chore(deps): bump django-js-asset from 3.1.2 to 4.0.1

[dependabot]

Bumps django-js-asset from 3.1.2 to 4.0.1.

Changelog

Sourced from django-js-asset's changelog.

.. _changelog:

Change log

Next version

- Fixed ``js_asset.Media`` crashing with an ``AttributeError`` when rendering an
  asset that only implements Django's plain ``__html__`` contract (neither a
  ``MediaAsset`` nor one of our ``ImportMap``/``JSON`` types). Such assets now
  fall back to ``__html__()`` exactly like ``django.forms.Media`` does; the
  nonce cannot be threaded into an opaque ``__html__`` asset, same as with stock
  Django.
4.0 (2026-06-11)

This is a major release. Most code keeps working unchanged and the rendered HTML is the same, but if you use import maps the upgrade is not automatic -- see the import-map note at the end.

• Added js_asset.Media, a django.forms.Media subclass with two extra abilities. First, it merges every embedded ImportMap into a single <script type="importmap"> rendered before any other script -- this replaces the old global importmap object and works no matter how many media objects Django combines. Second, it applies a request-scoped CSP nonce to the tags it renders. It implements __add__ and __radd__, so it keeps its type -- and its nonce -- when combined with a plain forms.Media from either side (e.g. while Django collects form and widget media). The nonce can be passed to the constructor (nonce=), copied onto a clone with with_nonce(), or passed to render(nonce=...); render() also accepts attrs={"nonce": ...} so it plugs straight into Django 6.2's {% csp_nonce_attr %} tag. Media.from_media() wraps an existing forms.Media instance (e.g. form.media).
• JS and CSS now produce Django's own Script and Stylesheet objects (backported via js_asset._compat on Django versions that lack them) instead of being standalone dataclasses. They therefore share merge buckets with native Django assets and with bare path strings, so the same file is no longer rendered more than once when js_asset assets, plain strings and Django's auto-wrapped assets meet in forms.Media.merge(). isinstance(x, JS) / isinstance(x, CSS) keep working (via a metaclass). Inline CSS (CSS(src, inline=True)) is rendered by a small dedicated InlineStyle asset. Rendered output is unchanged.
• Script, Stylesheet, MediaAsset and InlineStyle can now be imported from js_asset -- prefer these in isinstance checks over JS/CSS going forward.
• Equality now follows Django's own contract: identity is attribute-aware on

... (truncated)

Commits

• 7c024a3 django-js-asset 4.0.1
• 59aa7e5 Fix html objects in Media
• b3c515c django-js-asset 4.0
• 8a34338 Address review comments
• b7d05eb Remove the global importmap and update the guidance accordingly
• 3213b9b Increase interoperability with Django's own object-based media assets
• cfe3b52 Add a Media subclass with import-map merging and CSP nonce support
• 6708307 dj62 does not exist yet as a release
• 9961d48 Run tests with newer Django and Python versions
• f77abf5 Bump the github-actions group with 2 updates (#20)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.49%. Comparing base (cb3a9ee) to head (be0f48a).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #5515   +/-   ##
=======================================
  Coverage   98.49%   98.49%           
=======================================
  Files         272      272           
  Lines       22420    22420           
=======================================
  Hits        22083    22083           
  Misses        337      337           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cypress]

Geotrek-admin    Run #16911

Run Properties:   Passed #16911  •  fca62906d2 ℹ️: Merge be0f48a986635116f9348ae79854642a37e87c51 into b91eafe830170a6c88419af52df5...

Project	Geotrek-admin
Branch Review	refs/pull/5515/merge
Run status	Passed #16911
Run duration	02m 12s
Commit	fca62906d2 ℹ️: Merge be0f48a986635116f9348ae79854642a37e87c51 into b91eafe830170a6c88419af52df5...
Committer	dependabot[bot]
View all properties for this run ↗︎

---

Test results
Failures	0
Flaky	0
Pending	0
Skipped	0
Passing	22
View all changes introduced in this branch ↗︎

[dependabot]

Superseded by #5658.