[dependabot]

Bumps jekyll-remote-theme from 0.5.2 to 0.6.1.

Release notes

Sourced from jekyll-remote-theme's releases.

v0.6.1

Security

• Reject local theme paths when the site is built in safe mode, so a site's _config.yml can't read files from outside the site on the build host (GHSA-3343-386p-v26g)

v0.6.0

Security

• Cap the download size while streaming, so chunked responses without a Content-Length header are limited too (#152)
• Reject zip entries that inflate past their declared size, and cap the total extracted size at 2 GB (#152)

Fixes

• Honor NO_PROXY/no_proxy, and use HTTPS_PROXY for the @latest release lookup as well as the download (#152)
• Stop registering a new at_exit handler and theme temp directory on every jekyll serve rebuild (#152)

Changes

• Add a 10-second open timeout and a 60-second read timeout to GitHub requests (#152)

Dependencies

• Declare required_ruby_version >= 3.0 (#145)

Infrastructure

• Bump github/codeql-action (#146, #147, #149)

Changelog

Sourced from jekyll-remote-theme's changelog.

0.6.1

Security

• Reject local theme paths when the site is built in safe mode, so a site's _config.yml can't read files from outside the site on the build host (GHSA-3343-386p-v26g)

0.6.0

Security

• Cap the download size while streaming, so chunked responses without a Content-Length header are limited too (#152)
• Reject zip entries that inflate past their declared size, and cap the total extracted size at 2 GB (#152)

Fixes

• Honor NO_PROXY/no_proxy, and use HTTPS_PROXY for the @latest release lookup as well as the download (#152)
• Stop registering a new at_exit handler and theme temp directory on every jekyll serve rebuild (#152)

Changes

• Add a 10-second open timeout and a 60-second read timeout to GitHub requests (#152)

Dependencies

• Declare required_ruby_version >= 3.0 (#145)

Infrastructure

• Bump github/codeql-action (#146, #147, #149)

Commits

• 1900f20 Merge pull request #154 from benbalter/fix-local-path
• 14f9e03 Return no theme paths when a local theme is rejected
• 42646c5 Release 0.6.1
• bef0912 Reject local theme paths in safe mode
• cf16c2c Confine local theme paths to the site source
• e044a29 Release v0.6.0 (#153)
• 22ff974 Harden theme downloads: size caps, NO_PROXY, shared HTTP helper (#152)
• 0a18a10 Remove dependabot.yml (migrated to Renovate)
• bd804d7 Switch to :instant Renovate preset (platformAutomerge)
• 068d012 Onboard Renovate via shared preset
• Additional commits viewable in compare view