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-2gr8-3wc7-xhj3">CVE-2024-32879</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/python-social-auth/social-app-django/blob/master/CHANGELOG.md">social-auth-app-django's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/python-social-auth/social-app-django/releases/tag/5.4.1">5.4.1</a>
- 2024-04-24</h2>
<h3>Changed</h3>
<ul>
<li>Added reverse migration for JSON field</li>
<li>Fixed improper handling of case sensitivity with MySQL/MariaDB
(CVE-2024-32879)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/python-social-auth/social-app-django/commit/593ee4638eab9b1d9f252393a21ead643e3ceae6"><code>593ee46</code></a>
Version bump 5.4.1</li>
<li><a
href="https://github.com/python-social-auth/social-app-django/commit/31c3e0c7edb187004d8abbde7e9c4f7ef9098138"><code>31c3e0c</code></a>
models: make sure uid is compared case-sensitive</li>
<li><a
href="https://github.com/python-social-auth/social-app-django/commit/7033ff73993a4c3666d989930bbc15e87925abc9"><code>7033ff7</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/python-social-auth/social-app-django/commit/39da389c6b2a1d8f50768633269558fd609454b8"><code>39da389</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/python-social-auth/social-app-django/commit/0ec1bca6d6193e291a22f576ce30d44614258e96"><code>0ec1bca</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/python-social-auth/social-app-django/commit/03bce61f71978ae52fdd1db4118055f48de9f901"><code>03bce61</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/python-social-auth/social-app-django/commit/2278da6a1b20f9af23884084854b345a9284bf37"><code>2278da6</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/python-social-auth/social-app-django/commit/033302cdbf7a25ce900b6894bc0e683586b6162e"><code>033302c</code></a>
build(deps-dev): bump tox from 4.14.1 to 4.14.2</li>
<li><a
href="https://github.com/python-social-auth/social-app-django/commit/c50bc4a81127fff2fe4fdc619dd2e360bbe132b0"><code>c50bc4a</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li><a
href="https://github.com/python-social-auth/social-app-django/commit/13e10d943b836e68fcf7a7307d705519ec153481"><code>13e10d9</code></a>
[pre-commit.ci] pre-commit autoupdate</li>
<li>Additional commits viewable in <a
href="https://github.com/python-social-auth/social-app-django/compare/5.4.0...5.4.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=social-auth-app-django&package-manager=pip&previous-version=5.4.0&new-version=5.4.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/HyphaApp/hypha/network/alerts

).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [gunicorn](https://github.com/benoitc/gunicorn) from 21.2.0 to
22.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/benoitc/gunicorn/releases">gunicorn's
releases</a>.</em></p>
<blockquote>
<h2>Gunicorn 22.0 has been released</h2>
<p><strong>Gunicorn 22.0.0 has been released.</strong> This version fix
the numerous security vulnerabilities. You're invited to upgrade asap
your own installation.</p>
<p>Changes:</p>
<pre><code>22.0.0 - 2024-04-17
===================
<ul>
<li>use <code>utime</code> to notify workers liveness</li>
<li>migrate setup to pyproject.toml</li>
<li>fix numerous security vulnerabilities in HTTP parser (closing some
request smuggling vectors)</li>
<li>parsing additional requests is no longer attempted past unsupported
request framing</li>
<li>on HTTP versions &lt; 1.1 support for chunked transfer is refused
(only used in exploits)</li>
<li>requests conflicting configured or passed SCRIPT_NAME now produce a
verbose error</li>
<li>Trailer fields are no longer inspected for headers indicating secure
scheme</li>
<li>support Python 3.12</li>
</ul>
<p>** Breaking changes **</p>
<ul>
<li>minimum version is Python 3.7</li>
<li>the limitations on valid characters in the HTTP method have been
bounded to Internet Standards</li>
<li>requests specifying unsupported transfer coding (order) are refused
by default (rare)</li>
<li>HTTP methods are no longer casefolded by default (IANA method
registry contains none affected)</li>
<li>HTTP methods containing the number sign (#) are no longer accepted
by default (rare)</li>
<li>HTTP versions &lt; 1.0 or &gt;= 2.0 are no longer accepted by
default (rare, only HTTP/1.1 is supported)</li>
<li>HTTP versions consisting of multiple digits or containing a
prefix/suffix are no longer accepted</li>
<li>HTTP header field names Gunicorn cannot safely map to variables are
silently dropped, as in other software</li>
<li>HTTP headers with empty field name are refused by default (no
legitimate use cases, used in exploits)</li>
<li>requests with both Transfer-Encoding and Content-Length are refused
by default (such a message might indicate an attempt to perform request
smuggling)</li>
<li>empty transfer codings are no longer permitted (reportedly seen with
really old &amp; broken proxies)</li>
</ul>
<p>** SECURITY **</p>
<ul>
<li>fix CVE-2024-1135
</code></pre></li>
</ul>
<ol>
<li>Documentation is available there: <a
href="https://docs.gunicorn.org/en/stable/news.html">https://docs.gunicorn.org/en/stable/news.html</a></li>
<li>Packages: <a
href="https://pypi.org/project/gunicorn/">https://pypi.org/project/gunicorn/</a></li>
</ol>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/benoitc/gunicorn/commit/f63d59e4d73a8ee28748d2c700fb81c8780bc419"><code>f63d59e</code></a>
bump to 22.0</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/4ac81e0a1037ba5b570323be7430e09caa233e38"><code>4ac81e0</code></a>
Merge pull request <a
href="https://redirect.github.com/benoitc/gunicorn/issues/3175">#3175</a>
from e-kwsm/typo</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/401cecfaed85d79236c7a9a1f7d8946b01c466fc"><code>401cecf</code></a>
Merge pull request <a
href="https://redirect.github.com/benoitc/gunicorn/issues/3179">#3179</a>
from dhdaines/exclude-eventlet-0360</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/0243ec39ef4fc1b479ff4e1659e165f0b980b571"><code>0243ec3</code></a>
fix(deps): exclude eventlet 0.36.0</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/628a0bcb61ef3a211d67dfd68ad1ba161cccb3b8"><code>628a0bc</code></a>
chore: fix typos</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/88fc4a43152039c28096c8ba3eeadb3fbaa4aff9"><code>88fc4a4</code></a>
Merge pull request <a
href="https://redirect.github.com/benoitc/gunicorn/issues/3131">#3131</a>
from pajod/patch-py12-rebased</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/deae2fc4c5f93bfce59be5363055d4cd4ab1b0b6"><code>deae2fc</code></a>
CI: back off the agressive timeout</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/f4703824c323fe6867dce0e2f11013b8de319353"><code>f470382</code></a>
docs: promise 3.12 compat</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/5e30bfa6b1a3e1f2bde7feb514d1734d28f39231"><code>5e30bfa</code></a>
add changelog to project.urls (updated for PEP621)</li>
<li><a
href="https://github.com/benoitc/gunicorn/commit/481c3f9522edc58806a3efc5b49be4f202cc7700"><code>481c3f9</code></a>
remove setup.cfg - overridden by pyproject.toml</li>
<li>Additional commits viewable in <a
href="https://github.com/benoitc/gunicorn/compare/21.2.0...22.0.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gunicorn&package-manager=pip&previous-version=21.2.0&new-version=22.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/HyphaApp/hypha/network/alerts

).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [pillow](https://github.com/python-pillow/Pillow) from 10.2.0 to
10.3.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/python-pillow/Pillow/releases">pillow's
releases</a>.</em></p>
<blockquote>
<h2>10.3.0</h2>
<p><a
href="https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html">https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html</a></p>
<h2>Changes</h2>
<ul>
<li>CVE-2024-28219: Use strncpy to avoid buffer overflow <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7928">#7928</a>
[<a href="https://github.com/hugovk"><code>@​hugovk</code></a>]</li>
<li>Use <code>functools.lru_cache</code> for <code>hopper()</code> <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7912">#7912</a>
[<a href="https://github.com/hugovk"><code>@​hugovk</code></a>]</li>
<li>Raise ValueError if seeking to greater than offset-sized integer in
TIFF <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7883">#7883</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Improve speed of loading QOI images <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7925">#7925</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Added RGB to I;16N conversion <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7920">#7920</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Add --report argument to <strong>main</strong>.py to omit supported
formats <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7818">#7818</a>
[<a href="https://github.com/nulano"><code>@​nulano</code></a>]</li>
<li>Added RGB to I;16, I;16L and I;16B conversion <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7918">#7918</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Fix editable installation with custom build backend and
configuration options <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7658">#7658</a>
[<a href="https://github.com/nulano"><code>@​nulano</code></a>]</li>
<li>Fix putdata() for I;16N on big-endian <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7209">#7209</a>
[<a href="https://github.com/Yay295"><code>@​Yay295</code></a>]</li>
<li>Determine MPO size from markers, not EXIF data <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7884">#7884</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Improved conversion from RGB to RGBa, LA and La <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7888">#7888</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Support FITS images with GZIP_1 compression <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7894">#7894</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Use I;16 mode for 9-bit JPEG 2000 images <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7900">#7900</a>
[<a
href="https://github.com/scaramallion"><code>@​scaramallion</code></a>]</li>
<li>Raise ValueError if kmeans is negative <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7891">#7891</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Remove TIFF tag OSUBFILETYPE when saving using libtiff <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7893">#7893</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Raise ValueError for negative values when loading P1-P3 PPM images
<a
href="https://redirect.github.com/python-pillow/Pillow/issues/7882">#7882</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Added reading of JPEG2000 palettes <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7870">#7870</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Added alpha_quality argument when saving WebP images <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7872">#7872</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Fixed joined corners for ImageDraw rounded_rectangle() non-integer
dimensions <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7881">#7881</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Removed Python and NumPy pinning on Cygwin <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7880">#7880</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Update UnidentifiedImageError and <strong>version</strong> imports
<a
href="https://redirect.github.com/python-pillow/Pillow/issues/7644">#7644</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Stop reading EPS image at EOF marker <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7753">#7753</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>PSD layer co-ordinates may be negative <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7706">#7706</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Use subprocess with CREATE_NO_WINDOW flag in ImageShow WindowsViewer
<a
href="https://redirect.github.com/python-pillow/Pillow/issues/7791">#7791</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>When saving GIF frame that restores to background color, do not fill
identical pixels <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7788">#7788</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Fixed reading PNG iCCP compression method <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7823">#7823</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Allow writing IFDRational to UNDEFINED tag <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7840">#7840</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Fix logged tag name when loading Exif data <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7842">#7842</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Use maximum frame size in IHDR chunk when saving APNG images <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7821">#7821</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Prevent opening P TGA images without a palette <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7797">#7797</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Use palette when loading ICO images <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7798">#7798</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Use consistent arguments for load_read and load_seek <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7713">#7713</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Turn off nullability warnings for macOS SDK <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7827">#7827</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Fix shift-sign issue in Convert.c <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7838">#7838</a>
[<a href="https://github.com/r-barnes"><code>@​r-barnes</code></a>]</li>
<li>winbuild: Refactor dependency versions into constants <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7843">#7843</a>
[<a href="https://github.com/hugovk"><code>@​hugovk</code></a>]</li>
