build(deps): bump the github-actions group with 2 updates

[dependabot]

Bumps the github-actions group with 2 updates: rvben/rumdl and zizmorcore/zizmor-action.

Updates rvben/rumdl from 0.2.43 to 0.2.49

Release notes

Sourced from rvben/rumdl's releases.

v0.2.49

Security

• config: keep an extends target's path and contents out of messages about it (72bcb49)

  An extends value is expanded from the environment before it is resolved, so naming the resolved path in an error or warning printed environment variable values wherever that message went, which under CI is the build log. extends also points at an arbitrary path, so a target that is not valid TOML had its offending line quoted back. A file reached through extends is now named by the reference as written, and its own text is never repeated. A config you name yourself is unchanged, and rumdl config, the language server's report to its editor, and RUST_LOG=debug still show resolved paths.

  Reported privately by Shuvam Kumar.

Fixed

• md072: keep every trailing newline when sorting frontmatter keys (a5e7c40)
• fix-utils: measure fix ranges against the content the rule read (2ed4238)
• md044: read a wikilink's display text, not the page name it hides (51d584e)
• md039: keep wikilinks and nested images intact when trimming link text (aabd859)
• md045,md057,md044: stop reporting wiki embeds as images (1147d17)
• md058,md065: preserve the trailing newline when inserting blank lines (#783) (0ba54ce)
• md013: track line numbers in BlockBuilder for list reflow (#780) (56e2b3f)
• mkdocs: read an indented code block inside a container body as code (9439134)
• md087,inline-config: judge directives in indented container bodies (9285de1)

Performance

• md038: judge nested backticks against the outermost spans on a line (b02ea88)

Downloads

File	Platform	Checksum
rumdl-v0.2.49-x86_64-unknown-linux-gnu.tar.gz	Linux x86_64	checksum
rumdl-v0.2.49-x86_64-unknown-linux-musl.tar.gz	Linux x86_64 (musl)	checksum
rumdl-v0.2.49-aarch64-unknown-linux-gnu.tar.gz	Linux ARM64	checksum
rumdl-v0.2.49-aarch64-unknown-linux-musl.tar.gz	Linux ARM64 (musl)	checksum
rumdl-v0.2.49-x86_64-apple-darwin.tar.gz	macOS x86_64	checksum
rumdl-v0.2.49-aarch64-apple-darwin.tar.gz	macOS ARM64 (Apple Silicon)	checksum
rumdl-v0.2.49-x86_64-pc-windows-msvc.zip	Windows x86_64	checksum

Installation

Using uv (Recommended)

uv tool install rumdl
</tr></table> 

... (truncated)

Changelog

Sourced from rvben/rumdl's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

0.2.53 - 2026-08-10

Fixed

• tables: find a table's extent in the document's flavor (ad139af)
• tables: quoted brackets and a blank target are not a wikilink (a8aed70)
• lsp: a rescan keeps an open buffer only where a file still is (8e16303)
• lsp: keep an open document indexed from its buffer (ea30cca)
• lsp: index what an editor is showing when the workspace is rescanned (0d8eacc)
• lsp: stop an evicted file from being put back by a waiting disk read (5644516)
• md075: ignore Obsidian wikilink aliases in prose after tables (dda35d5)
• md084: stop deleting line endings as invisible characters (e6ca26e)
• rules: report a multi-line link's range on the line it ends on (2e1fde5)
• config: break "did you mean" ties by name instead of by key order (23fafd9)
• lsp: keep a pending edit when a file is only evicted from the index (1e34c47)
• lsp: drop a pending edit when its file is deleted (f718eca)
• md038: include the closing backtick in the reported range (128b9a1)
• md038: stop deleting a line when trimming a multi-line code span (e2e27ac)
• md018: recognize tags that start with a digit (6237384)
• lsp: stop publishing diagnostics for files that were never opened (8b89584)
• lsp: refresh cross-file diagnostics when the workspace index changes (eecda03)

0.2.52 - 2026-08-05

Fixed

• md012: report blank lines before a code block that ends the document (#791) (e897556)
• rules: treat a template shortcode tag as opaque markup (6962184)
• cli: report a piped document's findings on stdout like every other run (47f8a50)

0.2.51 - 2026-08-05

Added

• md088: normalize quotes and dashes to ASCII (#763) (52e9844)

Fixed

• config: keep a file's per-file-ignores out of the workspace index it feeds (2bb0ce7)
• md051: validate cross-file link fragments for a document read from stdin (e215c65)
• md051: report a broken fragment on a query-string destination once (7c8390f)
• md088: leave modifier letters and math notation alone (56dbf0f)
• config: report the effective rule lists from config get global.* (5db8f0c)

... (truncated)

Commits

• 4e70093 chore: bump version to v0.2.49
• 72bcb49 fix(config): keep an extends target's path and contents out of messages about it
• a5e7c40 fix(md072): keep every trailing newline when sorting frontmatter keys
• 2ed4238 fix(fix-utils): measure fix ranges against the content the rule read
• 51d584e fix(md044): read a wikilink's display text, not the page name it hides
• aabd859 fix(md039): keep wikilinks and nested images intact when trimming link text
• 1147d17 fix(md045,md057,md044): stop reporting wiki embeds as images
• b02ea88 perf(md038): judge nested backticks against the outermost spans on a line
• 0ba54ce fix(md058,md065): preserve the trailing newline when inserting blank lines (#...
• 56e2b3f fix(md013): track line numbers in BlockBuilder for list reflow (#780)
• Additional commits viewable in compare view

Updates zizmorcore/zizmor-action from 0.6.1 to 0.6.2

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.6.2

zizmor 1.29.0 is now the default version.

Commits

• 3dc1ecc Sync zizmor versions (#149)
• dc57e30 chore(deps): bump the github-actions group with 3 updates (#147)
• d94880a README: bump pins (#146)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions