Merge pull request #3010 from GSA/main

10/15/25 Production Release

Author: ccostino

.cfignore

@@ -79,7 +79,6 @@ target/
 .vscode
 
 # Frontend dependencies and compiled assets
-app/assets/stylesheets/govuk_template/.sass-cache/
 .sass-cache/
 cache/
 node_modules

.ds.baseline

@@ -161,7 +161,7 @@
         "filename": "app/config.py",
         "hashed_secret": "577a4c667e4af8682ca431857214b3a920883efc",
         "is_verified": false,
-        "line_number": 120,
+        "line_number": 118,
         "is_secret": false
       }
     ],
@@ -507,7 +507,7 @@
         "filename": "tests/app/main/views/test_accept_invite.py",
         "hashed_secret": "07f0a6c13923fc3b5f0c57ffa2d29b715eb80d71",
         "is_verified": false,
-        "line_number": 632,
+        "line_number": 641,
         "is_secret": false
       }
     ],
@@ -629,10 +629,10 @@
         "filename": "tests/conftest.py",
         "hashed_secret": "f8377c90fcfd699f0ddbdcb30c2c9183d2d933ea",
         "is_verified": false,
-        "line_number": 3287,
+        "line_number": 3291,
         "is_secret": false
       }
     ]
   },
-  "generated_at": "2025-10-01T14:58:39Z"
+  "generated_at": "2025-10-07T17:43:26Z"
 }

.github/workflows/deploy-demo.yml

@@ -64,7 +64,6 @@ jobs:
           LOGIN_DOT_GOV_INITIAL_SIGNIN_URL: "https://secure.login.gov/openid_connect/authorize?acr_values=http%3A%2F%2Fidmanagement.gov%2Fns%2Fassurance%2Fial%2F1&client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&nonce=NONCE&prompt=select_account&redirect_uri=https://notify-demo.app.cloud.gov/sign-in&response_type=code&scope=openid+email&state=STATE"
           LOGIN_DOT_GOV_CERTS_URL: "https://secure.login.gov/api/openid_connect/certs"
           API_PUBLIC_URL: ${{ secrets.API_PUBLIC_URL }}
-          API_PUBLIC_WS_URL: ${{ secrets.API_PUBLIC_WS_URL }}
         with:
           cf_username: ${{ secrets.CLOUDGOV_USERNAME }}
           cf_password: ${{ secrets.CLOUDGOV_PASSWORD }}
@@ -90,7 +89,6 @@ jobs:
             --var LOGIN_DOT_GOV_CERTS_URL="$LOGIN_DOT_GOV_CERTS_URL"
             --var LOGIN_PEM="$LOGIN_PEM"
             --var API_PUBLIC_URL="$API_PUBLIC_URL"
-            --var API_PUBLIC_WS_URL="$API_PUBLIC_WS_URL"
             --strategy rolling
 
       - name: Deploy egress proxy

.github/workflows/deploy-prod.yml

@@ -64,7 +64,6 @@ jobs:
           LOGIN_DOT_GOV_INITIAL_SIGNIN_URL: "https://secure.login.gov/openid_connect/authorize?acr_values=http%3A%2F%2Fidmanagement.gov%2Fns%2Fassurance%2Fial%2F1&client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&nonce=NONCE&prompt=select_account&redirect_uri=https://beta.notify.gov/sign-in&response_type=code&scope=openid+email&state=STATE"
           LOGIN_DOT_GOV_CERTS_URL: "https://secure.login.gov/api/openid_connect/certs"
           API_PUBLIC_URL: ${{ secrets.API_PUBLIC_URL }}
-          API_PUBLIC_WS_URL: ${{ secrets.API_PUBLIC_WS_URL }}
         with:
           cf_username: ${{ secrets.CLOUDGOV_USERNAME }}
           cf_password: ${{ secrets.CLOUDGOV_PASSWORD }}
@@ -90,7 +89,6 @@ jobs:
             --var LOGIN_DOT_GOV_CERTS_URL="$LOGIN_DOT_GOV_CERTS_URL"
             --var LOGIN_PEM="$LOGIN_PEM"
             --var API_PUBLIC_URL="$API_PUBLIC_URL"
-            --var API_PUBLIC_WS_URL="$API_PUBLIC_WS_URL"
             --strategy rolling
 
       - name: Deploy egress proxy

.github/workflows/deploy.yml

@@ -70,7 +70,6 @@ jobs:
         LOGIN_DOT_GOV_INITIAL_SIGNIN_URL: "https://secure.login.gov/openid_connect/authorize?acr_values=http%3A%2F%2Fidmanagement.gov%2Fns%2Fassurance%2Fial%2F1&client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&nonce=NONCE&prompt=select_account&redirect_uri=https://notify-staging.app.cloud.gov/sign-in&response_type=code&scope=openid+email&state=STATE"
         LOGIN_DOT_GOV_CERTS_URL: "https://secure.login.gov/api/openid_connect/certs"
         API_PUBLIC_URL: ${{ secrets.API_PUBLIC_URL }}
-        API_PUBLIC_WS_URL: ${{ secrets.API_PUBLIC_WS_URL }}
       with:
         cf_username: ${{ secrets.CLOUDGOV_USERNAME }}
         cf_password: ${{ secrets.CLOUDGOV_PASSWORD }}
@@ -96,7 +95,6 @@ jobs:
           --var LOGIN_DOT_GOV_CERTS_URL="$LOGIN_DOT_GOV_CERTS_URL"
           --var LOGIN_PEM="$LOGIN_PEM"
           --var API_PUBLIC_URL="$API_PUBLIC_URL"
-          --var API_PUBLIC_WS_URL="$API_PUBLIC_WS_URL"
           --strategy rolling
 
 

.gitignore

@@ -81,6 +81,7 @@ htmlcov/
 .coverage.*
 .cache
 .pytest_cache
+.hypothesis/
 coverage/
 coverage.xml
 test_results.xml
@@ -150,3 +151,6 @@ playwright/
 backstop_data/bitmaps_test/
 backstop_data/html_report/
 backstop_data/engine_scripts/playwright/
+
+# Pa11y
+pa11y-results.txt

.pre-commit-config.yaml

@@ -18,6 +18,15 @@ repos:
         args: [--allow-missing-credentials]
     -   id: detect-private-key
     -   id: mixed-line-ending
+-   repo: https://github.com/pycqa/flake8
+    rev: 7.1.1
+    hooks:
+    -   id: flake8
+-   repo: https://github.com/pycqa/isort
+    rev: 5.13.2
+    hooks:
+    -   id: isort
+        args: ["--profile", "black"]
 -   repo: https://github.com/Yelp/detect-secrets
     rev: v1.5.0
     hooks:

app/__init__.py

@@ -102,22 +102,16 @@
 from app.notify_client.performance_dashboard_api_client import (
     performance_dashboard_api_client,
 )
-from app.notify_client.platform_stats_api_client import (
-    platform_stats_api_client,
-)
+from app.notify_client.platform_stats_api_client import platform_stats_api_client
 from app.notify_client.service_api_client import service_api_client
 from app.notify_client.status_api_client import status_api_client
-from app.notify_client.template_folder_api_client import (
-    template_folder_api_client,
-)
-from app.notify_client.template_statistics_api_client import (
-    template_statistics_client,
-)
+from app.notify_client.template_folder_api_client import template_folder_api_client
+from app.notify_client.template_statistics_api_client import template_statistics_client
 from app.notify_client.upload_api_client import upload_api_client
 from app.notify_client.user_api_client import user_api_client
 from app.url_converters import SimpleDateTypeConverter, TemplateTypeConverter
 from app.utils.api_health import is_api_down
-from app.utils.govuk_frontend_jinja.flask_ext import init_govuk_frontend
+from app.utils.nunjucks_jinja.flask_ext import init_nunjucks_environment
 from notifications_python_client.errors import HTTPError
 from notifications_utils import logging, request_helper
 from notifications_utils.formatters import (
@@ -149,7 +143,6 @@
 def _csp(config):
     asset_domain = config["ASSET_DOMAIN"]
     api_public_url = config["API_PUBLIC_URL"]
-    api_public_ws_url = config["API_PUBLIC_WS_URL"]
 
     return {
         "default-src": ["'self'", asset_domain],
@@ -168,7 +161,6 @@ def _csp(config):
             "https://www.googletagmanager.com",
             "https://www.google-analytics.com",
             "https://dap.digitalgov.gov",
-            "https://cdn.socket.io",
         ],
         "connect-src": list(
             dict.fromkeys(
@@ -177,7 +169,6 @@ def _csp(config):
                     "https://gov-bam.nr-data.net",
                     "https://www.google-analytics.com",
                     f"{api_public_url}",
-                    f"{api_public_ws_url}",
                 ]
             )
         ),
@@ -198,17 +189,8 @@ def inject_is_api_down():
 
