Merge pull request #3333 from GSA/main

06/19/2026 Production Deploy

.github/actions/setup-project/action.yml

@@ -10,7 +10,7 @@ runs:
         && sudo apt-get install -y --no-install-recommends \
         libcurl4-openssl-dev
     - name: Set up Python 3.13.2
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v6
       with:
         python-version: "3.13.2"
     - name: Install poetry

.github/dependabot.yml

@@ -3,18 +3,19 @@
 # Please see the documentation for all configuration options:
 # https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
 
+# Note: Setting open-pull-requests-limit to 0 disables version update PRs.
+# Security updates are still active and controlled separately in repository settings.
+
 version: 2
 updates:
   - package-ecosystem: 'pip' # See documentation for possible values
     directory: '/' # Location of package manifests
     schedule:
       interval: 'daily'
-    assignees:
-      - 'alexjanousekGSA'
+    open-pull-requests-limit: 0  # Disable version update PRs; security updates still active
   - package-ecosystem: 'npm'
     directory: '/'
     schedule:
       interval: 'daily'
+    open-pull-requests-limit: 0  # Disable version update PRs; security updates still active
     versioning-strategy: increase
-    assignees:
-      - 'alexjanousekGSA'

.github/workflows/checks.yml

@@ -22,9 +22,9 @@ jobs:
       contents: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: "22.3.0"
       - name: Install dependencies
@@ -87,7 +87,7 @@ jobs:
           - 6379:6379
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-project
       - uses: jwalton/gh-find-current-pr@v1
         id: findPr
@@ -123,7 +123,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: staging
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-project
       - name: Validate NewRelic config
         env:
@@ -136,7 +136,7 @@ jobs:
   dependency-audits:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-project
       - name: Create requirements.txt
         run: poetry export --output requirements.txt
@@ -145,13 +145,14 @@ jobs:
           inputs: requirements.txt
           ignore-vulns: |
             PYSEC-2023-312
+            CVE-2026-4539
       - name: Run npm audit
         run: make npm-audit
 
   static-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-project
       - name: Run scan
         run: poetry run bandit -r app/ --confidence-level medium
@@ -159,7 +160,7 @@ jobs:
   dynamic-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-project
       - name: Run server
         run: make run-flask &
@@ -178,7 +179,7 @@ jobs:
   a11y-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-project
       - name: Run server
         run: make run-flask &

.github/workflows/codeql.yml

@@ -58,7 +58,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/daily_checks.yml

@@ -22,7 +22,7 @@ jobs:
   dependency-audits:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - uses: ./.github/actions/setup-project
     - name: Create requirements.txt
       run: poetry export --output requirements.txt
@@ -31,13 +31,14 @@ jobs:
         inputs: requirements.txt
         ignore-vulns: |
             PYSEC-2023-312
+            CVE-2026-4539
     - name: Run npm audit
       run: make npm-audit
 
   static-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-project
       - name: Run scan
         run: poetry run bandit -r app/ --confidence-level medium
@@ -45,7 +46,7 @@ jobs:
   dynamic-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: ./.github/actions/setup-project
       - name: Run server
         run: make run-flask &

.github/workflows/deploy-demo.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: demo
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 2
 

.github/workflows/deploy-prod.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: production
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 2
 

.github/workflows/deploy.yml

@@ -17,7 +17,7 @@ jobs:
 
     environment: staging
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
         fetch-depth: 2
 
@@ -126,6 +126,6 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.event.workflow_run.conclusion == 'failure' }}
     steps:
-      - uses: actions/github-script@v6
+      - uses: actions/github-script@v9
         with:
           script: core.setFailed('Checks failed, not deploying')

.github/workflows/drift.yml

@@ -13,7 +13,7 @@ jobs:
     environment: staging
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       # Looks like we need to install Terraform ourselves now!
       # https://github.com/actions/runner-images/issues/10796#issuecomment-2417064348
@@ -51,7 +51,7 @@ jobs:
     environment: demo
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: 'production'
 
@@ -90,7 +90,7 @@ jobs:
     environment: production
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: 'production'
 

.github/workflows/terraform-demo.yml

@@ -16,7 +16,7 @@ jobs:
     environment: demo
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       # Looks like we need to install Terraform ourselves now!
       # https://github.com/actions/runner-images/issues/10796#issuecomment-2417064348
@@ -59,7 +59,7 @@ jobs:
 
       # inspiration: https://learn.hashicorp.com/tutorials/terraform/github-actions#review-actions-workflow
       - name: Update PR
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         # we would like to update the PR even when a prior step failed
         if: ${{ always() }}
         with:

.github/workflows/terraform-production.yml

@@ -16,7 +16,7 @@ jobs:
     environment: production
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       # Looks like we need to install Terraform ourselves now!
       # https://github.com/actions/runner-images/issues/10796#issuecomment-2417064348
@@ -59,7 +59,7 @@ jobs:
 
       # inspiration: https://learn.hashicorp.com/tutorials/terraform/github-actions#review-actions-workflow
       - name: Update PR
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         # we would like to update the PR even when a prior step failed
         if: ${{ always() }}
         with:

.github/workflows/terraform-staging.yml

@@ -16,7 +16,7 @@ jobs:
     environment: staging
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       # Looks like we need to install Terraform ourselves now!
       # https://github.com/actions/runner-images/issues/10796#issuecomment-2417064348
@@ -59,7 +59,7 @@ jobs:
 
       # inspiration: https://learn.hashicorp.com/tutorials/terraform/github-actions#review-actions-workflow
       - name: Update PR
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         # we would like to update the PR even when a prior step failed
         if: ${{ always() }}
         with:

README.md

@@ -316,7 +316,7 @@ the VSCode dev container.
 1. `make run-flask` from within the devcontainer
 2. Run `make a11y-scan` from your host computer.
 
-## Further docs from UK
+## Further documentation
 
 - [Working with static assets](docs/static-assets.md)
 - [JavaScript documentation](https://github.com/alphagov/notifications-manuals/wiki/JavaScript-Documentation)

app/templates/components/browse-list.html

@@ -1,7 +1,7 @@
 {% macro browse_list(items) %}
   {% if items %}
     <nav class="browse-list">
-      <ul>
+      <ul class="usa-list usa-list--unstyled">
         {% for item in items %}
           {% if item.title and item.link %}
             <li class="browse-list-item">

app/templates/views/choose-account.html

@@ -15,14 +15,14 @@
         </h2>
       </div>
       <div class="grid-col-9 margin-top-1">
-        <ul>
+        <ul class="usa-list usa-list--unstyled">
   {% else %}
-    <ul>
+    <ul class="usa-list usa-list--unstyled">
   {% endif %}
   {% for org in organizations|sort %}
     <li class="browse-list-item margin-y-2">
       <a href="{{ url_for('.organization_dashboard', org_id=org.id) }}" class="usa-link">{{ org.name }}</a>
-      <p class="browse-list-hint">
+      <p class="browse-list-hint margin-top-05 margin-bottom-0 text-base font-body-xs">
         {{ org.count_of_live_services }}
         live service{% if org.count_of_live_services != 1 %}s{% endif %}
       </p>
@@ -62,10 +62,10 @@
             Platform admin
           </h2>
         </div>
-        <ul class="grid-col-9 margin-top-3">
-          <li class="browse-list-item">
+        <ul class="usa-list usa-list--unstyled grid-col-9 margin-top-3">
+          <li class="browse-list-item margin-y-2">
             <a href="{{ url_for('.organizations') }}" class="usa-link">All organizations</a>
-            <p class="browse-list-hint">
+            <p class="browse-list-hint margin-top-05 margin-bottom-0 text-base font-body-xs">
               {{ org_count|format_thousands }} organizations, {{ live_service_count|format_thousands }} live services
             </p>
           </li>

app/templates/views/organizations/organization/index.html

@@ -11,12 +11,12 @@
 
   <div class="margin-bottom-3">
     <div class="grid-row flex-align-center">
-      <h2 id="chartTitle" class="margin-right-1 margin-y-0">Overall {{ selected_year }} Messages Sent</h2>
+      <h2 id="chartTitle" class="margin-right-1 margin-y-0">Overall {{ selected_year }} Usage</h2>
       <button
         type="button"
         class="usa-tooltip usa-tooltip__information margin-right-0"
         data-position="top"
-        title="Total messages sent across all services in {{ current_org.name }}"
+        title="Combined totals for all services in {{ current_org.name }} for the current agreement period"
       >
         <span class="usa-sr-only">More information</span>
         <img src="{{ asset_url('img/usa-icons/info.svg') }}" alt="" class="usa-icon" role="presentation" />
@@ -85,8 +85,8 @@
 
   {% if invite_user_form %}
     <div id="invite-user-form" class="bg-base-lightest padding-3 radius-md margin-bottom-3">
-      <h3 class="margin-top-0">Invite a team member</h3>
-      <p class="margin-top-0">{{ current_org.name }} team members can see usage and team members for each service, and invite other team members.</p>
+      <h3 class="margin-top-0">Invite an organization administrator</h3>
+      <p class="margin-top-0">{{ current_org.name }} administrators can access and manage all services, and invite or remove other organization administrators.</p>
       <form method="post" action="{{ url_for('.organization_dashboard', org_id=current_org.id, action='invite-user') }}">
         <input type="hidden" name="csrf_token" value="{{ invite_user_form.csrf_token._value() }}"/>
 

app/templates/views/organizations/organization/users/invite-org-user.html

@@ -6,7 +6,7 @@
 {% from "components/components/back-link/macro.njk" import usaBackLink %}
 
 {% block service_page_title %}
-  Invite a team member
+  Invite an organization administrator
 {% endblock %}
 
 {% block backLink %}

notifications_python_client/authentication.py

@@ -21,7 +21,7 @@ INVALID_FUTURE_TOKEN_ERROR_MESSAGE = "Token can not be in the future"
 
 def create_jwt_token(secret, client_id):
     """
-    Create JWT token for GOV.UK Notify
+    Create JWT token for Notify.gov
 
     Tokens have standard header:
     {

notifications_python_client/errors.py

@@ -6,7 +6,7 @@ REQUEST_ERROR_STATUS_CODE = 503
 REQUEST_ERROR_MESSAGE = "Request failed"
 
 TOKEN_ERROR_GUIDANCE = "See our requirements for JSON Web Tokens \
-    at https://docs.notifications.service.gov.uk/rest-api.html#authorisation-header"
+    at https://github.com/GSA/notifications-api/tree/main/docs"
 TOKEN_ERROR_DEFAULT_ERROR_MESSAGE = "Invalid token: " + TOKEN_ERROR_GUIDANCE
 
 

notifications_utils/jinja_templates/letter_pdf/_head.jinja2

@@ -3,5 +3,5 @@
   <head>
     <meta charset="utf-8" />
     <title>
-      Preview – GOV.UK Notify
+      Preview – Notify.gov
     </title>

notifications_utils/template.py

@@ -557,7 +557,7 @@ class BaseEmailTemplate(SubjectMixin, Template):
         That's still an extremely long email, and should be sufficient for all normal use, while at the same
         time giving us safe margin while sending the emails through Amazon SES.
 
-        EDIT: putting size up to 2MB as GOV.UK email digests are hitting the limit.
+        EDIT: putting size up to 2MB as email digests were hitting the limit.
         """
         return self.content_size_in_bytes > 2000000
 

package.json

@@ -28,7 +28,9 @@
   "homepage": "https://github.com/GSA/notifications-admin#readme",
   "overrides": {
     "graceful-fs": "^4.2.11",
-    "glob@^10": "10.5.0"
+    "glob@^10": "10.5.0",
+    "rollup": "^4.59.0",
+    "picomatch": "^4.0.4"
   },
   "dependencies": {
     "@rollup/plugin-commonjs": "^29.0.0",
@@ -36,23 +38,24 @@
     "@rollup/stream": "^3.0.1",
     "@uswds/uswds": "^3.13.0",
     "cbor-js": "0.1.0",
-    "ci-info": "^4.3.1",
+    "ci-info": "^4.4.0",
     "d3": "^7.9.0",
-    "playwright": "^1.58.0",
+    "playwright": "^1.58.2",
     "python": "^0.0.4",
     "query-command-supported": "1.0.0",
     "sass-embedded": "^1.97.3",
-    "textarea-caret": "3.1.0"
+    "textarea-caret": "3.1.0",
+    "immutable": "^5.1.5"
   },
   "devDependencies": {
-    "@babel/core": "^7.28.6",
-    "@babel/preset-env": "^7.28.6",
-    "autoprefixer": "^10.4.23",
+    "@babel/core": "^7.29.0",
+    "@babel/preset-env": "^7.29.0",
+    "autoprefixer": "^10.4.27",
     "babel-loader": "^10.0.0",
     "backstopjs": "^6.3.25",
     "better-npm-audit": "^3.11.0",
-    "copy-webpack-plugin": "^13.0.1",
-    "css-loader": "^7.1.2",
+    "copy-webpack-plugin": "^14.0.0",
+    "css-loader": "^7.1.4",
     "jest": "^30.2.0",
     "jest-each": "^30.1.0",
     "jest-environment-jsdom": "^30.2.0",
@@ -60,11 +63,11 @@
     "jshint-stylish": "2.2.1",
     "merge-stream": "^2.0.0",
     "mini-css-extract-plugin": "^2.10.0",
-    "postcss-loader": "^8.2.0",
+    "postcss-loader": "^8.2.1",
     "sass": "^1.97.2",
-    "sass-loader": "^16.0.6",
-    "terser-webpack-plugin": "^5.3.16",
-    "webpack": "^5.104.1",
+    "sass-loader": "^16.0.7",
+    "terser-webpack-plugin": "^5.3.17",
+    "webpack": "^5.105.3",
     "webpack-cli": "^6.0.1"
   }
 }

pyproject.toml

@@ -12,6 +12,7 @@ python = "^3.13.2"
 ago = "~=0.1.0"
 beautifulsoup4 = "^4.14.3"
 blinker = "~=1.8"
+dulwich = "^1.2.5"
 gevent = "==25.9.1"
 exceptiongroup = "==1.3.1"
 flask = "~=3.1"
@@ -19,12 +20,12 @@ flask-basicauth = "~=0.2"
 flask-login = "^0.6"
 flask-talisman = "*"
 flask-wtf = "^1.2"
-gunicorn = {version = "==24.1.1", extras = ["gevent"]}
-hypothesis = "^6.151.2"
+gunicorn = {version = "==25.1.0", extras = ["gevent"]}
+hypothesis = "^6.151.9"
 humanize = "~=4.15"
 itsdangerous = "~=2.2"
 jinja2 = "^3.1.6"
-newrelic = "^11.3.0"
+newrelic = "^11.5.0"
 pyexcel = "==0.7.4"
 pyexcel-io = "==0.6.7"
 pyexcel-ods3 = "==0.6.1"
@@ -32,51 +33,51 @@ pyexcel-xls = "==0.7.1"
 pyexcel-xlsx = "==0.6.1"
 openpyxl = "==3.0.10"
 pyproj = "==3.7.2"
-python-dotenv = "==1.2.1"
+python-dotenv = "==1.2.2"
 rtreelib = "==0.2.0"
 werkzeug = "^3.1.5"
 wtforms = "~=3.1"
 markdown = "^3.10"
-mistune = "^3.2.0"
+mistune = "^3.2.1"
 async-timeout = "^5.0.1"
-bleach = "^6.3.0"
+bleach = "^6.4.0"
 boto3 = "^1.35.99"
 botocore = "^1.35.99"
-cachetools = "^6.2.5"
+cachetools = "^7.0.1"
 cffi = "^2.0.0"
-cryptography = "^46.0.3"
+cryptography = "^48.0.1"
 flask-redis = "^0.4.0"
 geojson = "^3.1.0"
 jmespath = "^1.1.0"
-numpy = "^2.4.1"
+numpy = "^2.4.2"
 ordered-set = "^4.1.0"
-phonenumbers = "^9.0.22"
+phonenumbers = "^9.0.25"
 pycparser = "^3.0"
-pyjwt = "^2.10.1"
+pyjwt = "^2.13.0"
 python-json-logger = "^4.0.0"
-redis = "^7.1.0"
-regex = "^2026.1.15"
+redis = "^7.2.1"
+regex = "^2026.2.19"
 s3transfer = "^0.10.2"
 shapely = "^2.1.2"
 smartypants = "^2.0.1"
-certifi = "^2026.1.4"
+certifi = "^2026.2.25"
 charset-normalizer = "^3.4.4"
 click = "^8.3.1"
-idna = "^3.11"
+idna = "^3.15"
 markupsafe = "^3.0.3"
 python-dateutil = "^2.9.0.post0"
 pyyaml = "^6.0.3"
-requests = "^2.32.5"
+requests = "^2.33.0"
 six = "^1.16.0"
 urllib3 = "^2.6.3"
 webencodings = "^0.5.1"
-virtualenv = "<20.37"
+virtualenv = "<21.2"
 
 
 [tool.poetry.group.dev.dependencies]
 awscli = "^1.34.29"
 bandit = "*"
-black = "^26.1.0"
+black = "^26.3.1"
 coverage = "*"
 detect-secrets = "^1.5.0"
 freezegun = "^1.5.5"
@@ -84,13 +85,13 @@ flake8 = "^7.3.0"
 flake8-bugbear = "^25.11.29"
 flake8-print = "^5.0.0"
 flake8-pytest-style = "^2.2.0"
-isort = "^7.0.0"
+isort = "^8.0.0"
 jinja2-cli = {version = "==1.0.0", extras = ["yaml"]}
 moto = "*"
 pip-audit = "*"
 pre-commit = "^4.5.1"
-pytest = "^9.0.2"
-pytest-env = "^1.2.0"
+pytest = "^9.0.3"
+pytest-env = "^1.5.0"
 pytest-mock = "^3.15.1"
 pytest-playwright = "^0.7.2"
 pytest-xdist = "^3.8.0"