<li>Build macOS arm64 wheels natively <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7852">#7852</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Fixed typo <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7855">#7855</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Open 16-bit grayscale PNGs as I;16 <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7849">#7849</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Handle truncated chunks at the end of PNG images <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7709">#7709</a>
[<a href="https://github.com/lajiyuan"><code>@​lajiyuan</code></a>]</li>
<li>Match mask size to pasted image size in GifImagePlugin <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7779">#7779</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Changed SupportsGetMesh protocol to be public <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7841">#7841</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Release GIL while calling <code>WebPAnimDecoderGetNext</code> <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7782">#7782</a>
[<a
href="https://github.com/evanmiller"><code>@​evanmiller</code></a>]</li>
<li>Fixed reading FLI/FLC images with a prefix chunk <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7804">#7804</a>
[<a href="https://github.com/twolife"><code>@​twolife</code></a>]</li>
<li>Updated package name for Tidelift <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7810">#7810</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Removed unused code <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7744">#7744</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst">pillow's
changelog</a>.</em></p>
<blockquote>
<h2>10.3.0 (2024-04-01)</h2>
<ul>
<li>
<p>CVE-2024-28219: Use <code>strncpy</code> to avoid buffer overflow <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7928">#7928</a>
[radarhere, hugovk]</p>
</li>
<li>
<p>Deprecate <code>eval()</code>, replacing it with
<code>lambda_eval()</code> and <code>unsafe_eval()</code> <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7927">#7927</a>
[radarhere, hugovk]</p>
</li>
<li>
<p>Raise <code>ValueError</code> if seeking to greater than offset-sized
integer in TIFF <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7883">#7883</a>
[radarhere]</p>
</li>
<li>
<p>Add <code>--report</code> argument to <code>__main__.py</code> to
omit supported formats <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7818">#7818</a>
[nulano, radarhere, hugovk]</p>
</li>
<li>
<p>Added RGB to I;16, I;16L, I;16B and I;16N conversion <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7918">#7918</a>,
<a
href="https://redirect.github.com/python-pillow/Pillow/issues/7920">#7920</a>
[radarhere]</p>
</li>
<li>
<p>Fix editable installation with custom build backend and configuration
options <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7658">#7658</a>
[nulano, radarhere]</p>
</li>
<li>
<p>Fix putdata() for I;16N on big-endian <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7209">#7209</a>
[Yay295, hugovk, radarhere]</p>
</li>
<li>
<p>Determine MPO size from markers, not EXIF data <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7884">#7884</a>
[radarhere]</p>
</li>
<li>
<p>Improved conversion from RGB to RGBa, LA and La <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7888">#7888</a>
[radarhere]</p>
</li>
<li>
<p>Support FITS images with GZIP_1 compression <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7894">#7894</a>
[radarhere]</p>
</li>
<li>
<p>Use I;16 mode for 9-bit JPEG 2000 images <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7900">#7900</a>
[scaramallion, radarhere]</p>
</li>
<li>
<p>Raise ValueError if kmeans is negative <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7891">#7891</a>
[radarhere]</p>
</li>
<li>
<p>Remove TIFF tag OSUBFILETYPE when saving using libtiff <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7893">#7893</a>
[radarhere]</p>
</li>
<li>
<p>Raise ValueError for negative values when loading P1-P3 PPM images <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7882">#7882</a>
[radarhere]</p>
</li>
<li>
<p>Added reading of JPEG2000 palettes <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7870">#7870</a>
[radarhere]</p>
</li>
<li>
<p>Added alpha_quality argument when saving WebP images <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7872">#7872</a>
[radarhere]</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/python-pillow/Pillow/commit/5c89d88eee199ba53f64581ea39b6a1bc52feb1a"><code>5c89d88</code></a>
10.3.0 version bump</li>
<li><a
href="https://github.com/python-pillow/Pillow/commit/63cbfcfdea2d163ec93bae8d283fcfe4b73b5dc7"><code>63cbfcf</code></a>
Update CHANGES.rst [ci skip]</li>
<li><a
href="https://github.com/python-pillow/Pillow/commit/2776126aa9af322b416eaca247f4f8ebefd08128"><code>2776126</code></a>
Merge pull request <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7928">#7928</a>
from python-pillow/lcms</li>
<li><a
href="https://github.com/python-pillow/Pillow/commit/aeb51cbb169eb3285818ba1390ddf2771d897e6e"><code>aeb51cb</code></a>
Merge branch 'main' into lcms</li>
<li><a
href="https://github.com/python-pillow/Pillow/commit/5beb0b66648db8b542bb5260eed79b25e33d643b"><code>5beb0b6</code></a>
Update CHANGES.rst [ci skip]</li>
<li><a
href="https://github.com/python-pillow/Pillow/commit/cac6ffa7b399ea79b6239984d1307056a0b19af2"><code>cac6ffa</code></a>
Merge pull request <a
href="https://redirect.github.com/python-pillow/Pillow/issues/7927">#7927</a>
from python-pillow/imagemath</li>
<li><a
href="https://github.com/python-pillow/Pillow/commit/f5eeeacf7539eaa0d93a677d7666bc7c142c8d1c"><code>f5eeeac</code></a>
Name as 'options' in lambda_eval and unsafe_eval, but '_dict' in
deprecated eval</li>
<li><a
href="https://github.com/python-pillow/Pillow/commit/facf3af93dabcbdd8cdbda8c3b50eefafa3bb04c"><code>facf3af</code></a>
Added release notes</li>
<li><a
href="https://github.com/python-pillow/Pillow/commit/2a93aba5cfcf6e241ab4f9392c13e3b74032c061"><code>2a93aba</code></a>
Use strncpy to avoid buffer overflow</li>
<li><a
href="https://github.com/python-pillow/Pillow/commit/a670597bc30e9d489656fc9d807170b8f3d7ca57"><code>a670597</code></a>
Update CHANGES.rst [ci skip]</li>
<li>Additional commits viewable in <a
href="https://github.com/python-pillow/Pillow/compare/10.2.0...10.3.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pillow&package-manager=pip&previous-version=10.2.0&new-version=10.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/HyphaApp/hypha/network/alerts

