Skip to content

Bump rojopolis/spellcheck-github-actions from 0.66.0 to 0.68.0 - #3297

Merged
martincostello merged 1 commit into
mainfrom
dependabot/github_actions/rojopolis/spellcheck-github-actions-0.68.0
Oct 30, 2026
Merged

Bump rojopolis/spellcheck-github-actions from 0.66.0 to 0.68.0#3297
martincostello merged 1 commit into
mainfrom
dependabot/github_actions/rojopolis/spellcheck-github-actions-0.68.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 30, 2026

Copy link
Copy Markdown
Contributor

Bumps rojopolis/spellcheck-github-actions from 0.66.0 to 0.68.0.

Release notes

Sourced from rojopolis/spellcheck-github-actions's releases.

0.68.0

What's Changed

Full Changelog: rojopolis/spellcheck-github-actions@0.67.0...0.68.0

0.67.0

What's Changed

Full Changelog: rojopolis/spellcheck-github-actions@0.66.0...0.67.0

Changelog

Sourced from rojopolis/spellcheck-github-actions's changelog.

Change Log for spellcheck-github-actions

0.68.0, 2026-10-24, maintenance release, update not required

  • Refreshed transitive Python dependency pins via PR #410: beautifulsoup4 4.12.3 to 4.15.0, Markdown 3.8.1 to 3.11.2, lxml 6.1.1 to 6.1.3, bracex 3.0.1 to 3.2, wcmatch 11.0 to 11.2, PyYAML 6.0.2 to 6.0.3, six 1.16.0 to 1.17.0, and webencodings 0.5.1 to 0.6.1. Also pulls in a new transitive dependency, typing-extensions 4.16.0, now required by the newer beautifulsoup4. None of these are pinned in requirements.in, so this is the same refresh Dependabot would otherwise have produced piecemeal under its lockfile-only strategy.

  • Bumped pymdown-extensions from 11.0.1 to 12.3 via PR #411. This is a major version bump with a documented BREAK in pymdown-extensions 12.0: BetterEm, Tilde, Caret, and Mark were rewritten with different nesting/escaping semantics. This repository's own pipeline configuration (spellcheck.yaml, examples/markdown.yml) only enables pymdownx.superfences, which is unaffected by that break and only gained new features across this range (a reset hook in 12.1, title_mode in 12.2/12.3). pyspelling itself does not depend on pymdown-extensions.

0.67.0, 2026-10-24, maintenance release, update not required

  • Docker image updated to Python 3.14.8-slim-trixie via PR #406 from Dependabot.

  • Bumped the core component PySpelling from 2.12.1 to 2.13 via PR #407. This release of PySpelling adds support for Python 3.15, drops support for Python 3.9 and 3.10, and introduces a new css_nostrict option for the XML/HTML filter to allow more relaxed CSS rules given soupsieve's new stricter defaults. This repository's own pyspelling.filters.html configuration (type selectors only) is unaffected, so the new option was not adopted. Pulls in soupsieve bumped from 2.9.2 to 3.0.4 transitively. See the release notes for PySpelling 2.13.

0.66.0, 2026-08-11, maintenance release, update not required

  • Docker image updated to Python 3.14.7-slim-trixie via PR #391 from Dependabot.

0.65.0, 2026-08-08, security release, update recommended

  • Bumped lxml from 5.4.0 to 6.1.1 to address CVE-2026-41066 (XXE via iterparse()/ETCompatXMLParser defaulting resolve_entities=True) and libxslt vulnerabilities CVE-2025-7424 and CVE-2025-11731, via PR #388 from Dependabot.

  • Bumped pymdown-extensions from 10.21.3 to 11.0.1 to address CVE-2026-67422 (ReDoS in the caret, tilde, betterem, and magiclink inline processors) and CVE-2026-61632 (path traversal in the b64 extension).

  • Bumped soupsieve from 2.6 to 2.9.2 to address CVE-2026-49476 (memory exhaustion via large comma-separated selector lists) and CVE-2026-49477 (ReDoS via the selector parser).

0.64.0, 2026-07-31, maintenance release, update not required

  • Adopted pip-compile (pip-tools) for Python dependency management via PR #380. requirements.in is now the source of truth for direct dependencies (pyspelling, pymdown-extensions); requirements.txt is generated from it rather than hand-maintained, so transitive pins can no longer silently fall out of sync the way bracex did in issue #378.

    • backrefs and zipp are dropped from requirements.txt. Neither is part of the resolved dependency graph for pyspelling + pymdown-extensions on the Python version this image ships (verified against each package's own declared metadata and the installed package list in the built image) — they were stale manual pins, not active dependencies. In particular, zipp was originally pinned in PR #204 to patch CVE-2024-5569; that dependency chain (pyspelling → importlib-metadata → zipp) no longer exists, so removing the pin does not reintroduce the vulnerability — the package simply isn't installed, pinned or not.

    • .github/dependabot.yml's pip ecosystem entry already set versioning-strategy: lockfile-only, which expects exactly this requirements.in/requirements.txt split; this change makes that existing setting apply as intended.

0.63.1, 2026-07-30, bug fix release, update recommended

  • Fixed sources glob patterns that combine brace expansion with the SPLIT/GLOBSTAR flags (e.g. **/*.{c,h}|!build/**) silently matching zero files and causing the action to fail with RuntimeError: None of the source targets from the configuration match any files. The pinned bracex dependency (2.5.post1) predated the version wcmatch requires for correct parsing of such patterns; bumped to 3.0.1 via PR #379. Addresses issue #378, reported by @​arkq.

0.63.0, 2026-07-01, maintenance release, update not required

  • Docker based image updated for Python 3.14.6 slim trixie via PR #364 from Dependabot.

0.62.0, 2026-06-19, security release, update recommended

  • Bumped lxml from 5.3.0 to 5.4.0 to address known CVEs via PR #357.

  • Bumped pymdown-extensions to patched version 10.21.3 via PR #358.

  • Bumped Markdown from 3.7 to 3.8.1 to patched version via PR #359.

... (truncated)

Commits
  • f2df388 Merge pull request #412 from rojopolis/release/0.68.0
  • 18eee54 Prepare release 0.68.0
  • d359a14 Merge pull request #411 from rojopolis/deps/pymdown-extensions-12.3
  • e2836b9 Add CHANGELOG.md entry for upcoming 0.68.0 release
  • c88675b Bump pymdown-extensions from 11.0.1 to 12.3
  • 0065676 Merge pull request #410 from rojopolis/deps/transitive-refresh
  • 8952318 Refresh transitive Python dependency pins
  • 8dd140a Merge pull request #408 from rojopolis/release/0.67.0
  • e42fae1 Fix CI spellcheck failure: use repository instead of repo's in CHANGELOG
  • 94b211c Prepare release 0.67.0
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump rojopolis/spellcheck-github-actions from 0.66.0 to 0.68.0
61520d1 
Bumps [rojopolis/spellcheck-github-actions](https://github.com/rojopolis/spellcheck-github-actions) from 0.66.0 to 0.68.0.
- [Release notes](https://github.com/rojopolis/spellcheck-github-actions/releases)
- [Changelog](https://github.com/rojopolis/spellcheck-github-actions/blob/master/CHANGELOG.md)
- [Commits](rojopolis/spellcheck-github-actions@c1934c5...f2df388)

---
updated-dependencies:
- dependency-name: rojopolis/spellcheck-github-actions
  dependency-version: 0.68.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 30, 2026
@martincostello
martincostello enabled auto-merge (squash) October 30, 2026 16:12
@martincostello
martincostello merged commit eafa1e7 into main Oct 30, 2026
26 checks passed
@martincostello
martincostello deleted the dependabot/github_actions/rojopolis/spellcheck-github-actions-0.68.0 branch October 30, 2026 16:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@martincostello martincostello martincostello approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@martincostello