[dependabot]

Bumps ejs from 6.0.1 to 7.0.1.

Release notes

Sourced from ejs's releases.

v7.0.1

Version 7.0.1

Commits

• 90d623c Version 7.0.1
• 5d09189 Major version bump
• b0c7809 Test the browser export condition against the packed tarball
• 9f88897 Merge PR #816: select browser bundle through conditional exports
• 5741749 Pass large CLI test payloads via stdin, not argv
• e61a417 Make prototype-settings test exercise a setting still read
• e2c015b Remove options-in-data (Express 2 compat) (breaking)
• 437324d Rework CLI argument parser (breaking)
• 79d5791 fix(package): select browser bundle through conditional exports
• 6bd7af9 Merge branch 'main' of github.com:mde/ejs
• Additional commits viewable in compare view

[frandallfarmer]

Parked deliberately — not a security fix, and we're not adding functionality.

No ejs alert triggered this (labels are just dependencies/javascript), and every known ejs advisory is long past: the newest affects < 3.1.10, the critical RCE/template-injection ones < 3.1.7 and < 2.5.3. We run 6.0.1, well clear of all of them.

So there's nothing to gain now, against a major-version bump of the engine that renders the web client's views (pushserver/views/*.ejs). CI's compose-smoke brings the stack up but doesn't assert rendered page content, so a template regression could reach prod unnoticed.

Pick this up when something else needs ejs 7 — and when it is picked up, read ejs 7's breaking changes against how the views actually use the API and verify a rendered page before merging.