chore(deps): bump django-js-asset from 3.1.2 to 4.1.0

[dependabot]

Bumps django-js-asset from 3.1.2 to 4.1.0.

Changelog

Sourced from django-js-asset's changelog.

.. _changelog:

Change log

Next version

4.1 (2026-08-28)

• Fixed js_asset.Media crashing with an AttributeError when rendering an asset that only implements Django's plain __html__ contract (neither a MediaAsset nor one of our ImportMap/JSON types). Such assets now fall back to __html__() exactly like django.forms.Media does; the nonce cannot be threaded into an opaque __html__ asset, same as with stock Django.
• Fixed js_asset.Media treating html-safe strings -- e.g. mark_safe('<script defer src="..."></script>'), a long-documented Django idiom for embedding a complete asset tag -- as asset paths, so they were run through static() and percent-encoded instead of being rendered verbatim. Anything providing __html__() now takes the verbatim path, matching django.forms.Media (see Django's ticket #37262).
• js_asset.Media additionally renders html-safe strings correctly on Django 6.1, whose own forms.Media mangles them (fixed in Django for 6.1.1). Only media built through js_asset.Media benefits; assets adopted from a plain forms.Media -- including widget Media declarations, which Django always builds with forms.Media -- are already normalized before we see them.
• Fixed js_asset.Media dropping the CSP nonce when rendering through Django's {% csp_nonce_attr media %} template tag. The tag passes the lazy csp_nonce object, which is deliberately falsy until it is first read, so truth-testing it looked like "no nonce at all". Lazy nonces are now resolved (still only when there is something to render, so an empty media does not cause a nonce to be generated).
• Fixed js_asset.Media.render_css() and .render_js() -- part of forms.Media's public API -- rendering neither the CSP nonce nor the merged import map. Only the full render() did.
• Fixed media["css"] / media["js"] -- what {{ media.css }} and {{ media.js }} resolve to in templates, and what Django's admin renders with {% csp_nonce_attr media.js %} -- returning a plain django.forms.Media, therefore losing the CSP nonce and the import-map merging. They now return a js_asset.Media carrying the same nonce.
• Fixed inline CSS (CSS(css, inline=True)) being HTML-escaped. A <style> element is raw text -- character references are not decoded inside it -- so escaping silently broke every rule containing >, ", ' or &: nav > a matches nothing. Inline CSS now renders verbatim, and CSS containing </style (the one sequence which could close the element early) is rejected with a ValueError.

... (truncated)

Commits

• c9efba3 django-js-asset 4.1
• cdc24b0 Correct the Django version boundaries for the CSP and normalization APIs
• bb36872 Note the nonce and inline-CSS invariants in AGENTS.md
• 8b4ef41 Render inline CSS verbatim instead of HTML-escaped
• 6192712 Keep our type and nonce in media["css"] and media["js"]
• b137484 Apply the nonce and merge import maps in render_css()/render_js()
• 5c32f33 Resolve lazy CSP nonces when rendering media
• 7f39691 [pre-commit.ci] pre-commit autoupdate (#32)
• 866a12b django-js-asset 4.0.2
• 66c80e9 Merge remote-tracking branch 'origin/main'
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[cypress]

Geotrek-admin    Run #17704

Run Properties:   Passed #17704  •  e1dd177455 ℹ️: Merge 624b18b0d932029ba6e5f11b2babc50f4ba5f4cd into 6f8f502af11c9afb036175d1321c...

Project	Geotrek-admin
Branch Review	refs/pull/5658/merge
Run status	Passed #17704
Run duration	02m 07s
Commit	e1dd177455 ℹ️: Merge 624b18b0d932029ba6e5f11b2babc50f4ba5f4cd into 6f8f502af11c9afb036175d1321c...
Committer	dependabot[bot]
View all properties for this run ↗︎

---

Test results
Failures	0
Flaky	0
Pending	0
Skipped	0
Passing	22
View all changes introduced in this branch ↗︎