Signed-off-by: Gary Kim <gary@garykim.dev>

Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>

Bumps [@nextcloud/initial-state](https://github.com/nextcloud/nextcloud-initial-state) from 1.1.0 to 1.1.1.
- [Release notes](https://github.com/nextcloud/nextcloud-initial-state/releases)
- [Changelog](https://github.com/nextcloud/nextcloud-initial-state/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nextcloud/nextcloud-initial-state/compare/v1.1.0...v1.1.1

)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
Signed-off-by: npmbuildbot[bot] <npmbuildbot[bot]@users.noreply.github.com>

Signed-off-by: Marco Ambrosini <marcoambrosini@pm.me>

Signed-off-by: Julius Härtl <jus@bitgrid.net>

Signed-off-by: Julius Härtl <jus@bitgrid.net>

Signed-off-by: Julius Härtl <jus@bitgrid.net>

Signed-off-by: Joas Schilling <coding@schilljs.com>

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

Bumps [clipboard](https://github.com/zenorocha/clipboard.js) from 2.0.4 to 2.0.6.
- [Release notes](https://github.com/zenorocha/clipboard.js/releases)
- [Commits](https://github.com/zenorocha/clipboard.js/compare/v2.0.4...v2.0.6

)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
Signed-off-by: npmbuildbot[bot] <npmbuildbot[bot]@users.noreply.github.com>

Bumps [webpack](https://github.com/webpack/webpack) from 4.41.6 to 4.42.0.
- [Release notes](https://github.com/webpack/webpack/releases)
- [Commits](https://github.com/webpack/webpack/compare/v4.41.6...v4.42.0

)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
Signed-off-by: npmbuildbot[bot] <npmbuildbot[bot]@users.noreply.github.com>

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

Signed-off-by: Joas Schilling <coding@schilljs.com>

As discussed in #18603 caching a 201 response is hard. It's now possible to distinguish between generated and uploaded avatars by reading the X-NC-IsCustomAvatar (0 = generated, 1 = uploaded) header.

Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>

Bumps [@babel/preset-env](https://github.com/babel/babel) from 7.8.3 to 7.8.6.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/master/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/compare/v7.8.3...v7.8.6

)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
Signed-off-by: npmbuildbot[bot] <npmbuildbot[bot]@users.noreply.github.com>

Signed-off-by: Gary Kim <gary@garykim.dev>

Signed-off-by: Joas Schilling <coding@schilljs.com>

Signed-off-by: Joas Schilling <coding@schilljs.com>

"button, textarea, select, div[contenteditable='true']" were removed and
"audio, canvas, embed, iframe" were added.

Note that this is a coarse-grained list; according to the spec some of
the elements, like canvas or input, might be treated as a replaced
element in some cases and as ordinary elements in others:
https://html.spec.whatwg.org/multipage/rendering.html#replaced-elements



For now all the elements that might be replaced elements use the loading
image by default, so apps will need to override that when the elements
are treated as ordinary elements. Of course that can be flipped in the
future to instead make an element to use the "::after" approach by
default if it is found that the element requires the override often.

Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>

Replaced elements do not have "::after" nor "::before" pseudo-elements,
so the regular loading icon needs to be shown using a background image
instead of the default "::after" pseudo-element approach. However, the
CSS rules were not applied on the replaced elements themselves, but on
their descendants. As the descendants might have support for
pseudo-elements the rules were fixed to be applied on the replaced
elements, and only on the replaced elements.

Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>

Test-Set:

no-referrer-when-downgrade
no-referrer
strict-origin-when-cross-origin
same-origin
no-referrer, strict-origin-when-cross-origin
strict-origin-
unsafe-raw, same-origin
strict-origin-when-downgrade

Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>