[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps the version-update group with 3 updates in the /.github/workflows directory: rojopolis/spellcheck-github-actions, actions/upload-artifact and actions/download-artifact.

Updates rojopolis/spellcheck-github-actions from 0.66.0 to 0.68.0

Release notes

Sourced from rojopolis/spellcheck-github-actions's releases.

0.68.0

What's Changed

• Refresh transitive Python dependency pins by @​jonasbn in rojopolis/spellcheck-github-actions#410
• Bump pymdown-extensions from 11.0.1 to 12.3 by @​jonasbn in rojopolis/spellcheck-github-actions#411
• Prepare release 0.68.0 by @​jonasbn in rojopolis/spellcheck-github-actions#412

Full Changelog: rojopolis/spellcheck-github-actions@0.67.0...0.68.0

0.67.0

What's Changed

• Bump rojopolis/spellcheck-github-actions from 0.64.0 to 0.66.0 by @​dependabot[bot] in rojopolis/spellcheck-github-actions#395
• Bump python from 83c1ceb to ce40764 by @​dependabot[bot] in rojopolis/spellcheck-github-actions#394
• Fix stale Python version comment in Dockerfile by @​jonasbn in rojopolis/spellcheck-github-actions#396
• Bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @​dependabot[bot] in rojopolis/spellcheck-github-actions#397
• Bump python from ce40764 to cae66f2 by @​dependabot[bot] in rojopolis/spellcheck-github-actions#398
• Bump python from cae66f2 to cad9a2c by @​dependabot[bot] in rojopolis/spellcheck-github-actions#399
• Bump docker/setup-qemu-action from 4.2.0 to 4.3.0 by @​dependabot[bot] in rojopolis/spellcheck-github-actions#400
• Bump docker/setup-qemu-action from 4.3.0 to 4.4.0 by @​dependabot[bot] in rojopolis/spellcheck-github-actions#401
• Bump docker/setup-buildx-action from 4.3.0 to 4.4.1 by @​dependabot[bot] in rojopolis/spellcheck-github-actions#402
• Bump docker/build-push-action from 7.3.0 to 7.4.0 by @​dependabot[bot] in rojopolis/spellcheck-github-actions#403
• Bump actions/upload-artifact from 7.0.1 to 7.0.2 by @​dependabot[bot] in rojopolis/spellcheck-github-actions#405
• Bump python from 3.14.7-slim-trixie to 3.14.8-slim-trixie by @​dependabot[bot] in rojopolis/spellcheck-github-actions#406
• Bump core component PySpelling from 2.12.1 to 2.13 by @​jonasbn in rojopolis/spellcheck-github-actions#407
• Prepare release 0.67.0 by @​jonasbn in rojopolis/spellcheck-github-actions#408

Full Changelog: rojopolis/spellcheck-github-actions@0.66.0...0.67.0

Changelog

Sourced from rojopolis/spellcheck-github-actions's changelog.

Change Log for spellcheck-github-actions

0.69.0, 2026-11-03, maintenance release, update recommended

• Docker image updated to Python 3.14.9-slim-trixie via PR #417 from Dependabot. Python 3.14.9 is an expedited security release that upgrades the bundled pip to 26.2.2 (including certifi 2026.10.19) in response to the eMudhra / emSign CA certificate incident, see the Python 3.14.9 release notes. Users of the prebuilt action are not affected in ordinary spellchecking; users who rebuild the image from the Dockerfile or run pip inside it are recommended to update.

• Bumped docker/login-action from 4.6.0 to 4.7.0 in the Docker build workflow via PR #416 from Dependabot.

0.68.0, 2026-10-24, maintenance release, update not required

• Refreshed transitive Python dependency pins via PR #410: beautifulsoup4 4.12.3 to 4.15.0, Markdown 3.8.1 to 3.11.2, lxml 6.1.1 to 6.1.3, bracex 3.0.1 to 3.2, wcmatch 11.0 to 11.2, PyYAML 6.0.2 to 6.0.3, six 1.16.0 to 1.17.0, and webencodings 0.5.1 to 0.6.1. Also pulls in a new transitive dependency, typing-extensions 4.16.0, now required by the newer beautifulsoup4. None of these are pinned in requirements.in, so this is the same refresh Dependabot would otherwise have produced piecemeal under its lockfile-only strategy.

• Bumped pymdown-extensions from 11.0.1 to 12.3 via PR #411. This is a major version bump with a documented BREAK in pymdown-extensions 12.0: BetterEm, Tilde, Caret, and Mark were rewritten with different nesting/escaping semantics. This repository's own pipeline configuration (spellcheck.yaml, examples/markdown.yml) only enables pymdownx.superfences, which is unaffected by that break and only gained new features across this range (a reset hook in 12.1, title_mode in 12.2/12.3). pyspelling itself does not depend on pymdown-extensions.

0.67.0, 2026-10-24, maintenance release, update not required

• Docker image updated to Python 3.14.8-slim-trixie via PR #406 from Dependabot.

