Skip to content

build(deps): bump rojopolis/spellcheck-github-actions from 0.37.0 to 0.66.0 - #173

Merged
degenaro merged 2 commits into
mainfrom
dependabot/github_actions/rojopolis/spellcheck-github-actions-0.66.0
Aug 25, 2026
Merged

build(deps): bump rojopolis/spellcheck-github-actions from 0.37.0 to 0.66.0#173
degenaro merged 2 commits into
mainfrom
dependabot/github_actions/rojopolis/spellcheck-github-actions-0.66.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps rojopolis/spellcheck-github-actions from 0.37.0 to 0.66.0.

Release notes

Sourced from rojopolis/spellcheck-github-actions's releases.

0.66.0

What's Changed

Full Changelog: rojopolis/spellcheck-github-actions@0.65.0...0.66.0

0.65.0

What's Changed

Full Changelog: rojopolis/spellcheck-github-actions@0.64.0...0.65.0

0.64.0

What's Changed

Full Changelog: rojopolis/spellcheck-github-actions@0.63.1...0.64.0

0.63.1

What's Changed

Full Changelog: rojopolis/spellcheck-github-actions@0.63.0...0.63.1

0.63.0

What's Changed

... (truncated)

Changelog

Sourced from rojopolis/spellcheck-github-actions's changelog.

Change Log for spellcheck-github-actions

0.66.0, 2026-08-11, maintenance release, update not required

  • Docker image updated to Python 3.14.7-slim-trixie via PR #391 from Dependabot.

0.65.0, 2026-08-08, security release, update recommended

  • Bumped lxml from 5.4.0 to 6.1.1 to address CVE-2026-41066 (XXE via iterparse()/ETCompatXMLParser defaulting resolve_entities=True) and libxslt vulnerabilities CVE-2025-7424 and CVE-2025-11731, via PR #388 from Dependabot.

  • Bumped pymdown-extensions from 10.21.3 to 11.0.1 to address CVE-2026-67422 (ReDoS in the caret, tilde, betterem, and magiclink inline processors) and CVE-2026-61632 (path traversal in the b64 extension).

  • Bumped soupsieve from 2.6 to 2.9.2 to address CVE-2026-49476 (memory exhaustion via large comma-separated selector lists) and CVE-2026-49477 (ReDoS via the selector parser).

0.64.0, 2026-07-31, maintenance release, update not required

  • Adopted pip-compile (pip-tools) for Python dependency management via PR #380. requirements.in is now the source of truth for direct dependencies (pyspelling, pymdown-extensions); requirements.txt is generated from it rather than hand-maintained, so transitive pins can no longer silently fall out of sync the way bracex did in issue #378.

    • backrefs and zipp are dropped from requirements.txt. Neither is part of the resolved dependency graph for pyspelling + pymdown-extensions on the Python version this image ships (verified against each package's own declared metadata and the installed package list in the built image) — they were stale manual pins, not active dependencies. In particular, zipp was originally pinned in PR #204 to patch CVE-2024-5569; that dependency chain (pyspelling → importlib-metadata → zipp) no longer exists, so removing the pin does not reintroduce the vulnerability — the package simply isn't installed, pinned or not.

    • .github/dependabot.yml's pip ecosystem entry already set versioning-strategy: lockfile-only, which expects exactly this requirements.in/requirements.txt split; this change makes that existing setting apply as intended.

0.63.1, 2026-07-30, bug fix release, update recommended

  • Fixed sources glob patterns that combine brace expansion with the SPLIT/GLOBSTAR flags (e.g. **/*.{c,h}|!build/**) silently matching zero files and causing the action to fail with RuntimeError: None of the source targets from the configuration match any files. The pinned bracex dependency (2.5.post1) predated the version wcmatch requires for correct parsing of such patterns; bumped to 3.0.1 via PR #379. Addresses issue #378, reported by @​arkq.

0.63.0, 2026-07-01, maintenance release, update not required

  • Docker based image updated for Python 3.14.6 slim trixie via PR #364 from Dependabot.

0.62.0, 2026-06-19, security release, update recommended

  • Bumped lxml from 5.3.0 to 5.4.0 to address known CVEs via PR #357.

  • Bumped pymdown-extensions to patched version 10.21.3 via PR #358.

  • Bumped Markdown from 3.7 to 3.8.1 to patched version via PR #359.

  • Cleaned up GitHub Actions workflows using zizmor and removed ratchet annotations via PR #355 and PR #356.

  • Clarified examples in README.

0.61.0, 2026-06-14, minor feature release, update not required

  • Docker based image updated for Python 3.14.5 slim trixie via PR #344 from Dependabot.

0.60, 2026-03-14, minor feature release, update not required

  • Docker based image updated for Python 3.14.3 slim trixie via PR #325 from Dependabot.

... (truncated)

Commits
  • c1934c5 Prepare release 0.66.0 (#392)
  • 37a9b64 Merge pull request #391 from rojopolis/dependabot/docker/python-3.14.7-slim-t...
  • 7ad126c Bump python from 3.14.6-slim-trixie to 3.14.7-slim-trixie
  • fcc5ca8 Release 0.65.0 (#389)
  • f7c4783 Bump lxml from 5.4.0 to 6.1.1 (#388)
  • ef5beca Merge pull request #387 from rojopolis/dependabot/github_actions/docker/login...
  • 43ad8fd Merge pull request #386 from rojopolis/dependabot/github_actions/rojopolis/sp...
  • 4441ce6 Bump docker/login-action from 4.5.1 to 4.6.0
  • 55afec6 Bump rojopolis/spellcheck-github-actions from 0.63.0 to 0.64.0
  • 07dfc2d Corrected release date
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 21, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/rojopolis/spellcheck-github-actions-0.66.0 branch from 4bc909a to a6ce0df Compare August 25, 2026 13:08
@dependabot
build(deps): bump rojopolis/spellcheck-github-actions
0a34b4d 
Bumps [rojopolis/spellcheck-github-actions](https://github.com/rojopolis/spellcheck-github-actions) from 0.37.0 to 0.66.0.
- [Release notes](https://github.com/rojopolis/spellcheck-github-actions/releases)
- [Changelog](https://github.com/rojopolis/spellcheck-github-actions/blob/master/CHANGELOG.md)
- [Commits](rojopolis/spellcheck-github-actions@e36f662...c1934c5)

---
updated-dependencies:
- dependency-name: rojopolis/spellcheck-github-actions
  dependency-version: 0.66.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/rojopolis/spellcheck-github-actions-0.66.0 branch from a6ce0df to 0a34b4d Compare August 25, 2026 13:26
degenaro
degenaro approved these changes Aug 25, 2026
View reviewed changes

@degenaro degenaro left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@degenaro
degenaro merged commit 40ee86c into main Aug 25, 2026
2 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/rojopolis/spellcheck-github-actions-0.66.0 branch August 25, 2026 17:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@degenaro degenaro degenaro approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@degenaro