Bump hypothesis from 6.150.3 to 6.151.2 (#3222)

Bumps [hypothesis](https://github.com/HypothesisWorks/hypothesis) from 6.150.3 to 6.151.2.
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](https://github.com/HypothesisWorks/hypothesis/compare/hypothesis-python-6.150.3...hypothesis-python-6.151.2)

---
updated-dependencies:
- dependency-name: hypothesis
  dependency-version: 6.151.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

app/cloudfoundry_config.py

@@ -10,7 +10,7 @@ class CloudfoundryConfig:
         self._empty_bucket_credentials = {
             "bucket": "",
             "access_key_id": "",
-            "secret_access_key": "",
+            "secret_access_key": "",  # nosec B105 - empty default, not a real password
             "region": "",
         }
 

app/main/views/send.py

@@ -846,7 +846,7 @@ def get_skip_link(step_index, template):
         and step_index == 0
         and template.template_type in ("sms", "email")
         and not (template.template_type == "sms" and current_user.mobile_number is None)
-        and current_user.has_permissions(ServicePermission.SEND_MESSAGES)
+        and current_user.has_permissions(ServicePermission.SEND_MESSAGES, allow_org_user=True)
     ):
         return (
             "Use my {}".format(first_column_headings[template.template_type][0]),

app/templates/views/templates/_template.html

@@ -8,7 +8,7 @@
     <p class="usa-hint">
       This template was deleted {{ template._template.updated_at|format_datetime_relative }}.
     </p>
-  {% elif not current_user.has_permissions(ServicePermission.SEND_MESSAGES, 'manage_api_keys', ServicePermission.MANAGE_TEMPLATES, ServicePermission.MANAGE_SERVICE) or not user_has_template_permission %}
+  {% elif not current_user.has_permissions(ServicePermission.SEND_MESSAGES, 'manage_api_keys', ServicePermission.MANAGE_TEMPLATES, ServicePermission.MANAGE_SERVICE, allow_org_user=True) or not user_has_template_permission %}
     <p class="top-gutter-1-3 {% if template.template_type != 'sms' %}margin-bottom-3{% endif %}">
       If you need to send this
       {{ 1|message_count_label(template.template_type, suffix='') }}
@@ -17,12 +17,12 @@
   {% else %}
     <div class="grid-row margin-bottom-5">
       <div class="usa-button-group">
-        {% if current_user.has_permissions(ServicePermission.SEND_MESSAGES, restrict_admin_usage=True) %}
+        {% if current_user.has_permissions(ServicePermission.SEND_MESSAGES, restrict_admin_usage=True, allow_org_user=True) %}
             <a href="{{ url_for(".set_sender", service_id=current_service.id, template_id=template.id) }}" class="usa-button usa-pill-separate-item">
               Use this template
             </a>
         {% endif %}
-        {% if current_user.has_permissions(ServicePermission.MANAGE_TEMPLATES) %}
+        {% if current_user.has_permissions(ServicePermission.MANAGE_TEMPLATES, allow_org_user=True) %}
             <a href="{{ url_for(".edit_service_template", service_id=current_service.id, template_id=template.id) }}" class="usa-button usa-button--outline usa-pill-separate-item">
               Edit this template
             </a>

app/utils/__init__.py

@@ -73,9 +73,9 @@ def unicode_truncate(s, length):
 
 def should_skip_template_page(db_template):
     return (
-        current_user.has_permissions(ServicePermission.SEND_MESSAGES)
+        current_user.has_permissions(ServicePermission.SEND_MESSAGES, allow_org_user=True)
         and not current_user.has_permissions(
-            ServicePermission.MANAGE_TEMPLATES, "manage_api_keys"
+            ServicePermission.MANAGE_TEMPLATES, "manage_api_keys", allow_org_user=True
         )
         and not db_template["archived"]
     )