• Bumped the core component PySpelling from 2.12.1 to 2.13 via PR #407. This release of PySpelling adds support for Python 3.15, drops support for Python 3.9 and 3.10, and introduces a new css_nostrict option for the XML/HTML filter to allow more relaxed CSS rules given soupsieve's new stricter defaults. This repository's own pyspelling.filters.html configuration (type selectors only) is unaffected, so the new option was not adopted. Pulls in soupsieve bumped from 2.9.2 to 3.0.4 transitively. See the release notes for PySpelling 2.13.

0.66.0, 2026-08-11, maintenance release, update not required

• Docker image updated to Python 3.14.7-slim-trixie via PR #391 from Dependabot.

0.65.0, 2026-08-08, security release, update recommended

• Bumped lxml from 5.4.0 to 6.1.1 to address CVE-2026-41066 (XXE via iterparse()/ETCompatXMLParser defaulting resolve_entities=True) and libxslt vulnerabilities CVE-2025-7424 and CVE-2025-11731, via PR #388 from Dependabot.

• Bumped pymdown-extensions from 10.21.3 to 11.0.1 to address CVE-2026-67422 (ReDoS in the caret, tilde, betterem, and magiclink inline processors) and CVE-2026-61632 (path traversal in the b64 extension).

• Bumped soupsieve from 2.6 to 2.9.2 to address CVE-2026-49476 (memory exhaustion via large comma-separated selector lists) and CVE-2026-49477 (ReDoS via the selector parser).

0.64.0, 2026-07-31, maintenance release, update not required

• Adopted pip-compile (pip-tools) for Python dependency management via PR #380. requirements.in is now the source of truth for direct dependencies (pyspelling, pymdown-extensions); requirements.txt is generated from it rather than hand-maintained, so transitive pins can no longer silently fall out of sync the way bracex did in issue #378.

  • backrefs and zipp are dropped from requirements.txt. Neither is part of the resolved dependency graph for pyspelling + pymdown-extensions on the Python version this image ships (verified against each package's own declared metadata and the installed package list in the built image) — they were stale manual pins, not active dependencies. In particular, zipp was originally pinned in PR #204 to patch CVE-2024-5569; that dependency chain (pyspelling → importlib-metadata → zipp) no longer exists, so removing the pin does not reintroduce the vulnerability — the package simply isn't installed, pinned or not.

  • .github/dependabot.yml's pip ecosystem entry already set versioning-strategy: lockfile-only, which expects exactly this requirements.in/requirements.txt split; this change makes that existing setting apply as intended.

0.63.1, 2026-07-30, bug fix release, update recommended

• Fixed sources glob patterns that combine brace expansion with the SPLIT/GLOBSTAR flags (e.g. **/*.{c,h}|!build/**) silently matching zero files and causing the action to fail with RuntimeError: None of the source targets from the configuration match any files. The pinned bracex dependency (2.5.post1) predated the version wcmatch requires for correct parsing of such patterns; bumped to 3.0.1 via PR #379. Addresses issue #378, reported by @​arkq.

0.63.0, 2026-07-01, maintenance release, update not required

• Docker based image updated for Python 3.14.6 slim trixie via PR #364 from Dependabot.

0.62.0, 2026-06-19, security release, update recommended

... (truncated)

Commits

• f2df388 Merge pull request #412 from rojopolis/release/0.68.0
• 18eee54 Prepare release 0.68.0
• d359a14 Merge pull request #411 from rojopolis/deps/pymdown-extensions-12.3
• e2836b9 Add CHANGELOG.md entry for upcoming 0.68.0 release
• c88675b Bump pymdown-extensions from 11.0.1 to 12.3
• 0065676 Merge pull request #410 from rojopolis/deps/transitive-refresh
• 8952318 Refresh transitive Python dependency pins
• 8dd140a Merge pull request #408 from rojopolis/release/0.67.0
• e42fae1 Fix CI spellcheck failure: use repository instead of repo's in CHANGELOG
• 94b211c Prepare release 0.67.0
• Additional commits viewable in compare view

Updates actions/upload-artifact from 7.0.1 to 7.0.2

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.2

What's Changed

• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Updates @​actions/artifact to v6.3.1.

New Contributors

• @​tunc-d made their first contribution in actions/upload-artifact#821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

Commits

• cf430e0 Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2
• c2acded chore: prepare v7.0.2 release
• 4687c1b Merge pull request #821 from actions/tunc-d-upload-artifact-package-bump
• 8cbe1be Bump @​actions/artifact to 6.3.1
• See full diff in compare view

Updates actions/download-artifact from 8.0.1 to 8.0.2

Release notes

Sourced from actions/download-artifact's releases.

v8.0.2

What's Changed

• Update the readme by @​danwkennedy in actions/download-artifact#473
• Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
• Update @​actions/artifact to 6.3.1 by @​tunc-d in actions/download-artifact#492
• Prepare download-artifact v8.0.2 by @​tunc-d in actions/download-artifact#493

New Contributors

• @​tunc-d made their first contribution in actions/download-artifact#492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

Commits

• 9000827 Merge pull request #493 from actions/tunc-d-prepare-download-v8-0-2
• e455989 Prepare download-artifact v8.0.2
• a00b90c Merge pull request #492 from actions/tunc-d-download-artifact-package-bump
• 29bb7ce Update @​actions/artifact to 6.3.1
• 484a0b5 Update the readme (#473)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[jgadsden]

done manuall, closing

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml