Bump @babel/plugin-transform-modules-systemjs from 7.29.0 to 7.29.4

Bumps [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) from 7.29.0 to 7.29.4.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.4/packages/babel-plugin-transform-modules-systemjs)

---
updated-dependencies:
- dependency-name: "@babel/plugin-transform-modules-systemjs"
  dependency-version: 7.29.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/dependabot.yml

@@ -3,18 +3,19 @@
 # Please see the documentation for all configuration options:
 # https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
 
+# Note: Setting open-pull-requests-limit to 0 disables version update PRs.
+# Security updates are still active and controlled separately in repository settings.
+
 version: 2
 updates:
   - package-ecosystem: 'pip' # See documentation for possible values
     directory: '/' # Location of package manifests
     schedule:
       interval: 'daily'
-    assignees:
-      - 'alexjanousekGSA'
+    open-pull-requests-limit: 0  # Disable version update PRs; security updates still active
   - package-ecosystem: 'npm'
     directory: '/'
     schedule:
       interval: 'daily'
+    open-pull-requests-limit: 0  # Disable version update PRs; security updates still active
     versioning-strategy: increase
-    assignees:
-      - 'alexjanousekGSA'

.github/workflows/checks.yml

@@ -145,6 +145,7 @@ jobs:
           inputs: requirements.txt
           ignore-vulns: |
             PYSEC-2023-312
+            CVE-2026-4539
       - name: Run npm audit
         run: make npm-audit
 

.github/workflows/daily_checks.yml

@@ -31,6 +31,7 @@ jobs:
         inputs: requirements.txt
         ignore-vulns: |
             PYSEC-2023-312
+            CVE-2026-4539
     - name: Run npm audit
       run: make npm-audit
 

README.md

@@ -316,7 +316,7 @@ the VSCode dev container.
 1. `make run-flask` from within the devcontainer
 2. Run `make a11y-scan` from your host computer.
 
-## Further docs from UK
+## Further documentation
 
 - [Working with static assets](docs/static-assets.md)
 - [JavaScript documentation](https://github.com/alphagov/notifications-manuals/wiki/JavaScript-Documentation)

app/templates/components/browse-list.html

@@ -1,7 +1,7 @@
 {% macro browse_list(items) %}
   {% if items %}
     <nav class="browse-list">
-      <ul>
+      <ul class="usa-list usa-list--unstyled">
         {% for item in items %}
           {% if item.title and item.link %}
             <li class="browse-list-item">

app/templates/views/choose-account.html

@@ -15,14 +15,14 @@
         </h2>
       </div>
       <div class="grid-col-9 margin-top-1">
-        <ul>
+        <ul class="usa-list usa-list--unstyled">
   {% else %}
-    <ul>
+    <ul class="usa-list usa-list--unstyled">
   {% endif %}
   {% for org in organizations|sort %}
     <li class="browse-list-item margin-y-2">
       <a href="{{ url_for('.organization_dashboard', org_id=org.id) }}" class="usa-link">{{ org.name }}</a>
-      <p class="browse-list-hint">
+      <p class="browse-list-hint margin-top-05 margin-bottom-0 text-base font-body-xs">
         {{ org.count_of_live_services }}
         live service{% if org.count_of_live_services != 1 %}s{% endif %}
       </p>
@@ -62,10 +62,10 @@
             Platform admin
           </h2>
         </div>
-        <ul class="grid-col-9 margin-top-3">
-          <li class="browse-list-item">
+        <ul class="usa-list usa-list--unstyled grid-col-9 margin-top-3">
+          <li class="browse-list-item margin-y-2">
             <a href="{{ url_for('.organizations') }}" class="usa-link">All organizations</a>
-            <p class="browse-list-hint">
+            <p class="browse-list-hint margin-top-05 margin-bottom-0 text-base font-body-xs">
               {{ org_count|format_thousands }} organizations, {{ live_service_count|format_thousands }} live services
             </p>
           </li>

app/templates/views/organizations/organization/index.html

@@ -11,12 +11,12 @@
 
   <div class="margin-bottom-3">
     <div class="grid-row flex-align-center">
-      <h2 id="chartTitle" class="margin-right-1 margin-y-0">Overall {{ selected_year }} Messages Sent</h2>
+      <h2 id="chartTitle" class="margin-right-1 margin-y-0">Overall {{ selected_year }} Usage</h2>
       <button
         type="button"
         class="usa-tooltip usa-tooltip__information margin-right-0"
         data-position="top"
-        title="Total messages sent across all services in {{ current_org.name }}"
+        title="Combined totals for all services in {{ current_org.name }} for the current agreement period"
       >
         <span class="usa-sr-only">More information</span>
         <img src="{{ asset_url('img/usa-icons/info.svg') }}" alt="" class="usa-icon" role="presentation" />
@@ -85,8 +85,8 @@
 
   {% if invite_user_form %}
     <div id="invite-user-form" class="bg-base-lightest padding-3 radius-md margin-bottom-3">
-      <h3 class="margin-top-0">Invite a team member</h3>
-      <p class="margin-top-0">{{ current_org.name }} team members can see usage and team members for each service, and invite other team members.</p>
+      <h3 class="margin-top-0">Invite an organization administrator</h3>
+      <p class="margin-top-0">{{ current_org.name }} administrators can access and manage all services, and invite or remove other organization administrators.</p>
       <form method="post" action="{{ url_for('.organization_dashboard', org_id=current_org.id, action='invite-user') }}">
         <input type="hidden" name="csrf_token" value="{{ invite_user_form.csrf_token._value() }}"/>
 

app/templates/views/organizations/organization/users/invite-org-user.html

@@ -6,7 +6,7 @@
 {% from "components/components/back-link/macro.njk" import usaBackLink %}
 
 {% block service_page_title %}
-  Invite a team member
+  Invite an organization administrator
 {% endblock %}
 
 {% block backLink %}

notifications_python_client/authentication.py

@@ -21,7 +21,7 @@ INVALID_FUTURE_TOKEN_ERROR_MESSAGE = "Token can not be in the future"
 
 def create_jwt_token(secret, client_id):
     """
-    Create JWT token for GOV.UK Notify
+    Create JWT token for Notify.gov
 
     Tokens have standard header:
     {

notifications_python_client/errors.py

@@ -6,7 +6,7 @@ REQUEST_ERROR_STATUS_CODE = 503
 REQUEST_ERROR_MESSAGE = "Request failed"
 
 TOKEN_ERROR_GUIDANCE = "See our requirements for JSON Web Tokens \
-    at https://docs.notifications.service.gov.uk/rest-api.html#authorisation-header"
+    at https://github.com/GSA/notifications-api/tree/main/docs"
 TOKEN_ERROR_DEFAULT_ERROR_MESSAGE = "Invalid token: " + TOKEN_ERROR_GUIDANCE
 
 

notifications_utils/jinja_templates/letter_pdf/_head.jinja2

@@ -3,5 +3,5 @@
   <head>
     <meta charset="utf-8" />
     <title>
-      Preview – GOV.UK Notify
+      Preview – Notify.gov
     </title>

notifications_utils/template.py

@@ -557,7 +557,7 @@ class BaseEmailTemplate(SubjectMixin, Template):
         That's still an extremely long email, and should be sufficient for all normal use, while at the same
         time giving us safe margin while sending the emails through Amazon SES.
 
-        EDIT: putting size up to 2MB as GOV.UK email digests are hitting the limit.
+        EDIT: putting size up to 2MB as email digests were hitting the limit.
         """
         return self.content_size_in_bytes > 2000000
 

package.json

@@ -28,7 +28,9 @@
   "homepage": "https://github.com/GSA/notifications-admin#readme",
   "overrides": {
     "graceful-fs": "^4.2.11",
-    "glob@^10": "10.5.0"
+    "glob@^10": "10.5.0",
+    "rollup": "^4.59.0",
+    "picomatch": "^4.0.4"
   },
   "dependencies": {
     "@rollup/plugin-commonjs": "^29.0.0",
@@ -36,23 +38,24 @@
     "@rollup/stream": "^3.0.1",
     "@uswds/uswds": "^3.13.0",
     "cbor-js": "0.1.0",
-    "ci-info": "^4.3.1",
+    "ci-info": "^4.4.0",
     "d3": "^7.9.0",
-    "playwright": "^1.58.0",
+    "playwright": "^1.58.2",
     "python": "^0.0.4",
     "query-command-supported": "1.0.0",
     "sass-embedded": "^1.97.3",
-    "textarea-caret": "3.1.0"
+    "textarea-caret": "3.1.0",
+    "immutable": "^5.1.5"
   },
   "devDependencies": {
-    "@babel/core": "^7.28.6",
-    "@babel/preset-env": "^7.28.6",
-    "autoprefixer": "^10.4.23",
+    "@babel/core": "^7.29.0",
+    "@babel/preset-env": "^7.29.0",
+    "autoprefixer": "^10.4.27",
     "babel-loader": "^10.0.0",
     "backstopjs": "^6.3.25",
     "better-npm-audit": "^3.11.0",
-    "copy-webpack-plugin": "^13.0.1",
-    "css-loader": "^7.1.2",
+    "copy-webpack-plugin": "^14.0.0",
+    "css-loader": "^7.1.4",
     "jest": "^30.2.0",
     "jest-each": "^30.1.0",
     "jest-environment-jsdom": "^30.2.0",
@@ -60,11 +63,11 @@
     "jshint-stylish": "2.2.1",
     "merge-stream": "^2.0.0",
     "mini-css-extract-plugin": "^2.10.0",
-    "postcss-loader": "^8.2.0",
+    "postcss-loader": "^8.2.1",
     "sass": "^1.97.2",
-    "sass-loader": "^16.0.6",
-    "terser-webpack-plugin": "^5.3.16",
-    "webpack": "^5.104.1",
+    "sass-loader": "^16.0.7",
+    "terser-webpack-plugin": "^5.3.17",
+    "webpack": "^5.105.3",
     "webpack-cli": "^6.0.1"
   }
 }

pyproject.toml

@@ -19,12 +19,12 @@ flask-basicauth = "~=0.2"
 flask-login = "^0.6"
 flask-talisman = "*"
 flask-wtf = "^1.2"
-gunicorn = {version = "==24.1.1", extras = ["gevent"]}
-hypothesis = "^6.150.3"
+gunicorn = {version = "==25.1.0", extras = ["gevent"]}
+hypothesis = "^6.151.9"
 humanize = "~=4.15"
 itsdangerous = "~=2.2"
 jinja2 = "^3.1.6"
-newrelic = "^11.3.0"
+newrelic = "^11.5.0"
 pyexcel = "==0.7.4"
 pyexcel-io = "==0.6.7"
 pyexcel-ods3 = "==0.6.1"
@@ -32,51 +32,51 @@ pyexcel-xls = "==0.7.1"
 pyexcel-xlsx = "==0.6.1"
 openpyxl = "==3.0.10"
 pyproj = "==3.7.2"
-python-dotenv = "==1.2.1"
+python-dotenv = "==1.2.2"
 rtreelib = "==0.2.0"
 werkzeug = "^3.1.5"
 wtforms = "~=3.1"
 markdown = "^3.10"
-mistune = "^3.2.0"
+mistune = "^3.2.1"
 async-timeout = "^5.0.1"
 bleach = "^6.3.0"
 boto3 = "^1.35.99"
 botocore = "^1.35.99"
-cachetools = "^6.2.4"
+cachetools = "^7.0.1"
 cffi = "^2.0.0"
-cryptography = "^46.0.3"
+cryptography = "^46.0.7"
 flask-redis = "^0.4.0"
 geojson = "^3.1.0"
 jmespath = "^1.1.0"
-numpy = "^2.4.1"
+numpy = "^2.4.2"
 ordered-set = "^4.1.0"
-phonenumbers = "^9.0.22"
+phonenumbers = "^9.0.25"
 pycparser = "^3.0"
-pyjwt = "^2.10.1"
+pyjwt = "^2.12.0"
 python-json-logger = "^4.0.0"
-redis = "^7.1.0"
-regex = "^2026.1.15"
+redis = "^7.2.1"
+regex = "^2026.2.19"
 s3transfer = "^0.10.2"
 shapely = "^2.1.2"
 smartypants = "^2.0.1"
-certifi = "^2026.1.4"
+certifi = "^2026.2.25"
 charset-normalizer = "^3.4.4"
 click = "^8.3.1"
 idna = "^3.11"
 markupsafe = "^3.0.3"
 python-dateutil = "^2.9.0.post0"
 pyyaml = "^6.0.3"
-requests = "^2.32.5"
+requests = "^2.33.0"
 six = "^1.16.0"
 urllib3 = "^2.6.3"
 webencodings = "^0.5.1"
-virtualenv = "<20.37"
+virtualenv = "<21.2"
 
 
 [tool.poetry.group.dev.dependencies]
 awscli = "^1.34.29"
 bandit = "*"
-black = "^26.1.0"
+black = "^26.3.1"
 coverage = "*"
 detect-secrets = "^1.5.0"
 freezegun = "^1.5.5"
@@ -84,13 +84,13 @@ flake8 = "^7.3.0"
 flake8-bugbear = "^25.11.29"
 flake8-print = "^5.0.0"
 flake8-pytest-style = "^2.2.0"
-isort = "^7.0.0"
+isort = "^8.0.0"
 jinja2-cli = {version = "==1.0.0", extras = ["yaml"]}
 moto = "*"
 pip-audit = "*"
 pre-commit = "^4.5.1"
-pytest = "^9.0.2"
-pytest-env = "^1.2.0"
+pytest = "^9.0.3"
+pytest-env = "^1.5.0"
 pytest-mock = "^3.15.1"
 pytest-playwright = "^0.7.2"
 pytest-xdist = "^3.8.0"