package.json

@@ -38,16 +38,16 @@
     "cbor-js": "0.1.0",
     "ci-info": "^4.3.1",
     "d3": "^7.9.0",
-    "playwright": "^1.57.0",
+    "playwright": "^1.58.0",
     "python": "^0.0.4",
     "query-command-supported": "1.0.0",
-    "sass-embedded": "^1.93.3",
+    "sass-embedded": "^1.97.3",
     "textarea-caret": "3.1.0"
   },
   "devDependencies": {
-    "@babel/core": "^7.28.5",
-    "@babel/preset-env": "^7.28.5",
-    "autoprefixer": "^10.4.22",
+    "@babel/core": "^7.28.6",
+    "@babel/preset-env": "^7.28.6",
+    "autoprefixer": "^10.4.23",
     "babel-loader": "^10.0.0",
     "backstopjs": "^6.3.25",
     "better-npm-audit": "^3.11.0",
@@ -59,12 +59,12 @@
     "jshint": "2.13.6",
     "jshint-stylish": "2.2.1",
     "merge-stream": "^2.0.0",
-    "mini-css-extract-plugin": "^2.9.4",
+    "mini-css-extract-plugin": "^2.10.0",
     "postcss-loader": "^8.2.0",
-    "sass": "^1.94.2",
+    "sass": "^1.97.2",
     "sass-loader": "^16.0.6",
-    "terser-webpack-plugin": "^5.3.15",
-    "webpack": "^5.103.0",
+    "terser-webpack-plugin": "^5.3.16",
+    "webpack": "^5.104.1",
     "webpack-cli": "^6.0.1"
   }
 }

pyproject.toml

@@ -19,12 +19,12 @@ flask-basicauth = "~=0.2"
 flask-login = "^0.6"
 flask-talisman = "*"
 flask-wtf = "^1.2"
-gunicorn = {version = "==23.0.0", extras = ["gevent"]}
-hypothesis = "^6.148.7"
-humanize = "~=4.14"
+gunicorn = {version = "==24.1.1", extras = ["gevent"]}
+hypothesis = "^6.151.2"
+humanize = "~=4.15"
 itsdangerous = "~=2.2"
 jinja2 = "^3.1.6"
-newrelic = "^11.1.0"
+newrelic = "^11.3.0"
 pyexcel = "==0.7.4"
 pyexcel-io = "==0.6.7"
 pyexcel-ods3 = "==0.6.1"
@@ -34,32 +34,32 @@ openpyxl = "==3.0.10"
 pyproj = "==3.7.2"
 python-dotenv = "==1.2.1"
 rtreelib = "==0.2.0"
-werkzeug = "^3.1.4"
+werkzeug = "^3.1.5"
 wtforms = "~=3.1"
 markdown = "^3.10"
-mistune = "^3.1.4"
+mistune = "^3.2.0"
 async-timeout = "^5.0.1"
 bleach = "^6.3.0"
 boto3 = "^1.35.99"
 botocore = "^1.35.99"
-cachetools = "^6.2.2"
+cachetools = "^6.2.5"
 cffi = "^2.0.0"
 cryptography = "^46.0.3"
 flask-redis = "^0.4.0"
 geojson = "^3.1.0"
-jmespath = "^1.0.1"
-numpy = "^2.3.5"
+jmespath = "^1.1.0"
+numpy = "^2.4.1"
 ordered-set = "^4.1.0"
-phonenumbers = "^9.0.20"
-pycparser = "^2.23"
+phonenumbers = "^9.0.22"
+pycparser = "^3.0"
 pyjwt = "^2.10.1"
 python-json-logger = "^4.0.0"
 redis = "^7.1.0"
-regex = "^2025.11.3"
+regex = "^2026.1.15"
 s3transfer = "^0.10.2"
 shapely = "^2.1.2"
 smartypants = "^2.0.1"
-certifi = "^2025.11.12"
+certifi = "^2026.1.4"
 charset-normalizer = "^3.4.4"
 click = "^8.3.1"
 idna = "^3.11"
@@ -68,15 +68,15 @@ python-dateutil = "^2.9.0.post0"
 pyyaml = "^6.0.3"
 requests = "^2.32.5"
 six = "^1.16.0"
-urllib3 = "^2.6.0"
+urllib3 = "^2.6.3"
 webencodings = "^0.5.1"
-virtualenv = "<20.36"
+virtualenv = "<20.37"
 
 
 [tool.poetry.group.dev.dependencies]
 awscli = "^1.34.29"
 bandit = "*"
-black = "^25.11.0"
+black = "^26.1.0"
 coverage = "*"
 detect-secrets = "^1.5.0"
 freezegun = "^1.5.5"
@@ -85,11 +85,11 @@ flake8-bugbear = "^25.11.29"
 flake8-print = "^5.0.0"
 flake8-pytest-style = "^2.2.0"
 isort = "^7.0.0"
-jinja2-cli = {version = "==0.8.2", extras = ["yaml"]}
+jinja2-cli = {version = "==1.0.0", extras = ["yaml"]}
 moto = "*"
 pip-audit = "*"
-pre-commit = "^4.5.0"
-pytest = "^9.0.1"
+pre-commit = "^4.5.1"
+pytest = "^9.0.2"
 pytest-env = "^1.2.0"
 pytest-mock = "^3.15.1"
 pytest-playwright = "^0.7.2"