From 588716185d71f5219677a524c6a850ec342ea43b Mon Sep 17 00:00:00 2001 From: Johannes Schindelin Date: Fri, 14 Aug 2026 15:05:14 +0200 Subject: [PATCH 1/2] lint-docs: explicitly limit permissions to read-only The pinned lychee-action downloads and executes a separate binary without verifying its digest (please find the relevant code here: https://github.com/lycheeverse/lychee-action/blob/e7477775783e/action.yml#L64-L117). But https://github.com/lycheeverse/lychee/releases/tag/lychee-v0.24.2, i.e. that binary's release, is mutable. This release-artifact gap is a relatively close analogue to the what https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094 describes, and which has become known as "the XZ Utils backdoor". Let's close this gap at least as much as we can from our side, and hope that attacks like the now-finally-fixed Actions cache poisining (see https://github.com/AdnaneKhan/ActionsCacheBlasting/), i.e. attacks that work even in read-only mode as long as they are run on the repository's `main` branch, don't come back to bite us. Signed-off-by: Johannes Schindelin --- .github/workflows/lint-docs.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/lint-docs.yml b/.github/workflows/lint-docs.yml index ff64b9bcd2..aaad11e454 100644 --- a/.github/workflows/lint-docs.yml +++ b/.github/workflows/lint-docs.yml @@ -13,6 +13,9 @@ on: - '**.md' - '.github/workflows/lint-docs.yml' +permissions: + contents: read + jobs: lint-markdown: name: Lint markdown files From b685a11eb457e78a0947cb2df453ba0da0f278bf Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 9 Jul 2026 20:32:27 +0000 Subject: [PATCH 2/2] build(deps): bump lycheeverse/lychee-action from 2.8.0 to 2.9.0 Bumps [lycheeverse/lychee-action](https://github.com/lycheeverse/lychee-action) from 2.8.0 to 2.9.0. - [Release notes](https://github.com/lycheeverse/lychee-action/releases) - [Commits](https://github.com/lycheeverse/lychee-action/compare/8646ba30535128ac92d33dfc9133794bfdd9b411...e7477775783ea5526144ba13e8db5eec57747ce8) --- updated-dependencies: - dependency-name: lycheeverse/lychee-action dependency-version: 2.9.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/lint-docs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/lint-docs.yml b/.github/workflows/lint-docs.yml index aaad11e454..caa553521b 100644 --- a/.github/workflows/lint-docs.yml +++ b/.github/workflows/lint-docs.yml @@ -38,7 +38,7 @@ jobs: - name: Run link checker # For any troubleshooting, see: # https://github.com/lycheeverse/lychee/blob/master/docs/TROUBLESHOOTING.md - uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 + uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 with: # user-agent: if a user agent is not specified, some websites (e.g. # GitHub Docs) return HTTP errors which Lychee will interpret as