Merge remote-tracking branch 'origin/develop' into HEAD

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

# Conflicts:
#	docs/mkdocs/docs/integration/package_managers.md

.github/CONTRIBUTING.md

@@ -142,6 +142,16 @@ The documentation will then be available at <http://127.0.0.1:8000/>. See the do
 [mkdocs](https://www.mkdocs.org) and [Material for MkDocs](https://squidfunk.github.io/mkdocs-material/) for more
 information.
 
+Before opening a pull request, check the documentation like the CI does:
+
+```shell
+make build -C docs/mkdocs          # strict build: fails on broken links, anchors, and structure problems
+make check_mermaid -C docs/mkdocs  # checks the Mermaid diagrams (requires Node.js)
+```
+
+A new API page also needs an entry in [`docs/docset/docSet.sql`](https://github.com/nlohmann/json/blob/develop/docs/docset/docSet.sql),
+the search index of the docset; `make build` reports missing entries.
+
 ### Amalgamate the source code
 
 The single-header files

.github/dependabot.yml

@@ -18,6 +18,17 @@ updates:
     cooldown:
       default-days: 7
 
+  - package-ecosystem: npm
+    directory: /docs/mkdocs/scripts/mermaid
+    schedule:
+      interval: daily
+    cooldown:
+      default-days: 7
+    ignore:
+      # Material for MkDocs loads mermaid@11; keep the checker on the same major version
+      - dependency-name: mermaid
+        update-types: ["version-update:semver-major"]
+
   - package-ecosystem: pip
     directory: /tools/astyle
     schedule:

.github/workflows/check_docs_links.yml

@@ -0,0 +1,46 @@
+name: Check documentation links
+
+# check the links of the documentation weekly; external links break without any change in this repository
+on:
+  schedule:
+    - cron: '17 4 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+jobs:
+  check_docs_links:
+    if: github.repository == 'nlohmann/json'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install virtual environment
+        run: make install_venv -C docs/mkdocs
+
+      - name: Check links
+        shell: bash  # adds -o pipefail, so tee does not hide the exit code
+        run: make link_check -C docs/mkdocs 2>&1 | tee link_check.log
+
+      - name: Summarize broken links
+        if: failure()
+        run: |
+          {
+            echo '### Broken documentation links'
+            echo '```'
+            grep 'invalid url' link_check.log || true
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/codeql-analysis.yml

@@ -38,14 +38,14 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+      uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
       with:
         languages: c-cpp
 
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+      uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+      uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2

.github/workflows/flawfinder.yml

@@ -47,6 +47,6 @@ jobs:
           output: 'flawfinder_results.sarif'
 
       - name: Upload analysis results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: ${{github.workspace}}/flawfinder_results.sarif

.github/workflows/publish_documentation.yml

@@ -43,6 +43,9 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+          # the git-revision-date-localized plugin needs the history for correct "last update" dates and so the
+          # strict build does not fail on a shallow clone
+          fetch-depth: 0
 
       - name: Install virtual environment
         run: make install_venv -C docs/mkdocs

.github/workflows/scorecards.yml

@@ -80,6 +80,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: results.sarif

.github/workflows/semgrep.yml

@@ -65,7 +65,7 @@ jobs:
 
       # Upload SARIF file generated in previous step
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: semgrep.sarif
         if: always()

.github/workflows/ubuntu.yml

@@ -153,6 +153,13 @@ jobs:
     steps:
       - name: Install build-essential
         run: apt-get update ; apt-get install -y build-essential unzip wget git
+      # the CMake 3.5.0 release binary that ci_cmake_flags downloads links
+      # against libidn.so.11, which Ubuntu 24.04 no longer ships
+      - name: Install libidn11 for CMake 3.5.0
+        if: matrix.target == 'ci_cmake_flags'
+        run: |
+          wget -q http://archive.ubuntu.com/ubuntu/pool/main/libi/libidn/libidn11_1.33-2.2ubuntu2_amd64.deb
+          dpkg -i libidn11_1.33-2.2ubuntu2_amd64.deb
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
@@ -442,7 +449,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        target: [ci_test_examples, ci_test_build_documentation]
+        target: [ci_test_examples, ci_test_build_documentation, ci_test_documentation_mermaid]
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
@@ -452,6 +459,12 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+          # the git-revision-date-localized plugin needs the history; a shallow clone makes the strict build fail
+          fetch-depth: ${{ matrix.target == 'ci_test_build_documentation' && '0' || '1' }}
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        if: matrix.target == 'ci_test_documentation_mermaid'
+        with:
+          node-version: 24
       - name: Run CMake
         run: cmake -S . -B build -DJSON_CI=On
       - name: Build