[dependabot]

Bumps jekyll-feed and github-pages. These dependencies needed to be updated together.
Updates jekyll-feed from 0.17.0 to 0.18.0

Release notes

Sourced from jekyll-feed's releases.

v0.18.0

Security

• Escape xml:lang values and CDATA terminators in the feed (GHSA-3gx8-pqcm-38hw, #396)

Development Fixes

• Upgrade to Rake 13 to fix master (#381)
• feat(CI): Add Ruby 3.2/3.3 to the test matrix (#402)
• Fix style offenses (#414)

Documentation

• Fix typos in Readme (#384)

Minor Enhancements

• Icon and logo support with simple tests (#412)

Changelog

Sourced from jekyll-feed's changelog.

0.18.0 / 2026-09-29

Security

• Escape xml:lang values and CDATA terminators in the feed (GHSA-3gx8-pqcm-38hw, #396)

Development Fixes

• Upgrade to Rake 13 to fix master (#381)
• feat(CI): Add Ruby 3.2/3.3 to the test matrix (#402)
• Fix style offenses (#414)

Documentation

• Fix typos in Readme (#384)

Minor Enhancements

• Icon and logo support with simple tests (#412)

Commits

• 61a0447 Merge pull request #431 from jekyll/escape-entry-lang
• 2215b0e Release 0.18.0
• b4225de Escape entry language
• 43cc5d5 Update history to reflect merge of #414 [ci skip]
• 7aa1e69 Fix style offenses (#414)
• 1f3d80f Update history to reflect merge of #412 [ci skip]
• f0ccb2f Icon and logo support with simple tests (#412)
• f321e1c Update history to reflect merge of #402 [ci skip]
• d9f04a7 feat(CI): Add Ruby 3.2/3.3 to the test matrix (#402)
• 7d9c3a4 History.markdown: Fix release date of 0.9.3
• Additional commits viewable in compare view

Updates github-pages from 232 to 233

Release notes

Sourced from github-pages's releases.

v233

Security updates

This release updates four bundled plugins to versions that fix published security advisories.

Gem	Old	New	Fix
jekyll-redirect-from	0.16.0	0.17.0	GHSA-xfg6-hjrc-hpvx: script injection through redirect_to
jekyll-seo-tag	2.8.0	2.9.1	GHSA-572m-7cg5-6j5r: HTML/script injection through metadata and JSON-LD
jekyll-feed	0.17.0	0.18.0	GHSA-3gx8-pqcm-38hw: unescaped post.lang and CDATA breakout
jekyll-remote-theme	0.4.3	0.6.2	Allows rubyzip 3.x for the CVE-2026-85396 fix (#966); fixes GHSA-3343-386p-v26g

Possible output changes

• jekyll-remote-theme 0.6.x requires Ruby 3.0 or later and adds a runtime dependency on openssl (>= 3.1.2).
• jekyll-seo-tag 2.9.x changes some <head> output: it adds twitter:description, shortens descriptions to 100 words and supports canonical: false.
• jekyll-redirect-from 0.17.0 skips redirect_to targets that aren't http(s) or relative, with a build warning. It also percent-encodes characters such as quotes, < and >.

What's Changed

• Fix security issues in various workflows by @​yoannchaudet in github/pages-gem#929
• Bump jekyll-seo-tag, jekyll-feed, jekyll-redirect-from, and jekyll-remote-theme for security fixes by @​benbalter in github/pages-gem#965
• Update integration test assertion by @​tsusdere in github/pages-gem#968

Full Changelog: github/pages-gem@v232...v233

Commits

• e382ad7 Merge pull request #969 from github/prep-233
• 5b971e2 Bump version to 233
• 38fbe00 Merge pull request #968 from github/update-tests
• 047f3ba update test
• f7dd561 Merge pull request #965 from benbalter/security-bumps
• 09226aa Bump jekyll-remote-theme to 0.6.2 for rubyzip and local-path fixes
• adedc53 Bump jekyll-seo-tag, jekyll-feed and jekyll-redirect-from for security fixes
• cd7369a Merge pull request #929 from github/security-fixes
• 4db45df Fix security issues in various workflows
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)