Bump govuk_app_config from 2.10.0 to 5.1.0

[dependabot]

Bumps govuk_app_config from 2.10.0 to 5.1.0.

Changelog

Sourced from govuk_app_config's changelog.

5.1.0

• Add support to force-load the GovukPrometheusExporter by setting GOVUK_PROMETHEUS_EXPORTER to force. (#282)

5.0.0

• Forbid base elements in the Content Security Policy
• BREAKING: Content Security Policy forbids unsafe-inline script-src and data: image-src. It provides a nonce generator. Apps that can't support this will need to amend their CSP configuration in an initializer, see example in signon. Any apps that still use jQuery 1.x will need unsafe-inline for Firefox compatibility.

4.13.0

• Flush log writes to stdout immediately so that structured (JSON) logs are not lost on crash or delayed indefinitely.

4.12.0

• Allow https://img.youtube.com as a CSP image source
• CSP only allows scripts, styles and fonts from self which reflects GOV.UK production behaviour
• Set the default CSP behaviour to be allow communication only to self
• Remove webchat scripts from the CSP, these are now handled in government-frontend
• Remove www.signin.service.gov.uk from the CSP as it is no-longer used in GOV.UK
• Disallow data fonts in the global Content Security policy

4.11.1

• Remove govuk_i18n plural rules file

4.11.0

• Update Plek support to allow version 5
• Add I18n plural rules for Welsh (cy), Maltese (mt) and Chinese (zh) since Rails-I18n has dropped support for them in 7.0.6 (#266)

4.10.1

• Fix an object ownership/sharing bug where the Rails log level was erroneously being set to WARN when initialising Sentry.

4.10.0

• Reduce log level for the Sentry gem from INFO to WARN to avoid polluting logs with uninformative messages. This only affects log messages from the Sentry gem itself, which go to stdout.

4.9.0

• Add GovukProxy::StaticProxy to forward Static asset requests by setting GOVUK_PROXY_STATIC_ENABLED=true.(#261)

4.8.0

• Enables Sentry environment names for EKS versions of integration, staging and production.(#260)

4.7.1

• Fix the ability to open the Rails console (bundle exec rails c) when running inside a container (#257).

... (truncated)

Commits

• 0ff7984 Merge pull request #282 from alphagov/dj-maisy/prometheus-override
• 923c037 Update CHANGELOG and bump version number.
• 14c9457 Allow us to force-load the Prometheus Exporter...
• 94d3b94 Merge pull request #281 from alphagov/dependabot/bundler/rubocop-govuk-eq-4.10.0
• ecc72eb Update rubocop-govuk requirement from = 4.9.0 to = 4.10.0
• 5478c06 Merge pull request #279 from alphagov/aspirational-csp
• 414e539 Release as version 5.0.0
• c138810 Disallow a base element via the content-security-policy
• 7596544 Apply December 2022 CSP intentions
• 13083f8 Merge pull request #278 from alphagov/kevindew-patch-1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)