).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

- Update requirements
- Replace classnames with classname
- update wagtail admin page of `settings -> users`

closes #3674

Fixes #3819

Fixes #3693 

Aims to fully replace bleach with nh3 due to bleach deprecation.
Currently, [django-nh3](https://github.com/marksweb/django-nh3) is in
it's infancy, but seems like it could be an almost drop in replacement
for [django-bleach](https://github.com/marksweb/django-bleach), for I
[forked it](https://github.com/wes-otf/django-nh3) and made some small
additions that would allow it to work for our purposes and be smoothly
migrated.

Initial smoke testing in Hypha seems to work exactly as bleach did but
needs more extensive testing. Ideally I would smooth out some edges of
my fork and put in a PR to django-nh3. Let me know any
thoughts/questions!

- Upgrade heroicons to 2.6.0, adds support for heroicons_mirco
- Remove/upgrade sprite icons
- Update icons in the global messages widget
- Remove unused bgg-logo sprite
- Update calendar icon with heroicon
- Update anchor-link icon
- Remove speech-bubble icon and link—-open-feed, link--close-feed and
link—to-top
- Remove arrow-up and arrow-down
- Remove arrow-split
- Remove "website" icon
- Remove “error” icon
- Update like & dislike button in the screening section
 - Remove 'bulb' svg from sprite
 - Remove 'hero-home-left-pixels' sprite
 - Remove 'hero-home-right-pixels' from sprite
 - Remove 'magnifying-glass' svg from sprite
-  Remove 'person-icon' and profile_button.html
 - Replace 'caret-down' and 'caret-up' icon
 - Remove 'side-arrow' from svg sprite
 - Remove 'add-user' icon, replace with 'user-plus'
 - Remove 'logo-desktop', 'logo-mobile' and 'logo-desktop--dark' icons
 - Remove 'logo-mobile-no-text' icon
 - Remove 'logo-mobile-dark' and 'logo-desktop--dark-alt'
 - Remove 'hero-standard-left-pixels' and 'hero-standard-right-pixels'
 - Remove 'eye' icon and replace with heroicon 'eye'
- Remove 'exclamation-point' icon and replace by heroicon
exlaimation-circle
 - Remove 'github' icon
 - Remove 'person-icon' and profile_button.html
 - Replace 'caret-down' and 'caret-up' icon
 - Remove 'side-arrow' from svg sprite

closes #3703 
depends on #3722

This is part of public site removal effort

Bleach==5.0.1 is installed as part of django-bleech dependency.

- Use `.python-version` and `.nvmrc` in CI script, single source of
truth
- Update version of python and node. 
- Update version of alpinejs, htmx and other build js
- Update minor versions of python dependencies

- Update psycopg to 3 as it’s not supported by Django 4.2
- Replaced “BaseUserManager().make_random_password”, as it’s deprecated
- Update github action and breakup different checks, making them easier
to debug
- Updated the `makemigrations` checks to display the missing migration
and then fail
- Upgrade django-hijack to 3.4.2
- Update gunicorn to 21.2.0
- Upgrade django slack to 5.19.0
- Upgrade mistune to 3.0.2 (Bug fix release)
- Upgrade whitenoise to 6.6.0
- Update dev dependencies - black, ruff, pre-commit, pytest-django

Closes https://github.com/HyphaApp/hypha/issues/3362

Fixes #ISSUEID

This PR is depended on #3521 

- [x] Passwordless login
- [x] Passwordless signup 
- [x] Allow user to set a password after going to profile.
- [x] Allow user to change their email even if they don't have an email
set.
- [x] Allow user to add their name in the application form if name is
not present in the user account.
- [x] Don't display "Dashboard" link if the user does't have permission
to access to it.
- [x] Allow to use to setup 2FA without account password.
- [x] Display user content on the login screen, if configured (it is an
existing feature)
- [x] If 2FA is enforced, allow the user to submit the application
without setting up 2FA
- [x] Add email re-verification option to elevate, sudo mode, apart from
password
- [x] Update landing page after application submission, on success it
redirects now.
- [x] Update ENABLE_PUBLIC_SIGNUP and FORCE_LOGIN_FOR_APPLICATION to
true by default

# Login/Signup Flow


![image](https://github.com/HyphaApp/hypha/assets/236356/91c22cb1-bd1f-4665-98e2-0350829a5807)


## Updated Login Page with Registration Enabled

![Screenshot 2023-09-13 at 07 53
06@2x](https://github.com/HyphaApp/hypha/assets/236356/424fa2f6-a519-44e3-a9ec-449815dd39b2)


## After providing the email ID

The messaging is kept neutral to hide if the user is already registered
or not. The email will contain more detail, if the account exist or not.

![Screenshot 2023-09-13 at 07 57
27@2x](https://github.com/HyphaApp/hypha/assets/236356/7577447b-edf2-496e-94ca-3c98a8f2f075)

Login email copy
![Screenshot 2023-09-13 at 08 08
36@2x](https://github.com/HyphaApp/hypha/assets/236356/ab2d3e90-da2e-40ec-9f7e-bbb8d9e7235f)

## Signup

New Account Email copy
![Screenshot 2023-09-21 at 07 08
52@2x](https://github.com/HyphaApp/hypha/assets/236356/cb14350b-1cfb-4869-b863-ebbb95701089)

### Profile Page just after signup 
The user after clicking on the signup link in the email is redirect to
homepage. No dashboard is available as the user doesn't have applicant
role. If they click on the "profile" button they see this page with open
to update profile and setup a password and enable 2FA.

If the user decide to change the email, password is not asked if not
password is set, instead an email is sent to authorize the email change.

![Screenshot 2023-09-22 at 08 50
21@2x](https://github.com/HyphaApp/hypha/assets/236356/7ed0cb97-a7ca-49fe-aef5-de8f3890db1e)


## Updated "Sudo" mode page

### For account with password

![Screenshot 2023-10-31 at 7  49
38@2x](https://github.com/HyphaApp/hypha/assets/236356/fe27ad75-7e4b-4226-89c1-ddd7a5548944)

After clicking on the "Send a confirmation code to your email" link

![Screenshot 2023-10-31 at 8  03
28@2x](https://github.com/HyphaApp/hypha/assets/236356/bf7a4098-fd0f-4d55-9850-0862da69d808)


![Screenshot 2023-10-31 at 7  51
03@2x](https://github.com/HyphaApp/hypha/assets/236356/3768e87f-d105-4d54-9cd6-2e2b8a81fa2f)


### For account without password

![Screenshot 2023-10-31 at 7  53
44@2x](https://github.com/HyphaApp/hypha/assets/236356/8c84181a-43ce-4afe-a5be-758e3f0e55f8)


## Updated disable 2FA page

It requires "Sudo" mode, instead of password now. 

![Screenshot 2023-10-31 at 7  48
01@2x](https://github.com/HyphaApp/hypha/assets/236356/2b5c8bd1-27ea-42cd-9c84-608bb351631c)

Notes: 

Wagtail 5x has migrations:
```
You have 11 unapplied migration(s). Your project may not work properly until you apply the migrations for app(s): wagtailcore, wagtailsearchpromotions, wagtailusers.
```

- Upgrade Django, wagtail-purge,
Django-pwned-password,django-basic-auth-ip-whitelist
- Move logic from DeleteView -> delete() to form_valid()
- Make test more robust
- Upgrade dj-database-url to 2.x, and enable CONN_HEALTH_CHECKS
- Bump django-two-factor-auth to 1.15.x that has confirmed support for
Django 4.1
- Bump django-ratelimit to 4.1.0
- django-pwned-passwords seems be abandoned
https://github.com/jamiecounsell/django-pwned-passwords/pull/11
(replaced with it with it's fork)

These all have are non-breaking changes

With the latest updates to python-docx, older APIs that are relied upon
by htmldocx have broken. This pins the version so htmldocx can utilize
the old APIs. For more info on this breakage see
[here](https://github.com/python-openxml/python-docx/issues/1256#issuecomment-1756839793).

Co-authored-by: Saurabh Kumar <theskumar@users.noreply.github.com>
Co-authored-by: Sandeep Chauhan <sandeepsajan0@gmail.com>

Bumps [reportlab](http://www.reportlab.com/) from 3.6.12 to 3.6.13.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=reportlab&package-manager=pip&previous-version=3.6.12&new-version=3.6.13)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/HyphaApp/hypha/network/alerts

).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Fixes #3430

- [x] Simplified code
- [x] Use postgres FTS search
- [x] Improve UX for filters
- [x]  Improve submission listing
- [x] Add filter for submission date, OTF have asked about this.
- [x] Add submission ID search, see
https://github.com/HyphaApp/hypha/pull/3294
- [x]  🏃🏼 Make sure the batch actions are working 
- [x]  🏃🏼 Permissions check for batch actions
- [x] Ensure search index works after submissions is updated
- [x] ~Integrate Django messages framework with htmx responses~ (Not
needed)
- [x] [Fix Polynomial regular expression used on uncontrolled
data](https://github.com/HyphaApp/hypha/security/code-scanning/74

)
- [ ] make bulk update status working, currently it's hidden.

---------

Co-authored-by: Fredrik Jonsson <frjo@xdeb.org>

Fixes #3395 

It was a package(django-formtools) issue, they have also mentioned it in
[latest
version](https://django-formtools.readthedocs.io/en/latest/changelog.html#id1).

