From 7c4d15e7770f773595db823f27c8ed3286576d1e Mon Sep 17 00:00:00 2001
From: Josh Soref <2119212+jsoref@users.noreply.github.com>
Date: Tue, 20 May 2025 08:22:14 -0400
Subject: [PATCH] Upgrade check-spelling to v0.0.25

Refresh metadata based on
https://github.com/check-spelling/spell-check-this/commit/8749d8d8b30b5dfb272ae9b4579c07a8165fc273

- SARIF reporting is enabled by default
  - When active, public repositories will need to add a code scanning ruleset
  - For private repositories, unless you're using GHEC and paying for Advanced Security, you'll want to set a repository actions variable `DO_NOT_USE_SARIF_REPORTING` (see `/settings/variables/actions`) to `1` to disable SARIF

- Extend checking
  - `.rst` docs
  - pdns/dnsdistdist/dnsdist-settings-definitions.yml
---
 .../actions/spell-check/candidate.patterns    | 104 ++++--
 .github/actions/spell-check/expect.txt        | 126 +++----
 .../spell-check/line_forbidden.patterns       | 335 +++++++++++++++++-
 .github/actions/spell-check/only.txt          |   2 +
 .github/actions/spell-check/patterns.txt      |  19 +-
 .github/actions/spell-check/reject.txt        |  12 +-
 .github/workflows/spelling3.yml               |  57 ++-
 7 files changed, 500 insertions(+), 155 deletions(-)

diff --git a/.github/actions/spell-check/candidate.patterns b/.github/actions/spell-check/candidate.patterns
index 040967025f..30a01da901 100644
--- a/.github/actions/spell-check/candidate.patterns
+++ b/.github/actions/spell-check/candidate.patterns
@@ -1,3 +1,6 @@
+# Repeated letters
+\b([a-z])\g{-1}{2,}\b
+
 # marker to ignore all code on line
 ^.*/\* #no-spell-check-line \*/.*$
 # marker to ignore all code on line
@@ -7,6 +10,9 @@
 # cspell inline
 ^.*\b[Cc][Ss][Pp][Ee][Ll]{2}:\s*[Dd][Ii][Ss][Aa][Bb][Ll][Ee]-[Ll][Ii][Nn][Ee]\b
 
+# copyright
+Copyright (?:\([Cc]\)|)(?:[-\d, ]|and)+(?: [A-Z][a-z]+ [A-Z][a-z]+,?)+
+
 # patch hunk comments
 ^@@ -\d+(?:,\d+|) \+\d+(?:,\d+|) @@ .*
 # git index header
@@ -15,6 +21,9 @@ index (?:[0-9a-z]{7,40},|)[0-9a-z]{7,40}\.\.[0-9a-z]{7,40}
 # file permissions
 ['"`\s][-bcdLlpsw](?:[-r][-w][-Ssx]){2}[-r][-w][-SsTtx]\+?['"`\s]
 
+# css fonts
+\bfont(?:-family|):[^;}]+
+
 # css url wrappings
 #\burl\([^)]+\)
 
@@ -26,7 +35,7 @@ index (?:[0-9a-z]{7,40},|)[0-9a-z]{7,40}\.\.[0-9a-z]{7,40}
 # data url in quotes
 ([`'"])data:(?:[^ `'"].*?|)(?:[A-Z]{3,}|[A-Z][a-z]{2,}|[a-z]{3,}).*\g{-1}
 # data url
-\bdata:[-a-zA-Z=;:/0-9+]*,\S*
+\bdata:[-a-zA-Z=;:/0-9+_]*,\S*
 
 # https/http/file urls
 #(?:\b(?:https?|ftp|file)://)[-A-Za-z0-9+&@#/*%?=~_|!:,.;]+[-A-Za-z0-9+&@#/*%=~_|]
@@ -65,6 +74,8 @@ magnet:[?=:\w]+
 
 # Amazon
 \bamazon\.com/[-\w]+/(?:dp/[0-9A-Z]+|)
+# AWS ARN
+arn:aws:[-/:\w]+
 # AWS S3
 \b\w*\.s3[^.]*\.amazonaws\.com/[-\w/&#%_?:=]*
 # AWS execute-api
@@ -91,6 +102,8 @@ vpc-\w+
 \bgoogle-analytics\.com/collect.[-0-9a-zA-Z?%=&_.~]*
 # Google APIs
 \bgoogleapis\.(?:com|dev)/[a-z]+/(?:v\d+/|)[a-z]+/[-@:./?=\w+|&]+
+# Google Artifact Registry
+\.pkg\.dev(?:/[-\w]+)+(?::[-\w]+|)
 # Google Storage
 \b[-a-zA-Z0-9.]*\bstorage\d*\.googleapis\.com(?:/\S*|)
 # Google Calendar
@@ -126,6 +139,8 @@ themes\.googleusercontent\.com/static/fonts/[^/\s"]+/v\d+/[^.]+.
 \bscholar\.google\.com/citations\?user=[A-Za-z0-9_]+
 # Google Colab Research Drive
 \bcolab\.research\.google\.com/drive/[-0-9a-zA-Z_?=]*
+# Google Cloud regions
+(?:us|(?:north|south)america|europe|asia|australia|me|africa)-(?:north|south|east|west|central){1,2}\d+
 
 # GitHub SHAs (api)
 \bapi.github\.com/repos(?:/[^/\s"]+){3}/[0-9a-f]+\b
@@ -164,6 +179,12 @@ GHSA(?:-[0-9a-z]{4}){3}
 # GitLab commits
 \bgitlab\.[^/\s"]*/(?:[^/\s"]+/){2}commits?/[0-9a-f]+\b
 
+# #includes
+^\s*#include\s*(?:<.*?>|".*?")
+
+# #pragma lib
+^\s*#pragma comment\(lib, ".*?"\)
+
 # binance
 accounts\.binance\.com/[a-z/]*oauth/authorize\?[-0-9a-zA-Z&%]*
 
@@ -216,7 +237,7 @@ accounts\.binance\.com/[a-z/]*oauth/authorize\?[-0-9a-zA-Z&%]*
 \bmedium\.com/@?[^/\s"]+/[-\w]+
 
 # microsoft
-\b(?:https?://|)(?:(?:download\.visualstudio|docs|msdn2?|research)\.microsoft|blogs\.msdn)\.com/[-_a-zA-Z0-9()=./%]*
+\b(?:https?://|)(?:(?:(?:blogs|download\.visualstudio|docs|msdn2?|research)\.|)microsoft|blogs\.msdn)\.co(?:m|\.\w\w)/[-_a-zA-Z0-9()=./%]*
 # powerbi
 \bapp\.powerbi\.com/reportEmbed/[^"' ]*
 # vs devops
@@ -390,7 +411,7 @@ ipfs://[0-9a-zA-Z]{3,}
 \bgetopts\s+(?:"[^"]+"|'[^']+')
 
 # ANSI color codes
-(?:\\(?:u00|x)1[Bb]|\x1b|\\u\{1[Bb]\})\[\d+(?:;\d+|)m
+(?:\\(?:u00|x)1[Bb]|\\03[1-7]|\x1b|\\u\{1[Bb]\})\[\d+(?:;\d+)*m
 
 # URL escaped characters
 %[0-9A-F][A-F](?=[A-Za-z])
@@ -426,10 +447,14 @@ sha\d+:[0-9a-f]*?[a-f]{3,}[0-9a-f]*
 # pki (base64)
 LS0tLS1CRUdJT.*
 
+# C# includes
+^\s*using [^;]+;
+
 # uuid:
 \b[0-9a-fA-F]{8}-(?:[0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}\b
 # hex digits including css/html color classes:
-(?:[\\0][xX]|\\u|[uU]\+|#x?|%23)[0-9_a-fA-FgGrR]*?[a-fA-FgGrR]{2,}[0-9_a-fA-FgGrR]*(?:[uUlL]{0,3}|[iu]\d+)\b
+(?:[\\0][xX]|\\u\{?|[uU]\+|#x?|%23|&H)[0-9_a-fA-FgGrR]*?[a-fA-FgGrR]{2,}[0-9_a-fA-FgGrR]*(?:[uUlL]{0,3}|[iu]\d+)\b
+
 # integrity
 integrity=(['"])(?:\s*sha\d+-[-a-zA-Z=;:/0-9+]{40,})+\g{-1}
 
@@ -447,7 +472,10 @@ integrity=(['"])(?:\s*sha\d+-[-a-zA-Z=;:/0-9+]{40,})+\g{-1}
 Name\[[^\]]+\]=.*
 
 # IServiceProvider / isAThing
-(?:\b|_)(?:(?:ns|)I|isA)(?=(?:[A-Z][a-z]{2,})+(?:[A-Z\d]|\b))
+(?:(?:\b|_|(?<=[a-z]))I|(?:\b|_)(?:nsI|isA))(?=(?:[A-Z][a-z]{2,})+(?:[A-Z\d]|\b))
+
+# python
+\b(?i)py(?!gments|gmy|lon|ramid|ro|th)(?=[a-z]{2,})
 
 # crypt
 (['"])\$2[ayb]\$.{56}\g{-1}
@@ -461,17 +489,14 @@ Name\[[^\]]+\]=.*
 # machine learning (?)
 \b(?i)ml(?=[a-z]{2,})
 
-# python
-\b(?i)py(?!gments|gmy|lon|ramid|ro|th)(?=[a-z]{2,})
-
 # scrypt / argon
 \$(?:scrypt|argon\d+[di]*)\$\S+
 
 # go.sum
 #\bh1:\S+
 
-# scala imports
-^import (?:[\w.]|\{\w*?(?:,\s*(?:\w*|\*))+\})+
+# imports
+^import\s+(?:(?:static|type)\s+|)(?:[\w.]|\{\s*\w*?(?:,\s*(?:\w*|\*))+\s*\})+
 
