- `allow_user_trust_override`
- `clear_cache_on_logout`

The `persistent_store` setting can now also be set to `sessionStorage`

The `trusted` settings was in effect playing the role of two separate settings
and implicitly affecting a third ('persistent_store').

By breaking it up, we make things more explicit and allow for new
configurations. For example, clearing the cache on logout, while using
some kind of persistent store.

Bumps [elliptic](https://github.com/indutny/elliptic) from 6.5.2 to 6.5.3. **This update includes a security fix.**
- [Release notes](https://github.com/indutny/elliptic/releases)
- [Commits](https://github.com/indutny/elliptic/compare/v6.5.2...v6.5.3)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

use muc-toolbar-btn-color for background

* allow the use of MUC affiliation, MUC role, and VCard roles as hats
* update setting documentation
* remove filter from VCard roles
* update naming and documentation to make explicit the use of XEP-317 Hats
* include muc_hats config option update to changelog

* notify changes to client on bookmark-update
* update XEP-115 caps verification string

in 1:1 chats.

See: https://xmpp.org/extensions/xep-0313.html#archives_id

* regression of #1317: Don't show errors for CSI messages
* fix failing tests

- Let `api.rooms.open` call `api.rooms.get` directly, instead of indirectly via `api.rooms.create`
- Remove the `createChatRoom` function
- Also strip URI parts from JID in `api.rooms.get` and use utility method for doing so

Bumps [http-proxy](https://github.com/http-party/node-http-proxy) from 1.18.0 to 1.18.1.
- [Release notes](https://github.com/http-party/node-http-proxy/releases)
- [Changelog](https://github.com/http-party/node-http-proxy/blob/master/CHANGELOG.md)
- [Commits](https://github.com/http-party/node-http-proxy/compare/1.18.0...1.18.1)
Signed-off-by: dependabot[bot] <support@github.com>

* #1829 css var instead of hard coded colors

Bumps [dot-prop](https://github.com/sindresorhus/dot-prop) from 4.2.0 to 4.2.1. **This update includes a security fix.**
- [Release notes](https://github.com/sindresorhus/dot-prop/releases)
- [Commits](https://github.com/sindresorhus/dot-prop/commits)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

* catch all whitespace characters instead of just new line

* Only update the room list after shown.bs.modal
* add changes to CHANGES.md
* Move shown listener to initialize

Don't use 100vh, it doesn't work properly on mobile

Not strictly necessary for vanilla Converse, but makes life easier
downstream

filter
find
has
isEmpty
isString
isUndefined
noop
reject
uniq

Use of lowercase letters and Infinity to avoid calculation errors when the index is -1

- The `converse.api.query` method now no longer accepts an RSM instance.
- The RSM class now separates `query` parameters from `result` attributes
- Improve JSDoc docs and remove need to make `converse-rsm` a plugin
- Add typedefs for the options expected by RSM and `api.archive.query`

This reverts commit 5a874a49.