chore(deps): bump commit-check from 2.4.3 to 2.5.0

[dependabot]

Bumps commit-check from 2.4.3 to 2.5.0.

Release notes

Sourced from commit-check's releases.

v2.5.0

🚀 New features and improvements

• feat: co-author ignore, org-level config inheritance, git-config author validation, test mock fix in #387
• feat: update cchk output with more explicit error messages by @​shenxianpeng in #383

📦 Dependency updates

• chore(deps): bump CodSpeedHQ/action from 4.11.1 to 4.12.1 in the github-actions group by @dependabot[bot] in #386

Full Changelog: commit-check/commit-check@v2.4.3...v2.5.0

Changelog

Sourced from commit-check's changelog.

v2.5.0 (2026-04-03)

New Features

* **Co-author bypass in ``ignore_authors``** — ``_should_skip_commit_validation()`` now parses ``Co-authored-by:`` trailers in the commit message body. If any co-author name matches ``ignore_authors``, all commit checks are skipped. Useful for AI bots that co-author commits (e.g., ``coderabbitai[bot]``).
* **Organization-level config inheritance via ``inherit_from``** — New top-level TOML key that loads a parent config from a GitHub shorthand (``github:owner/repo:path``), a local file path, or an HTTPS URL, then deep-merges it with local settings. HTTP (non-TLS) URLs are rejected to prevent MITM attacks.
* **Git config author validation** — ``AuthorValidator`` now checks ``git config user.name`` / ``user.email`` first (the identity used for the *next* commit), falling back to ``git log`` if unset. Previously, a misconfigured identity would pass if the last commit had a valid author.
Bug Fixes

* Fixed incorrect mock target in ``test_main_with_message_empty_string_no_stdin_with_git``: was patching ``commit_check.util.get_commit_info`` (ineffective) instead of ``commit_check.engine.get_commit_info``.
v2.0.0 (2025-10-01)
.. Attention::

This major release introduces significant architectural changes and breaking updates to commit-check. Please review carefully before upgrading.
What's New



TOML Configuration — Replaces the old .commit-check.yml with cchk.toml or commit-check.toml for clearer syntax.
Simplified CLI & Hooks — Legacy pre-commit hooks and command-line options have been removed for a cleaner, more consistent interface.
New Validation Engine — The validation system has been completely redesigned around a new ValidationEngine to improve maintainability and flexibility.

Breaking Changes
^^^^^^^^^^^^^^^^
Configuration Format:

.commit-check.yml has been replaced with cchk.toml or commit-check.toml.
All YAML configurations must be migrated to TOML from this version onward.
See the Migration Guide <migration.html>_ for step-by-step instructions.

Removed Pre-commit Hooks and CLI Options:

Several legacy hooks and command-line flags have been removed in favor of a simplified interface.
Removed hooks: check-commit-signoff, check-merge-base, check-imperative.
Removed CLI options: --signoff, --merge-base, --imperative.

Module Removal:

The following legacy modules have been removed: author.py, branch.py, commit.py, error.py.

Architecture Redesign:

The validation system has been completely restructured around the new ValidationEngine, breaking compatibility with any code or integrations relying on the old module structure.
</tr></table>

... (truncated)

Commits

• 2f44b81 docs: Change v2.5.0 status to released on 2026-04-03
• 5877170 feat: co-author ignore, org-level config inheritance, git-config author valid...
• 40cbacd chore(deps): bump CodSpeedHQ/action from 4.11.1 to 4.12.1 in the github-actio...
• e45d40c feat: update cchk output with more explicit error messages (#383)
• 7a54cc9 feat: add demo GIF and update usage instructions in README
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Commit-Check ✔️