chore(deps): update rojopolis/spellcheck-github-actions action to v0.64.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
rojopolis/spellcheck-github-actions	action	minor	0.61.0 → 0.64.0

---

Release Notes

rojopolis/spellcheck-github-actions (rojopolis/spellcheck-github-actions)

v0.64.0

Compare Source

• Adopted pip-compile (pip-tools) for Python dependency management via PR #​380. requirements.in is now the source of truth for direct dependencies (pyspelling, pymdown-extensions); requirements.txt is generated from it rather than hand-maintained, so transitive pins can no longer silently fall out of sync the way bracex did in issue #​378.

  • backrefs and zipp are dropped from requirements.txt. Neither is part of the resolved dependency graph for pyspelling + pymdown-extensions on the Python version this image ships (verified against each package's own declared metadata and the installed package list in the built image) — they were stale manual pins, not active dependencies. In particular, zipp was originally pinned in PR #​204 to patch CVE-2024-5569; that dependency chain (pyspelling → importlib-metadata → zipp) no longer exists, so removing the pin does not reintroduce the vulnerability — the package simply isn't installed, pinned or not.

  • .github/dependabot.yml's pip ecosystem entry already set versioning-strategy: lockfile-only, which expects exactly this requirements.in/requirements.txt split; this change makes that existing setting apply as intended.

v0.63.1

Compare Source

• Fixed sources glob patterns that combine brace expansion with the SPLIT/GLOBSTAR flags (e.g. **/*.{c,h}|!build/**) silently matching zero files and causing the action to fail with RuntimeError: None of the source targets from the configuration match any files. The pinned bracex dependency (2.5.post1) predated the version wcmatch requires for correct parsing of such patterns; bumped to 3.0.1 via PR #​379. Addresses issue #​378, reported by @​arkq.

v0.63.0

Compare Source

• Docker based image updated for Python 3.14.6 slim trixie via PR #​364 from Dependabot.

v0.62.0

Compare Source

• Bumped lxml from 5.3.0 to 5.4.0 to address known CVEs via PR #​357.

• Bumped pymdown-extensions to patched version 10.21.3 via PR #​358.

• Bumped Markdown from 3.7 to 3.8.1 to patched version via PR #​359.

• Cleaned up GitHub Actions workflows using zizmor and removed ratchet annotations via PR #​355 and PR #​356.

• Clarified examples in README.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.