[depfu]

We've tested your project with an updated dependency and the build failed.

This version is either within the version range you specified or you haven't specified a version/range. To be able to test your project with the new version, we've taken the liberty of pinning the version for this branch and pull request.

name	version specification	new version
github-pages		233

Unfortunately, we encountered failing tests after pinning. This means that this new version is not compatible with your project and the test failure will potentially also happen on fresh installs.

If you have correctly specified a semantic versioning version range, you should probably also file an issue with the upstream project as they might have released an update that's breaking SemVer rules, which is not cool. (But then again, not all projects explicitly follow SemVer)

We've left the pull request open for you to investigate this issue. Please don't merge it as is, because, again, we've pinned the version of github-pages for this test run.

What changed?

✳️ github-pages ( → 233) · Repo

Release Notes

233

Security updates

This release updates four bundled plugins to versions that fix published security advisories.

Gem	Old	New	Fix
jekyll-redirect-from	0.16.0	0.17.0	GHSA-xfg6-hjrc-hpvx: script injection through redirect_to
jekyll-seo-tag	2.8.0	2.9.1	GHSA-572m-7cg5-6j5r: HTML/script injection through metadata and JSON-LD
jekyll-feed	0.17.0	0.18.0	GHSA-3gx8-pqcm-38hw: unescaped post.lang and CDATA breakout
jekyll-remote-theme	0.4.3	0.6.2	Allows rubyzip 3.x for the CVE-2026-85396 fix (#966); fixes GHSA-3343-386p-v26g

Possible output changes

• jekyll-remote-theme 0.6.x requires Ruby 3.0 or later and adds a runtime dependency on openssl (>= 3.1.2).
• jekyll-seo-tag 2.9.x changes some <head> output: it adds twitter:description, shortens descriptions to 100 words and supports canonical: false.
• jekyll-redirect-from 0.17.0 skips redirect_to targets that aren't http(s) or relative, with a build warning. It also percent-encodes characters such as quotes, < and >.

What's Changed

• Fix security issues in various workflows by @yoannchaudet in #929
• Bump jekyll-seo-tag, jekyll-feed, jekyll-redirect-from, and jekyll-remote-theme for security fixes by @benbalter in #965
• Update integration test assertion by @tsusdere in #968

Full Changelog: v232...v233

Does any of this look wrong? Please let us know.

Sorry, we couldn't find anything useful about this release.

[performance-testing-bot]

Unable to locate .performanceTestingBot config file