Skip to content

Bump rojopolis/spellcheck-github-actions from 0.60.0 to 0.64.0 - #860

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/rojopolis/spellcheck-github-actions-0.64.0
Open

Bump rojopolis/spellcheck-github-actions from 0.60.0 to 0.64.0#860
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/rojopolis/spellcheck-github-actions-0.64.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps rojopolis/spellcheck-github-actions from 0.60.0 to 0.64.0.

Release notes

Sourced from rojopolis/spellcheck-github-actions's releases.

0.64.0

What's Changed

Full Changelog: rojopolis/spellcheck-github-actions@0.63.1...0.64.0

0.63.1

What's Changed

Full Changelog: rojopolis/spellcheck-github-actions@0.63.0...0.63.1

0.63.0

What's Changed

Full Changelog: rojopolis/spellcheck-github-actions@0.62.0...0.63.0

0.62.0

What's Changed

Full Changelog: rojopolis/spellcheck-github-actions@0.61.0...0.62.0

0.61.0

What's Changed

... (truncated)

Changelog

Sourced from rojopolis/spellcheck-github-actions's changelog.

0.64.0, 2026-07-31, maintenance release, update not required

  • Adopted pip-compile (pip-tools) for Python dependency management via PR #380. requirements.in is now the source of truth for direct dependencies (pyspelling, pymdown-extensions); requirements.txt is generated from it rather than hand-maintained, so transitive pins can no longer silently fall out of sync the way bracex did in issue #378.

    • backrefs and zipp are dropped from requirements.txt. Neither is part of the resolved dependency graph for pyspelling + pymdown-extensions on the Python version this image ships (verified against each package's own declared metadata and the installed package list in the built image) — they were stale manual pins, not active dependencies. In particular, zipp was originally pinned in PR #204 to patch CVE-2024-5569; that dependency chain (pyspelling → importlib-metadata → zipp) no longer exists, so removing the pin does not reintroduce the vulnerability — the package simply isn't installed, pinned or not.

    • .github/dependabot.yml's pip ecosystem entry already set versioning-strategy: lockfile-only, which expects exactly this requirements.in/requirements.txt split; this change makes that existing setting apply as intended.

0.63.1, 2026-07-30, bug fix release, update recommended

  • Fixed sources glob patterns that combine brace expansion with the SPLIT/GLOBSTAR flags (e.g. **/*.{c,h}|!build/**) silently matching zero files and causing the action to fail with RuntimeError: None of the source targets from the configuration match any files. The pinned bracex dependency (2.5.post1) predated the version wcmatch requires for correct parsing of such patterns; bumped to 3.0.1 via PR #379. Addresses issue #378, reported by @​arkq.

0.63.0, 2026-07-01, maintenance release, update not required

  • Docker based image updated for Python 3.14.6 slim trixie via PR #364 from Dependabot.

0.62.0, 2026-06-19, security release, update recommended

  • Bumped lxml from 5.3.0 to 5.4.0 to address known CVEs via PR #357.

  • Bumped pymdown-extensions to patched version 10.21.3 via PR #358.

  • Bumped Markdown from 3.7 to 3.8.1 to patched version via PR #359.

  • Cleaned up GitHub Actions workflows using zizmor and removed ratchet annotations via PR #355 and PR #356.

  • Clarified examples in README.

0.61.0, 2026-06-14, minor feature release, update not required

  • Docker based image updated for Python 3.14.5 slim trixie via PR #344 from Dependabot.

0.60, 2026-03-14, minor feature release, update not required

  • Docker based image updated for Python 3.14.3 slim trixie via PR #325 from Dependabot.

  • Cleaned up the error messaging, to address issue #328 from @​akohout-hai, the error message is now more correct, but not improved in general

0.59.0, 2026-03-02, feature release, update recommended

  • Improvements have been added to the docker entrypoint, based on a PR from @​akohout-hai which fixes an issue with handling of spaces in files names and directories, see PR #322 for details. This is his first contribution to the project and I want to thank him for his contribution, which is highly appreciated.

  • Docker based image updated to Python 3.14.3 slim trixie via PR #320 from Dependabot.

0.58.0, 2026-01-20, security release, update not required

... (truncated)

Commits
  • 26a39cd Merge pull request #383 from rojopolis/release/0.64.0
  • 83c2a8a Fix inconsistent steps indentation in Output Artifact example
  • 1096979 Release 0.64.0
  • d4fd16d Merge pull request #380 from rojopolis/chore/pip-compile-dependency-management
  • 7b3ceea Merge remote-tracking branch into chore/pip-compile-dependency-management
  • 2b98dff Add CHANGELOG entry for 0.64.0
  • 6f4f174 Merge origin/master and resolve requirements.txt conflict
  • 8861a59 Merge pull request #377 from rojopolis/dependabot/github_actions/docker/login...
  • b1a70f1 Merge pull request #381 from rojopolis/release/0.63.1
  • 6e33b9e Add arkq to wordlist to fix spellcheck CI failure
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note

Low Risk
Single CI dependency pin with no application or runtime code changes; main risk is a spellcheck workflow regression, which is easy to spot on PRs.

Overview
Updates the PR spellcheck workflow to use rojopolis/spellcheck-github-actions@0.64.0 instead of 0.60.0. Checkout and .github/spellcheck-settings.yml are unchanged.

The jump includes upstream security-oriented dependency updates (e.g. lxml, Markdown, pymdown-extensions in 0.62.0) and maintenance fixes in later patches; this repo’s Markdown sources remain simple globs (*.md, docs/*.md), so behavior should stay the same aside from the newer action image.

Reviewed by Cursor Bugbot for commit 4503ade. Bugbot is set up for automated code reviews on this repo. Configure here.

@dependabot
Bump rojopolis/spellcheck-github-actions from 0.60.0 to 0.64.0
4503ade 
Bumps [rojopolis/spellcheck-github-actions](https://github.com/rojopolis/spellcheck-github-actions) from 0.60.0 to 0.64.0.
- [Release notes](https://github.com/rojopolis/spellcheck-github-actions/releases)
- [Changelog](https://github.com/rojopolis/spellcheck-github-actions/blob/master/CHANGELOG.md)
- [Commits](rojopolis/spellcheck-github-actions@0.60.0...0.64.0)

---
updated-dependencies:
- dependency-name: rojopolis/spellcheck-github-actions
  dependency-version: 0.64.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants