Skip to content

chore(deps): bump lycheeverse/lychee-action from 2.8.0 to 2.9.0#112

Merged
agjs merged 1 commit into
mainfrom
dependabot/github_actions/lycheeverse/lychee-action-2.9.0
Jul 21, 2026
Merged

chore(deps): bump lycheeverse/lychee-action from 2.8.0 to 2.9.0#112
agjs merged 1 commit into
mainfrom
dependabot/github_actions/lycheeverse/lychee-action-2.9.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 17, 2026

Copy link
Copy Markdown
Contributor

Bumps lycheeverse/lychee-action from 2.8.0 to 2.9.0.

Release notes

Sourced from lycheeverse/lychee-action's releases.

v2.9.0

Summary

This release updates the default lychee version from v0.23.0 to v0.24.2.

The main reason for this release is compatibility with the new lychee 0.24.x release artifacts. Starting with lychee v0.24.0, the archive layout changed, and the lychee binary may now be packaged inside a subdirectory. lychee-action now detects that layout automatically, so users can upgrade without changing their workflows.

If you use:

uses: lycheeverse/lychee-action@v2

you will get the new version once the floating v2 tag has been updated. If you pin exact versions, update to:

uses: lycheeverse/lychee-action@v2.9.0

What’s new from lychee v0.24.x

Better diagnostics

lychee now reports line and column numbers for detected links. This makes broken link reports easier to act on, especially in larger documentation sites or generated reports.

Text fragment checking

lychee can now check URL text fragments, such as links containing #:~:text=.... This helps catch links that point to a valid page but no longer points to the intended highlighted text.

Sitemap support

lychee can now read sitemap.xml inputs. This is useful for checking published websites or generated documentation sites where the sitemap is the easiest source of URLs to validate.

JUnit output

lychee now supports JUnit output. This makes it easier to integrate link checking results with CI systems and test reporting tools that understand JUnit XML.

Redirect and remap visibility

lychee can now show redirects and remaps more clearly. This helps explain why a URL was checked as a different final URL and makes debugging link-checking behavior easier.

Multiple config files

lychee now supports multiple configuration files and expanded config handling. This is useful for repositories that split documentation, website, or package-specific link-checking settings.

Timeout handling

lychee can now accept timeouts explicitly. This gives users more control over how strict their link checks should be for flaky or slow endpoints.

Fixes and reliability improvements

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 17, 2026
agjs added a commit that referenced this pull request Jul 20, 2026
* chore(deps): consolidate the 14 open dependabot bumps

Single PR superseding the open dependabot PRs:
- fast-check 3.23.2 → 4.9.0 (packages/core) — full suite green on v4 (#93/#99)
- astro 7.0.9 → 7.1.3 (root + apps/docs) — clears GHSA-4g3v-8h47-v7g6 (#158/#162)
- @astrojs/react 5.0.6 → 6.0.1 (#114), @astrojs/sitemap 3.7.2 → 3.7.3 (#116)
- astro-mermaid 2.0.1 → 2.1.0 (#119)
- tailwindcss + @tailwindcss/vite 4.3.2 → 4.3.3 (#115/#117)
- wrangler 4.110.0/4.111.0 → 4.112.0 (#161), @ast-grep/cli 0.43.0 → 0.44.1 (#118)

Validated: typecheck + lint + full suite (2820) green. Docs build + osv run by CI.
NOTE: the transitive brace-expansion CVE (not a dependabot PR) is separate and may
still need an override; GH Actions bumps (#160 checkout, #112 lychee) are workflow
YAML, follow-up.

* fix(deps): pin brace-expansion to patched 5.0.7 (CVE-2026-13149)

New high-severity ReDoS advisory CVE-2026-13149 / GHSA-3jxr-9vmj-r5cp (published
~2026-07-20 21:00) affects brace-expansion <1.1.16 / <2.1.2 / <5.0.7. The lockfile
had 1.1.15 and 5.0.6 (transitive via eslint→minimatch/glob — a real runtime dep of
the published package, so it is FIXED, not ignored). Override forces all instances
to 5.0.7 (patched; API is a single stable expand() fn across majors). typecheck +
lint (uses minimatch/glob) + full suite green.

* fix(deps): pin js-yaml to patched 4.3.0 (GHSA-52cp-r559-cp3m)

The astro/tooling bumps pulled js-yaml 4.2.0 (High ReDoS, GHSA-52cp-r559-cp3m,
fixed 4.3.0). Transitive, 4.x only (no 3.x consumers) → override to 4.3.0.
osv-scanner local run: 'No issues found', exit 0. typecheck + lint + full suite green.
Bumps [lycheeverse/lychee-action](https://github.com/lycheeverse/lychee-action) from 2.8.0 to 2.9.0.
- [Release notes](https://github.com/lycheeverse/lychee-action/releases)
- [Commits](lycheeverse/lychee-action@8646ba3...e747777)

---
updated-dependencies:
- dependency-name: lycheeverse/lychee-action
  dependency-version: 2.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/lycheeverse/lychee-action-2.9.0 branch from 6d075ba to 1e744dc Compare July 21, 2026 07:36
agjs added a commit that referenced this pull request Jul 21, 2026
…165)

Consolidates the 3 remaining dependabot PRs off current main:
- #159 dev-toolchain: eslint 10.6.0→10.7.0, typescript-eslint/parser/utils 8.62.1/8.60.0→8.65.0,
  eslint-plugin-sonarjs ^4.0.3→^4.2.0, eslint-plugin-unicorn ^64→^72, prettier 3.9.4→3.9.5.
  DROPPED the proposed typescript 6.0.3→7.0.2: TS7 (native/Go preview) removes the classic
  compiler API (createProgram/sys/parseJsonConfigFileContent) that proptest-oracle.test.ts uses,
  breaking typecheck. Kept classic typescript@6.0.3 (@typescript/native stays 7.0.2 for tsc7).
- #160 actions/checkout 7.0.0→7.0.1 (6 workflows); #112 lycheeverse/lychee-action 2.8.0→2.9.0.
- unicorn@72 added prefer-ternary → fixed require-plugin-name.ts (if→ternary), not disabled.

Validated: typecheck + lint + format + full suite (2833, 0 fail) + osv-scanner (No issues found).
@agjs
agjs merged commit 6f882a8 into main Jul 21, 2026
5 checks passed
@agjs
agjs deleted the dependabot/github_actions/lycheeverse/lychee-action-2.9.0 branch July 21, 2026 07:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant