Prepare for 3.0.5

[eyelidlessness]

Note: this will need to be updated again, pending release of enketo-core 6.0.4

• Create release PR
• Check Dependabot for alerts
  • Note this will not correctly reflect the vulnerabilities to be released until the dependency upgrades are merged. I do not see any vulnerabilities that aren't addressed with npm audit below.
• Run npm update
  • Check if node-forge has been updated and if so, verify encrypted submissions end-to-end
• Run npm audit
  • Run npm audit fix --production to apply most important fixes
    • Note there is an outstanding dependency vulnerability for jstransformer-markdown-it, which is only used to render CHANGELOG.md as HTML, which does not process arbitrary user input
• Run npm ci
• Run npm test
• Run npm run build-docs
• Update CHANGELOG.md
• Update version in package.json
  • N/A: Bump to major version if consumers have to make changes.
• Merge PR with all changes @lognaturel
• Create GitHub release @lognaturel
• Tag and publish the release @lognaturel
  • GitHub Action will publish it to npm

[MartijnR]

Watch out for node-forge #378 (comment). Just in the unlikely case, that users end up with encrypted records that can never be decrypted.

[eyelidlessness]

@MartijnR As @lognaturel mentioned on the enketo-core PR, I have verified the node-forge upgrade works with Central's managed encryption. I have now also verified that it works with non-managed public/private key encryption through ODK Briefcase, as you said in #378 (comment)

[MartijnR]

Great! Thanks!

[lognaturel]

Core 6.0.4 is released. I think #373 and #365 should also be merged.

Would be good to update the build status icon to use the Github action and to have that link to /actions or something (rather than to the icon itself which is what's going on in Core right now).