     # @application.context_processor
     # def inject_feature_flags():
-        # this is where feature flags can be easily added as a dictionary within context
-        # feature_socket_enabled = application.config.get("FEATURE_SOCKET_ENABLED", True)
-
-        # current_app.logger.info(
-        #     f"FEATURE_SOCKET_ENABLED value in __init__.py coming \
-        #                          from config is {application.config.get('FEATURE_SOCKET_ENABLED')} and \
-        #                             the ending value is {feature_socket_enabled}"
-        # )
-        # return dict(
-        #     FEATURE_SOCKET_ENABLED=feature_socket_enabled,
-        # )
+    # this is where feature flags can be easily added as a dictionary within context
+    # feature_enabled = application.config.get("FEATURE_ENABLED", True)
 
     @application.context_processor
     def inject_initial_signin_url():
@@ -246,7 +228,7 @@ def inject_initial_signin_url():
     if "extensions" not in application.jinja_options:
         application.jinja_options["extensions"] = []
 
-    init_govuk_frontend(application)
+    init_nunjucks_environment(application)
     init_jinja(application)
 
     for client in (

app/assets/error_pages/5xx.html

@@ -92,10 +92,7 @@ <h2 class="usa-sr-only">Support links</h2>
               d="M421.5 142.8V.1l-50.7 32.3v161.1h112.4v-50.7zm-122.3-9.6A47.12 47.12 0 0 1 221 97.8c0-26 21.1-47.1 47.1-47.1 16.7 0 31.4 8.7 39.7 21.8l42.7-27.2A97.63 97.63 0 0 0 268.1 0c-36.5 0-68.3 20.1-85.1 49.7A98 98 0 0 0 97.8 0C43.9 0 0 43.9 0 97.8s43.9 97.8 97.8 97.8c36.5 0 68.3-20.1 85.1-49.7a97.76 97.76 0 0 0 149.6 25.4l19.4 22.2h3v-87.8h-80l24.3 27.5zM97.8 145c-26 0-47.1-21.1-47.1-47.1s21.1-47.1 47.1-47.1 47.2 21 47.2 47S123.8 145 97.8 145" />
           </svg>
           <span class="usa-footer__licence-description">
-            All content is available under the
-            <a class="usa-footer__link"
-              href="https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/" rel="license">Open
-              Government Licence v3.0</a>, except where otherwise stated
+            All content is available under <a href="https://open.gsa.gov/oss/">GSA's Open Source Policy</a>, except where otherwise stated
           </span>
         </div>
       </div>

app/assets/javascripts/activityChart.js

@@ -239,10 +239,10 @@
             }
 
             const data = await response.json();
-                labels = [];
-                deliveredData = [];
-                failedData = [];
-                pendingData = [];
+                let labels = [];
+                let deliveredData = [];
+                let failedData = [];
+                let pendingData = [];
                 let totalMessages = 0;
 
                 for (var dateString in data) {
@@ -399,19 +399,19 @@
         dropdown.addEventListener('change', handleDropdownChange);
     });
 
-        // Resize chart on window resize
-        window.addEventListener('resize', function() {
-            if (labels.length > 0 && deliveredData.length > 0 && failedData.length > 0 && pendingData.length > 0) {
-                createChart('#weeklyChart', labels, deliveredData, failedData, pendingData);
-                createTable('weeklyTable', 'activityChart', labels, deliveredData, failedData, pendingData);
-            }
-        });
+    // Resize chart on window resize
+    window.addEventListener('resize', function() {
+        if (labels.length > 0 && deliveredData.length > 0 && failedData.length > 0 && pendingData.length > 0) {
+            createChart('#weeklyChart', labels, deliveredData, failedData, pendingData);
+            createTable('weeklyTable', 'activityChart', labels, deliveredData, failedData, pendingData);
+        }
+    });
 
-        // Export functions for testing
-        window.createChart = createChart;
-        window.createTable = createTable;
-        window.handleDropdownChange = handleDropdownChange;
-        window.fetchData = fetchData;
-    }
+    // Export functions for testing
+    window.createChart = createChart;
+    window.createTable = createTable;
+    window.handleDropdownChange = handleDropdownChange;
+    window.fetchData = fetchData;
+}
 
 })(window);