Bump the update-version group in /.github/workflows with 5 updates

[dependabot]

Bumps the update-version group in /.github/workflows with 5 updates:

Package	From	To
otto-de/purge-deprecated-workflow-runs	4.0.10	4.0.13
actions/stale	10.3.0	10.4.0
actions/checkout	7.0.0	7.0.1
lycheeverse/lychee-action	2.8.0	2.9.0
rojopolis/spellcheck-github-actions	0.60.0	0.63.0

Updates otto-de/purge-deprecated-workflow-runs from 4.0.10 to 4.0.13

Release notes

Sourced from otto-de/purge-deprecated-workflow-runs's releases.

4.0.13 ⬆️ update dependencies

What's Changed

• Bump @​vercel/ncc from 0.44.0 to 0.44.1 by @​dependabot[bot] in otto-de/purge-deprecated-workflow-runs#177

Full Changelog: otto-de/purge-deprecated-workflow-runs@v4.0.12...v4.0.13

4.0.12 ⬆️ update dependencies

What's Changed

• Bump undici from 6.24.1 to 6.27.0 by @​dependabot[bot] in otto-de/purge-deprecated-workflow-runs#175
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in otto-de/purge-deprecated-workflow-runs#174
• Bump @​types/node from 24.12.2 to 26.0.1 by @​dependabot[bot] in otto-de/purge-deprecated-workflow-runs#176

4.0.11 was broken and this is basically the same contents

Full Changelog: otto-de/purge-deprecated-workflow-runs@v4.0.10...v4.0.12

Commits

• c1c15cf Release
• 1b30789 Bump @​vercel/ncc from 0.44.0 to 0.44.1 (#177)
• 13dac29 Update security policy to reflect that only v4 is receiving updates
• 94a4d1d Bump @​types/node from 24.12.2 to 26.0.1 (#176)
• 8b0c7d2 Bump actions/checkout from 6 to 7 (#174)
• 0950c1d Bump undici from 6.24.1 to 6.27.0 (#175)
• See full diff in compare view

Updates actions/stale from 10.3.0 to 10.4.0

Release notes

Sourced from actions/stale's releases.

v10.4.0

What's Changed

Bug Fix

• Fixed only-issue-types validation by @​trueberryless in actions/stale#1338

Dependency Updates

• Bump undici to 6.27.0 via override, clean up stale license files, and version to 10.4.0. by @​dependabot in actions/stale#1342

New Contributors

• @​trueberryless made their first contribution in actions/stale#1338

Full Changelog: actions/stale@v10.3.0...v10.4.0

Commits

• 1e223db Bump undici to 6.27.0 via override, clean up stale license files, and version...
• 9461cb1 fix: only-issue-types does not affect PRs (#1338)
• See full diff in compare view

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

• skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

• Skip running unsafe pr check if input is default by @​aiqiaoy in actions/checkout#2518
• Trim only ascii whitespace for branch by @​aiqiaoy in actions/checkout#2521
• Escape values passed to --unset by @​aiqiaoy in actions/checkout#2530
• Various dependency updates

v7.0.0

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in actions/checkout#2454
• Various dependency updates

v6.0.3

• Fix checkout init for SHA-256 repositories by @​yaananth in actions/checkout#2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in actions/checkout#2414

v6.0.2

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in actions/checkout#2356

v6.0.1

• Add worktree support for persist-credentials includeIf by @​ericsciple in actions/checkout#2327

v6.0.0

• Persist creds to a separate file by @​ericsciple in actions/checkout#2286
• Update README to include Node.js 24 support details and requirements by @​salmanmkc in actions/checkout#2248

v5.0.1

• Port v6 cleanup to v5 by @​ericsciple in actions/checkout#2301

v5.0.0

• Update actions checkout to use node 24 by @​salmanmkc in actions/checkout#2226

v4.3.1

• Port v6 cleanup to v4 by @​ericsciple in actions/checkout#2305

v4.3.0

• docs: update README.md by @​motss in actions/checkout#1971
• Add internal repos for checking out multiple repositories by @​mouismail in actions/checkout#1977
• Documentation update - add recommended permissions to Readme by @​benwells in actions/checkout#2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in actions/checkout#2044
• Update README.md by @​nebuk89 in actions/checkout#2194
• Update CODEOWNERS for actions by @​TingluoHuang in actions/checkout#2224
• Update package dependencies by @​salmanmkc in actions/checkout#2236

v4.2.2

• url-helper.ts now leverages well-known environment variables by @​jww3 in actions/checkout#1941
• Expand unit test coverage for isGhes by @​jww3 in actions/checkout#1946

v4.2.1

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in actions/checkout#1924

... (truncated)

Commits

• 3d3c42e prep v7.0.1 release (#2531)
• 2880268 escape values passed to --unset (#2530)
• 12cd223 trim only ascii whitespace for branch (#2521)
• 62661c4 skip running unsafe pr check if input is default (#2518)
• e8d4307 Bump the minor-actions-dependencies group with 2 updates (#2499)
• 631c942 eslint 9 (#2474)
• 4f1f4ae Bump actions/upload-artifact from 4 to 7 (#2476)
• ba09753 Bump actions/checkout from 6 to 7 (#2488)
• b9e0990 Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)
• e8cb398 Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)
• Additional commits viewable in compare view

Updates lycheeverse/lychee-action from 2.8.0 to 2.9.0

Release notes

Sourced from lycheeverse/lychee-action's releases.

v2.9.0

Summary

This release updates the default lychee version from v0.23.0 to v0.24.2.

The main reason for this release is compatibility with the new lychee 0.24.x release artifacts. Starting with lychee v0.24.0, the archive layout changed, and the lychee binary may now be packaged inside a subdirectory. lychee-action now detects that layout automatically, so users can upgrade without changing their workflows.

If you use:

uses: lycheeverse/lychee-action@v2

you will get the new version once the floating v2 tag has been updated. If you pin exact versions, update to:

uses: lycheeverse/lychee-action@v2.9.0

What’s new from lychee v0.24.x

Better diagnostics

lychee now reports line and column numbers for detected links. This makes broken link reports easier to act on, especially in larger documentation sites or generated reports.

Text fragment checking

lychee can now check URL text fragments, such as links containing #:~:text=.... This helps catch links that point to a valid page but no longer points to the intended highlighted text.

Sitemap support

lychee can now read sitemap.xml inputs. This is useful for checking published websites or generated documentation sites where the sitemap is the easiest source of URLs to validate.

JUnit output

lychee now supports JUnit output. This makes it easier to integrate link checking results with CI systems and test reporting tools that understand JUnit XML.

Redirect and remap visibility

lychee can now show redirects and remaps more clearly. This helps explain why a URL was checked as a different final URL and makes debugging link-checking behavior easier.

Multiple config files

lychee now supports multiple configuration files and expanded config handling. This is useful for repositories that split documentation, website, or package-specific link-checking settings.

Timeout handling

lychee can now accept timeouts explicitly. This gives users more control over how strict their link checks should be for flaky or slow endpoints.

Fixes and reliability improvements

... (truncated)

Commits

• e747777 Bump actions/cache from 5 to 6 (#340)
• 39066c6 Bump actions/checkout from 6 to 7 (#339)
• 6da1d14 Install into $RUNNER_TEMP instead of $HOME (#338)
• a63497c fixes #322 check for null (#336)
• b40e218 [create-pull-request] automated change
• faea714 bump default to 0.24.1 and auto-detect lychee bin in subfolder (#330)
• See full diff in compare view

Updates rojopolis/spellcheck-github-actions from 0.60.0 to 0.63.0

Release notes

Sourced from rojopolis/spellcheck-github-actions's releases.

0.63.0

What's Changed

• Update CLAUDE.md with release workflow and gotchas by @​jonasbn in rojopolis/spellcheck-github-actions#363
• Bump rojopolis/spellcheck-github-actions from 0.61.0 to 0.62.0 by @​dependabot[bot] in rojopolis/spellcheck-github-actions#366
• Bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in rojopolis/spellcheck-github-actions#365
• Bump python from 3.14.5-slim-trixie to 3.14.6-slim-trixie by @​dependabot[bot] in rojopolis/spellcheck-github-actions#364
• Release 0.63.0 by @​jonasbn in rojopolis/spellcheck-github-actions#367

Full Changelog: rojopolis/spellcheck-github-actions@0.62.0...0.63.0

0.62.0

What's Changed

• Workflow clean up by @​jonasbn in rojopolis/spellcheck-github-actions#355
• More workflow clean up by @​jonasbn in rojopolis/spellcheck-github-actions#356
• Bumped lxml version to address known CVEs by @​jonasbn in rojopolis/spellcheck-github-actions#357
• Upgrade for pymdown-extensions by @​jonasbn in rojopolis/spellcheck-github-actions#358
• Bumped Markdown dependency version to patched version by @​jonasbn in rojopolis/spellcheck-github-actions#359
• Release 0.62.0 by @​jonasbn in rojopolis/spellcheck-github-actions#361

Full Changelog: rojopolis/spellcheck-github-actions@0.61.0...0.62.0

0.61.0

What's Changed

• Bump rojopolis/spellcheck-github-actions from 0.59.0 to 0.60.0 by @​dependabot[bot] in rojopolis/spellcheck-github-actions#337
• Bump docker/login-action from 4.0.0 to 4.1.0 by @​dependabot[bot] in rojopolis/spellcheck-github-actions#339
• Bump docker/build-push-action from 7.0.0 to 7.1.0 by @​dependabot[bot] in rojopolis/spellcheck-github-actions#342
• Bump actions/upload-artifact from 7.0.0 to 7.0.1 by @​dependabot[bot] in rojopolis/spellcheck-github-actions#341
• Added Claude configuration for assistance with chores and maintenance by @​jonasbn in rojopolis/spellcheck-github-actions#345
• Bump python from 3.14.3-slim-trixie to 3.14.5-slim-trixie by @​dependabot[bot] in rojopolis/spellcheck-github-actions#344
• Bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @​dependabot[bot] in rojopolis/spellcheck-github-actions#348
• Bump docker/metadata-action from 6.0.0 to 6.1.0 by @​dependabot[bot] in rojopolis/spellcheck-github-actions#349
• Bump docker/build-push-action from 7.1.0 to 7.2.0 by @​dependabot[bot] in rojopolis/spellcheck-github-actions#347
• Bump docker/login-action from 4.1.0 to 4.2.0 by @​dependabot[bot] in rojopolis/spellcheck-github-actions#350
• Bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in rojopolis/spellcheck-github-actions#352
• Bump docker/setup-qemu-action from 4.0.0 to 4.1.0 by @​dependabot[bot] in rojopolis/spellcheck-github-actions#351
• Release 0.61.0 by @​jonasbn in rojopolis/spellcheck-github-actions#353

Full Changelog: rojopolis/spellcheck-github-actions@0.60.0...0.61.0

Changelog

Sourced from rojopolis/spellcheck-github-actions's changelog.

Change Log for spellcheck-github-actions

0.64.0, 2026-07-31, maintenance release, update not required

• Adopted pip-compile (pip-tools) for Python dependency management via PR #380. requirements.in is now the source of truth for direct dependencies (pyspelling, pymdown-extensions); requirements.txt is generated from it rather than hand-maintained, so transitive pins can no longer silently fall out of sync the way bracex did in issue #378.

  • backrefs and zipp are dropped from requirements.txt. Neither is part of the resolved dependency graph for pyspelling + pymdown-extensions on the Python version this image ships (verified against each package's own declared metadata and the installed package list in the built image) — they were stale manual pins, not active dependencies. In particular, zipp was originally pinned in PR #204 to patch CVE-2024-5569; that dependency chain (pyspelling → importlib-metadata → zipp) no longer exists, so removing the pin does not reintroduce the vulnerability — the package simply isn't installed, pinned or not.

  • .github/dependabot.yml's pip ecosystem entry already set versioning-strategy: lockfile-only, which expects exactly this requirements.in/requirements.txt split; this change makes that existing setting apply as intended.

0.63.1, 2026-07-30, bug fix release, update recommended

• Fixed sources glob patterns that combine brace expansion with the SPLIT/GLOBSTAR flags (e.g. **/*.{c,h}|!build/**) silently matching zero files and causing the action to fail with RuntimeError: None of the source targets from the configuration match any files. The pinned bracex dependency (2.5.post1) predated the version wcmatch requires for correct parsing of such patterns; bumped to 3.0.1 via PR #379. Addresses issue #378, reported by @​arkq.

0.63.0, 2026-07-01, maintenance release, update not required

• Docker based image updated for Python 3.14.6 slim trixie via PR #364 from Dependabot.

0.62.0, 2026-06-19, security release, update recommended

• Bumped lxml from 5.3.0 to 5.4.0 to address known CVEs via PR #357.

• Bumped pymdown-extensions to patched version 10.21.3 via PR #358.

• Bumped Markdown from 3.7 to 3.8.1 to patched version via PR #359.

• Cleaned up GitHub Actions workflows using zizmor and removed ratchet annotations via PR #355 and PR #356.

• Clarified examples in README.

0.61.0, 2026-06-14, minor feature release, update not required

• Docker based image updated for Python 3.14.5 slim trixie via PR #344 from Dependabot.

0.60, 2026-03-14, minor feature release, update not required

• Docker based image updated for Python 3.14.3 slim trixie via PR #325 from Dependabot.

• Cleaned up the error messaging, to address issue #328 from @​akohout-hai, the error message is now more correct, but not improved in general

0.59.0, 2026-03-02, feature release, update recommended

• Improvements have been added to the docker entrypoint, based on a PR from @​akohout-hai which fixes an issue with handling of spaces in files names and directories, see PR #322 for details. This is his first contribution to the project and I want to thank him for his contribution, which is highly appreciated.

• Docker based image updated to Python 3.14.3 slim trixie via PR #320 from Dependabot.

0.58.0, 2026-01-20, security release, update not required

• A minor security issue in the dependency: pymdown-extensions, which is used by the core component PySpelling
  • GHSA-r6h4-mm7h-8pmq

... (truncated)

Commits

• e619e00 Merge pull request #367 from rojopolis/release-0.63.0
• e9f0ea4 Prepare release 0.63.0
• 32854ed Bump python from 3.14.5-slim-trixie to 3.14.6-slim-trixie
• 0d74ebf Merge pull request #365 from rojopolis/dependabot/github_actions/actions/chec...
• 9016db1 Bump actions/checkout from 6.0.3 to 7.0.0
• 7f48afb Merge pull request #366 from rojopolis/dependabot/github_actions/rojopolis/sp...
• 7cb618c Bump rojopolis/spellcheck-github-actions from 0.61.0 to 0.62.0
• 7f79330 Bump python from 3.14.5-slim-trixie to 3.14.6-slim-trixie
• 02d2e14 Merge pull request #363 from rojopolis/update-claude-md
• 68b0f0b Update CLAUDE.md with release workflow, Dependabot, and README gotchas
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions