Skip to content

build(deps): bump lycheeverse/lychee-action from 2.8.0 to 2.9.0 - #2374

Merged
dscho merged 2 commits into
mainfrom
dependabot/github_actions/lycheeverse/lychee-action-2.9.0
Aug 14, 2026
Merged

build(deps): bump lycheeverse/lychee-action from 2.8.0 to 2.9.0#2374
dscho merged 2 commits into
mainfrom
dependabot/github_actions/lycheeverse/lychee-action-2.9.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 9, 2026

Copy link
Copy Markdown
Contributor

Bumps lycheeverse/lychee-action from 2.8.0 to 2.9.0.

Release notes

Sourced from lycheeverse/lychee-action's releases.

v2.9.0

Summary

This release updates the default lychee version from v0.23.0 to v0.24.2.

The main reason for this release is compatibility with the new lychee 0.24.x release artifacts. Starting with lychee v0.24.0, the archive layout changed, and the lychee binary may now be packaged inside a subdirectory. lychee-action now detects that layout automatically, so users can upgrade without changing their workflows.

If you use:

uses: lycheeverse/lychee-action@v2

you will get the new version once the floating v2 tag has been updated. If you pin exact versions, update to:

uses: lycheeverse/lychee-action@v2.9.0

What’s new from lychee v0.24.x

Better diagnostics

lychee now reports line and column numbers for detected links. This makes broken link reports easier to act on, especially in larger documentation sites or generated reports.

Text fragment checking

lychee can now check URL text fragments, such as links containing #:~:text=.... This helps catch links that point to a valid page but no longer points to the intended highlighted text.

Sitemap support

lychee can now read sitemap.xml inputs. This is useful for checking published websites or generated documentation sites where the sitemap is the easiest source of URLs to validate.

JUnit output

lychee now supports JUnit output. This makes it easier to integrate link checking results with CI systems and test reporting tools that understand JUnit XML.

Redirect and remap visibility

lychee can now show redirects and remaps more clearly. This helps explain why a URL was checked as a different final URL and makes debugging link-checking behavior easier.

Multiple config files

lychee now supports multiple configuration files and expanded config handling. This is useful for repositories that split documentation, website, or package-specific link-checking settings.

Timeout handling

lychee can now accept timeouts explicitly. This gives users more control over how strict their link checks should be for flaky or slow endpoints.

Fixes and reliability improvements

... (truncated)

Commits

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 9, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner July 9, 2026 20:32
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 9, 2026
dscho and others added 2 commits August 14, 2026 15:13
The pinned lychee-action downloads and executes a separate binary
without verifying its digest (please find the relevant code here:
https://github.com/lycheeverse/lychee-action/blob/e7477775783e/action.yml#L64-L117).
But https://github.com/lycheeverse/lychee/releases/tag/lychee-v0.24.2,
i.e. that binary's release, is mutable.

This release-artifact gap is a relatively close analogue to the what
https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094
describes, and which has become known as "the XZ Utils backdoor".

Let's close this gap at least as much as we can from our side, and hope
that attacks like the now-finally-fixed Actions cache poisining (see
https://github.com/AdnaneKhan/ActionsCacheBlasting/), i.e. attacks that
work even in read-only mode as long as they are run on the repository's
`main` branch, don't come back to bite us.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Bumps [lycheeverse/lychee-action](https://github.com/lycheeverse/lychee-action) from 2.8.0 to 2.9.0.
- [Release notes](https://github.com/lycheeverse/lychee-action/releases)
- [Commits](lycheeverse/lychee-action@8646ba3...e747777)

---
updated-dependencies:
- dependency-name: lycheeverse/lychee-action
  dependency-version: 2.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dscho
dscho force-pushed the dependabot/github_actions/lycheeverse/lychee-action-2.9.0 branch from 78eb975 to b685a11 Compare August 14, 2026 13:13
@dscho
dscho enabled auto-merge August 14, 2026 14:13
@dscho
dscho merged commit 10f818b into main Aug 14, 2026
26 checks passed
@dscho
dscho deleted the dependabot/github_actions/lycheeverse/lychee-action-2.9.0 branch August 14, 2026 14:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants