Update renovate/renovate Docker tag to v44.93.5

Release-Bump: minor

.gitea/workflows/renovate.yml

@@ -21,7 +21,7 @@ jobs:
             -e RENOVATE_PLATFORM=gitea \
             -e RENOVATE_REPOSITORIES=${{ github.repository }} \
             -e RENOVATE_TOKEN \
-            renovate/renovate:44.75.1
+            renovate/renovate:44.93.5
 
   # After the renovate job, cut ONE tag covering the renovate-bot commits merged to main since the
   # last tag (batch per run). Targets origin/main — the real post-merge tip; the checkout SHA is the

AGENTS.md

@@ -447,9 +447,12 @@ one-time setup. A file-map or table row gets a clause, not a paragraph.
   same rule in their own language. An unmapped Kratos id renders Kratos' own wording — map the id when
   it matters. **Held by the author, never by a test:** slightly different wording is often the right
   call, and a build-failing check takes that judgment away.
-- Use well formed, standard compliant, rich URIs. Prefer state in the URL over POSTing it, for
+- Use well formed, standard compliant, rich URIs. **State lives in the URL or on the server, never in
-  example on list pages with filters and pagination. Do `ids=x&ids=y`, not `ids[]=x&ids[]=y` and not
+  a cookie.** Prefer state in the URL over POSTing it, for example on list pages with filters and
-  `ids=x,y`.
+  pagination. A message for the page a redirect lands on rides its query string — `info-msg`,
+  `warn-msg`, `error-msg` — since a fragment never reaches the server. A cookie carries only what
+  must be bound to the browser: the session (`plainpages_jwt`) and the CSRF token (`plainpages_csrf`).
+  Do `ids=x&ids=y`, not `ids[]=x&ids[]=y` and not `ids=x,y`.
 
 ## Comments
 

README.md

@@ -961,6 +961,16 @@ underneath it — cramped, but nothing is unreachable. List state
 (`?q=…&status=…&sort=…&page=…`) lives **in the URL**, so a view is bookmarkable and shareable; the
 URL is the only state the UI keeps.
 
+**A field whose options depend on another field is asked for in steps, one GET form each**, so every
+choice is in the URL, and nothing typed is lost to one because nothing is typed until they are made.
+Once the query names a value, that field renders read-only (`field` with `readonly`, and a `link` back
+to the URL without it) above the next step's form, which carries the earlier choices as hidden inputs,
+plus `locale` from `localeParam`. The form that writes comes last and posts to the URL naming every
+choice, so its handler reads them from `ctx.query`, never from the body; a value the query names that
+the step does not offer is that step's error, never a silent fallback. Don't redraw a half-filled form
+through a submit that writes nothing instead: a `required` field blocks it, and the choice never
+reaches the URL.
+
 Plugins that genuinely need it — live dashboards, bulk actions, client-side validation — may **opt
 into progressive enhancement** (htmx, Alpine, vanilla JS) on top of working server-rendered HTML.
 The baseline never depends on it.

package-lock.json

@@ -8,7 +8,7 @@
       "dependencies": {
         "@larvit/log": "2.3.0",
         "ejs": "6.0.1",
-        "lucide-static": "1.39.0",
+        "lucide-static": "1.46.0",
         "postgres": "3.4.9"
       },
       "devDependencies": {
@@ -399,9 +399,9 @@
       }
     },
     "node_modules/lucide-static": {
-      "version": "1.39.0",
+      "version": "1.46.0",
-      "resolved": "https://registry.npmjs.org/lucide-static/-/lucide-static-1.39.0.tgz",
+      "resolved": "https://registry.npmjs.org/lucide-static/-/lucide-static-1.46.0.tgz",
-      "integrity": "sha512-TaDiwNFZ78c+HrZRNWHoR+LVkIOL8ebYOyNYvytdPkaLWE29G9umks6p1aeCE8kSEIoifnlNLPxMvvE3zqT/YA==",
+      "integrity": "sha512-kq1lP/78BxG28VG3Ut2FxMeQElereTrrRwTBeXH7+olxATGcDbsuKRB/v/VKLhPrEu8BvNi6Uh2GvbH3pQcYhg==",
       "license": "ISC"
     },
     "node_modules/postgres": {

package.json

@@ -18,7 +18,7 @@
   "dependencies": {
     "@larvit/log": "2.3.0",
     "ejs": "6.0.1",
-    "lucide-static": "1.39.0",
+    "lucide-static": "1.46.0",
     "postgres": "3.4.9"
   },
   "devDependencies": {