Fixes #3018

- Update requirements - `wagtail` and `wagtail-cache`
- Update `BaseSetting` to `BaseSiteSettings`
- Fix Category StreamBlock at hypha/apply/categories/blocks.py
- Add migration changes
- Add `wagtail_reference_index_ignore = True` to models (See [this
issue](https://github.com/wagtail/wagtail/issues/9731

) on wagtail for
more info)
- Use checkboxes when selecting reviewers for a Round and a Lab
- Update `ReadOnlyPanel` to use `render_html()` method instead of
`render_as_object()`

---------

Co-authored-by: Fredrik Jonsson <frjo@xdeb.org>

Fixes #ISSUEID

Introduce tailwindcss[1] utilities and django-web-component[2] for
frontend design isolation and reusability.

Notes:
- Saas rules take preference over the tailwind (we might want to change
it)
- In the future, the saas should be depreciated, and reusable classes
should be updated to use tailwindcss

[1] https://tailwindcss.com/
[2] https://github.com/Xzya/django-web-components



---------

Co-authored-by: Fredrik Jonsson <frjo@xdeb.org>

- Add a guide on how to enable and setup sentry
- Upgrades sentry-sdk to 1.16.0
- Add optional performance monitoring
- Add Browser Javascript Tracking & Tracing

Fixes #3242

- Add htmx integration
- Add hx-boost for header nav; it degrades gracefully! 

Configure https://github.com/rstacruz/nprogress to show progress on ajax
activities.

Note: django-htmx is not used right now but will be used to add more
htmx-based functionalities.

Partial Fix #3127 

Upgrade following pip packages:
Production requirements
1. Sentry = 1.9.5 - 1.14.0
2. Babel = 2.9.1 - 2.11.0
3. boto3 = 1.26.27 - 1.26.57
4. celery = 5.2.2 - 5.2.7
5. django-anymail = 8.4 - 9.0
6. django-bleach = 3.0.0 - 3.0.1
7. django-countries = 7.2.1 - 7.5
8. django-extensions = 3.1.5 - 3.2.1
9. django-file-form = 3.4.1 - 3.4.3
10. django-fsm = 2.8.0 - 2.8.1
11. django-hijack = 3.1.4 - 3.2.6
12. django-redis = 5.1.0 - 5.2.0
13. django-salesforce = 4.0 - 4.1
14. django-select2 = 7.9.0 - 8.0
15. django-slack = 5.17.7 - 5.18.0
16. django-storages = 1.12.3 - 1.13.2
17. django-tables2 = 2.4.1 - 2.5.1
18. django-tinymce = 3.4.0 - 3.5.0
19. djangorestframework-api-key = 2.2.0 - 2.3.0
20. djangorestframework = 3.12.4 - 3.14.0
21. drf-yasg = 1.20.0 - 1.21.4
22. mailchimp3 = 3.0.16 - 3.0.17
23. mistune = 2.0.3 - 2.0.4
24. more-itertools = 8.12.0 - 9.0.0
25. phonenumberslite = 8.12.39 - 8.13.4
26. Pillow = 9.3.0 - 9.4.0
27. tablib = 3.2.1 - 3.3.0
28. xmltodict = 0.12.0 - 0.13.0
Dev requirements
29. django-debug-toolbar = 3.6.0 - 3.8.1
30. dslr = 0.3.1 - 0.4.0
31. ruff = 0.0.206 - 0.0.236
32. model-bakery = 1.7.0 - 1.10.1
33. pytest-xdist[psutil] = 2.5.0 - 3.1.0
34. responses = 0.21.0 - 0.22.0

Related https://github.com/HyphaApp/hypha-issues/issues/10

- Create/update superuser
- Set wagtail site domains

```
❯ ./manage.py initialize
Provide the details below to initialize Hypha Site. Press enter to keep the default value.

Domain of public site  [hypha.test]:
Domain of apply site  [apply.hypha.test]:
Superadmin Email  [superadmin@hypha.test]:
Superadmin Password  [hypha123]:
Site port [8090]:
>>> Created superuser with email superadmin@hypha.test.
>>> Set public site to hypha.test:8090
>>> Set apply site to apply.hypha.test:8090
```