Bump link-cache from 0.5.0 to 0.6.0

[dependabot]

Bumps link-cache from 0.5.0 to 0.6.0.

Release notes

Sourced from link-cache's releases.

v0.6.0

One lifetime rule for cache entries: expires present, it governs; absent, lychee's max_cache_age does. The mode split and the staleness guard are gone.

Behavior changes and migration

• No mode flag. lychee-norm-cache --check-stale is gone: PR checks, local runs, and the refresh lane run the same command with the same projection. A forwarded --max-cache-age now passes through to lychee (--max-cache-age 0s forces a full re-check for one run); it was rejected by 0.5.0's default mode.
• No staleness guard. link-cache --max-age and its exit code 3 are gone; a stopped refresh lane shows up as refreshed timestamps in PR diffs instead (Operating model). Drop the flag from workflows and package.json scripts.
• expires is the one override, on any entry (not only manual ones): a 2xx entry with expires is served lapsed or not and is exempt from age-ordered pruning while it holds; never holds forever.
• manual entries without expires age like any other entry. 0.4.1 and 0.5.0 exempted every manual entry from pruning; permanent trust is now "expires": "never".
• expires dates are exclusive. A YYYY-MM-DD date lapses at the start of that UTC day, so hand-written expires dates lapse a day earlier than under 0.5.0: write 2026-10-01 to hold a seed through September 30. +0d resolves already lapsed and retires at the next prune.
• Prune drops lapsed entries unconditionally, before the age-ordered count (--prune 0 drops lapsed entries only).
• Docs moved. User docs are under docs/, maintainer docs under _docs/; the README is a map. Compatibility notes for 0.4.x and 0.5.0 files: cache format.
• lib/ is not a public API. Deep imports (link-cache/lib/cache.mjs) work in 0.6.0 but are unsupported and will be closed by an exports map in a later release.

Existing cache files need no migration: 0.4.x and 0.5.0 files are read compatibly and rewritten by the first check or prune that writes them.

Merged

Package changes:

• #7 Drop the mode split and --max-age guard; make expires the one override
• #9 Make expires dates exclusive: +0d retires at the next prune
• #8 Separate user and maintainer docs from the README

Repository hardening (no package effect):

• #10 Harden the publish and check workflows; lint them with zizmor
• #11, #12 CodeQL --match alert: comment the why, drop the inert suppression directive
• #13 Add a security policy
• #14 Add a Renovate config for the action, shared-workflow, npm, and Node pins

Commits

• d4606ad Add a Renovate config for the action, shared-workflow, npm, and Node pins (#14)
• e62f67f Add a security policy (#13)
• 30c57ae Drop the inert codeql[] suppression directive (#12)
• 4f8cb4a Suppress CodeQL's regex-injection alert on --match, with the why (#11)
• f61991a Harden the publish and check workflows; lint them with zizmor (#10)
• f50daa1 Separate user and maintainer docs from the README (#8)
• 9fa7ff2 Make expires dates exclusive: +0d retires at the next prune (#9)
• 7a54f75 Drop the mode split and --max-age guard; make expires the one override (v0.6....
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)