Skip to content

chore(deps): bump the github-actions group across 1 directory with 6 updates - #263

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-819cd4ef3b
Open

chore(deps): bump the github-actions group across 1 directory with 6 updates#263
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-819cd4ef3b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 6 updates in the / directory:

Package From To
actions/checkout 3.7.0 7.0.1
actions/setup-node 6.5.0 7.1.0
peaceiris/actions-gh-pages 3.9.3 4.1.0
peter-evans/create-issue-from-file 5.0.1 6.0.0
rojopolis/spellcheck-github-actions 0.47.0 0.66.0
actions/upload-artifact 4.6.2 7.0.2

Updates actions/checkout from 3.7.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates actions/setup-node from 6.5.0 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

v7.0.0

What's Changed

Enhancements:

... (truncated)

Commits
  • 949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
  • 7207c4f chore: update dependencies and add license files (#1642)
  • 54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
  • fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
  • 7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
  • 0c54c7b Bump @​typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
  • a829419 Bump @​types/semver from 7.7.1 to 7.8.0 (#1616)
  • 680d1e4 Support absolute paths in node-version-file (#1633)
  • db0fb3a Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (#1629)
  • 94196ee Bump pnpm/action-setup from 6.0.9 to 6.0.10 (#1602)
  • Additional commits viewable in compare view

Updates peaceiris/actions-gh-pages from 3.9.3 to 4.1.0

Release notes

Sourced from peaceiris/actions-gh-pages's releases.

actions-github-pages v4.1.0

See CHANGELOG.md for more details.

What's Changed

New Contributors

Full Changelog: peaceiris/actions-gh-pages@v4.0.0...v4.1.0

actions-github-pages v4.0.0

See CHANGELOG.md for more details.

Changelog

Sourced from peaceiris/actions-gh-pages's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

4.1.0 (2026-05-12)

chore

ci

docs

4.0.0 (2024-04-08)

build

chore

ci

docs

... (truncated)

Commits
  • 84c30a8 chore(release): 4.1.0
  • 6fa0f50 chore(release): Add build assets
  • 3b7506a chore(deps): update dependency trim-newlines to v5 (#1158)
  • aa0466c ci: harden GitHub Actions workflows (#1156)
  • 31835fb chore(deps): update actions/labeler action to v6 (#1153)
  • f4f1bc4 chore(deps): update peaceiris/actions-mdbook action to v2 (#1161)
  • a5e4979 chore(deps): update dependency ubuntu to v24 (#1159)
  • 6cc3bac chore(deps): update github/codeql-action action to v4 (#1160)
  • 0d6e9f4 chore(deps): update actions/setup-node action to v6 (#1154)
  • d70c101 chore(deps): update actions/upload-artifact action to v7 (#1155)
  • Additional commits viewable in compare view

Updates peter-evans/create-issue-from-file from 5.0.1 to 6.0.0

Release notes

Sourced from peter-evans/create-issue-from-file's releases.

Create Issue From File v6.0.0

⚙️ Requires Actions Runner v2.327.1 or later if you are using a self-hosted runner for Node 24 support.

What's Changed

... (truncated)

Commits

Updates rojopolis/spellcheck-github-actions from 0.47.0 to 0.66.0

Release notes

Sourced from rojopolis/spellcheck-github-actions's releases.

0.66.0

What's Changed

Full Changelog: rojopolis/spellcheck-github-actions@0.65.0...0.66.0

0.65.0

What's Changed

Full Changelog: rojopolis/spellcheck-github-actions@0.64.0...0.65.0

0.64.0

What's Changed

Full Changelog: rojopolis/spellcheck-github-actions@0.63.1...0.64.0

0.63.1

What's Changed

Full Changelog: rojopolis/spellcheck-github-actions@0.63.0...0.63.1

0.63.0

What's Changed

... (truncated)

Changelog

Sourced from rojopolis/spellcheck-github-actions's changelog.

Change Log for spellcheck-github-actions

0.68.0, 2026-10-24, maintenance release, update not required

  • Refreshed transitive Python dependency pins via PR #410: beautifulsoup4 4.12.3 to 4.15.0, Markdown 3.8.1 to 3.11.2, lxml 6.1.1 to 6.1.3, bracex 3.0.1 to 3.2, wcmatch 11.0 to 11.2, PyYAML 6.0.2 to 6.0.3, six 1.16.0 to 1.17.0, and webencodings 0.5.1 to 0.6.1. Also pulls in a new transitive dependency, typing-extensions 4.16.0, now required by the newer beautifulsoup4. None of these are pinned in requirements.in, so this is the same refresh Dependabot would otherwise have produced piecemeal under its lockfile-only strategy.

  • Bumped pymdown-extensions from 11.0.1 to 12.3 via PR #411. This is a major version bump with a documented BREAK in pymdown-extensions 12.0: BetterEm, Tilde, Caret, and Mark were rewritten with different nesting/escaping semantics. This repository's own pipeline configuration (spellcheck.yaml, examples/markdown.yml) only enables pymdownx.superfences, which is unaffected by that break and only gained new features across this range (a reset hook in 12.1, title_mode in 12.2/12.3). pyspelling itself does not depend on pymdown-extensions.

0.67.0, 2026-10-24, maintenance release, update not required

  • Docker image updated to Python 3.14.8-slim-trixie via PR #406 from Dependabot.

  • Bumped the core component PySpelling from 2.12.1 to 2.13 via PR #407. This release of PySpelling adds support for Python 3.15, drops support for Python 3.9 and 3.10, and introduces a new css_nostrict option for the XML/HTML filter to allow more relaxed CSS rules given soupsieve's new stricter defaults. This repository's own pyspelling.filters.html configuration (type selectors only) is unaffected, so the new option was not adopted. Pulls in soupsieve bumped from 2.9.2 to 3.0.4 transitively. See the release notes for PySpelling 2.13.

0.66.0, 2026-08-11, maintenance release, update not required

  • Docker image updated to Python 3.14.7-slim-trixie via PR #391 from Dependabot.

0.65.0, 2026-08-08, security release, update recommended

  • Bumped lxml from 5.4.0 to 6.1.1 to address CVE-2026-41066 (XXE via iterparse()/ETCompatXMLParser defaulting resolve_entities=True) and libxslt vulnerabilities CVE-2025-7424 and CVE-2025-11731, via PR #388 from Dependabot.

  • Bumped pymdown-extensions from 10.21.3 to 11.0.1 to address CVE-2026-67422 (ReDoS in the caret, tilde, betterem, and magiclink inline processors) and CVE-2026-61632 (path traversal in the b64 extension).

  • Bumped soupsieve from 2.6 to 2.9.2 to address CVE-2026-49476 (memory exhaustion via large comma-separated selector lists) and CVE-2026-49477 (ReDoS via the selector parser).

0.64.0, 2026-07-31, maintenance release, update not required

  • Adopted pip-compile (pip-tools) for Python dependency management via PR #380. requirements.in is now the source of truth for direct dependencies (pyspelling, pymdown-extensions); requirements.txt is generated from it rather than hand-maintained, so transitive pins can no longer silently fall out of sync the way bracex did in issue #378.

    • backrefs and zipp are dropped from requirements.txt. Neither is part of the resolved dependency graph for pyspelling + pymdown-extensions on the Python version this image ships (verified against each package's own declared metadata and the installed package list in the built image) — they were stale manual pins, not active dependencies. In particular, zipp was originally pinned in PR #204 to patch CVE-2024-5569; that dependency chain (pyspelling → importlib-metadata → zipp) no longer exists, so removing the pin does not reintroduce the vulnerability — the package simply isn't installed, pinned or not.

    • .github/dependabot.yml's pip ecosystem entry already set versioning-strategy: lockfile-only, which expects exactly this requirements.in/requirements.txt split; this change makes that existing setting apply as intended.

0.63.1, 2026-07-30, bug fix release, update recommended

  • Fixed sources glob patterns that combine brace expansion with the SP...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 12, 2026
@dependabot
chore(deps): bump the github-actions group across 1 directory with 6 …
fb7b60f 
…updates

Bumps the github-actions group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `3.7.0` | `7.0.1` |
| [actions/setup-node](https://github.com/actions/setup-node) | `6.5.0` | `7.1.0` |
| [peaceiris/actions-gh-pages](https://github.com/peaceiris/actions-gh-pages) | `3.9.3` | `4.1.0` |
| [peter-evans/create-issue-from-file](https://github.com/peter-evans/create-issue-from-file) | `5.0.1` | `6.0.0` |
| [rojopolis/spellcheck-github-actions](https://github.com/rojopolis/spellcheck-github-actions) | `0.47.0` | `0.66.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.2` |



Updates `actions/checkout` from 3.7.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v3.7.0...3d3c42e)

Updates `actions/setup-node` from 6.5.0 to 7.1.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@2499707...949feb2)

Updates `peaceiris/actions-gh-pages` from 3.9.3 to 4.1.0
- [Release notes](https://github.com/peaceiris/actions-gh-pages/releases)
- [Changelog](https://github.com/peaceiris/actions-gh-pages/blob/main/CHANGELOG.md)
- [Commits](peaceiris/actions-gh-pages@373f7f2...84c30a8)

Updates `peter-evans/create-issue-from-file` from 5.0.1 to 6.0.0
- [Release notes](https://github.com/peter-evans/create-issue-from-file/releases)
- [Commits](peter-evans/create-issue-from-file@e8ef132...fca9117)

Updates `rojopolis/spellcheck-github-actions` from 0.47.0 to 0.66.0
- [Release notes](https://github.com/rojopolis/spellcheck-github-actions/releases)
- [Changelog](https://github.com/rojopolis/spellcheck-github-actions/blob/master/CHANGELOG.md)
- [Commits](rojopolis/spellcheck-github-actions@ed07562...c1934c5)

Updates `actions/upload-artifact` from 4.6.2 to 7.0.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@ea165f8...cf430e0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: peaceiris/actions-gh-pages
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: peter-evans/create-issue-from-file
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: rojopolis/spellcheck-github-actions
  dependency-version: 0.66.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump the github-actions group with 6 updates chore(deps): bump the github-actions group across 1 directory with 6 updates Oct 26, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-819cd4ef3b branch from dbcbf57 to fb7b60f Compare October 26, 2026 17:02

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants