Decap CMS 3.17.1

A patch release with a smaller browser bundle, a clearer Decap Turbo error, and dependency security updates. Nothing changes in how you configure or use the CMS.

Changes

• Smaller bundle. decap-cms.js is 384 KB smaller: 4.86 MB instead of 5.24 MB, and 118 KB less over gzip. The bundle carried two full copies of lodash, two versions of Immutable, a server-side renderer it never called, and two dependencies whose code never ran. (#8032)
• Clearer error for a Turbo site without a repository. A Turbo site can be created before a repository is chosen. The CMS used to report a missing repo in config.yml, which can't fix it. It now says the site has no repository and links to the site's page in the Turbo dashboard. (#8031)
• Dependency updates. The lockfile now resolves to patched versions of axios, morgan, lodash, webpack, express and other dependencies, fixing open security alerts. No declared version ranges changed. (#8030)

For npm users

decap-cms-ui-default, decap-cms-widget-boolean and decap-cms-widget-map now declare immutable as a peer dependency, like the other widgets. They always needed it. If you install decap-cms-app, it already provides immutable, so nothing changes for you.