 # scala modules
 ("[^"]+"\s*%%?\s*){2,3}"[^"]+"
@@ -480,13 +505,13 @@ Name\[[^\]]+\]=.*
 image: [-\w./:@]+
 
 # Docker images
-^\s*FROM\s+\S+:\S+(?:\s+AS\s+\S+|)
+^\s*(?i)FROM\s+\S+:\S+(?:\s+AS\s+\S+|)
 
 # `docker images` REPOSITORY TAG IMAGE ID CREATED SIZE
 \s*\S+/\S+\s+\S+\s+[0-9a-f]{8,}\s+\d+\s+(?:hour|day|week)s ago\s+[\d.]+[KMGT]B
 
 # Intel intrinsics
-_mm_\w+
+_mm\d*_(?!dd)\w+
 
 # Input to GitHub JSON
 content: (['"])[-a-zA-Z=;:/0-9+]*=\g{-1}
@@ -520,7 +545,7 @@ content: (['"])[-a-zA-Z=;:/0-9+]*=\g{-1}
 # javascript replace regex
 \.replace\(/[^/\s"]{3,}/[gim]*\s*,
 # assign regex
-= /[^*].*?(?:[a-z]{3,}|[A-Z]{3,}|[A-Z][a-z]{2,}).*/[gi]?(?=\W|$)
+= /[^*].*?(?:[a-z]{3,}|[A-Z]{3,}|[A-Z][a-z]{2,}).*/[gim]*(?=\W|$)
 # perl regex test
 [!=]~ (?:/.*/|m\{.*?\}|m<.*?>|m([|!/@#,;']).*?\g{-1})
 
@@ -534,7 +559,7 @@ perl(?:\s+-[a-zA-Z]\w*)+
 (?:\d|\bh)to(?!ken)(?=[a-z])|to(?=[adhiklpun]\()
 
 # Go regular expressions
-regexp?\.MustCompile\(`[^`]*`\)
+regexp?\.MustCompile\((?:`[^`]*`|".*"|'.*')\)
 
 # regex choice
 \(\?:[^)]+\|[^)]+\)
@@ -582,7 +607,7 @@ urn:shemas-jetbrains-com
 # xcode
 
 # xcodeproject scenes
-(?:Controller|destination|ID|id)="\w{3}-\w{2}-\w{3}"
+(?:Controller|destination|(?:first|second)Item|ID|id)="\w{3}-\w{2}-\w{3}"
 
 # xcode api botches
 customObjectInstantitationMethod
@@ -597,14 +622,17 @@ PrependWithABINamepsace
 \.fa-[-a-z0-9]+
 
 # bearer auth
-(['"])[Bb]ear[e][r] .*?\g{-1}
+(['"])[Bb]ear[e][r] .{3,}?\g{-1}
 
 # bearer auth
-\b[Bb]ear[e][r]:? [-a-zA-Z=;:/0-9+.]+
+\b[Bb]ear[e][r]:? [-a-zA-Z=;:/0-9+.]{3,}
 
 # basic auth
 (['"])[Bb]asic [-a-zA-Z=;:/0-9+]{3,}\g{-1}
 
+# basic auth
+: [Bb]asic [-a-zA-Z=;:/0-9+.]{3,}
+
 # base64 encoded content
 ([`'"])[-a-zA-Z=;:/0-9+]{3,}=\g{-1}
 # base64 encoded content in xml/sgml
@@ -616,6 +644,12 @@ PrependWithABINamepsace
 # base64 encoded pkcs
 \bMII[-a-zA-Z=;:/0-9+]+
 
+# uuencoded
+#[!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_]{40,}
+
+# DNS rr data
+(?:\d+\s+){3}(?:[-+/=.\w]{2,}\s*){1,2}
+
 # encoded-word
 =\?[-a-zA-Z0-9"*%]+\?[BQ]\?[^?]{0,75}\?=
 
@@ -623,7 +657,7 @@ PrependWithABINamepsace
 \bnumer\b(?=.*denom)
 
 # Time Zones
-\b(?:Africa|Atlantic|America|Antarctica|Asia|Australia|Europe|Indian|Pacific)(?:/\w+)+
+\b(?:Africa|Atlantic|America|Antarctica|Arctic|Asia|Australia|Europe|Indian|Pacific)(?:/[-\w]+)+
 
 # linux kernel info
 ^(?:bugs|flags|Features)\s+:.*
@@ -641,6 +675,12 @@ systemd.*?running in system mode \([-+].*\)$
 (?:(?:\w|\s|[,.])*\b(?i)(?:amet|consectetur|cursus|dolor|eros|ipsum|lacus|libero|ligula|lorem|magna|neque|nulla|suscipit|tempus)\b(?:\w|\s|[,.])*)
 
 # Non-English
+# Even repositories expecting pure English content can unintentionally have Non-English content... People will occasionally mistakenly enter [homoglyphs](https://en.wikipedia.org/wiki/Homoglyph) which are essentially typos, and using this pattern will mean check-spelling will not complain about them.
+#
+# If the content to be checked should be written in English and the only Non-English items will be people's names, then you can consider adding this.
+#
+# Alternatively, if you're using check-spelling v0.0.25+, and you would like to _check_ the Non-English content for spelling errors, you can. For information on how to do so, see:
+# https://docs.check-spelling.dev/Feature:-Configurable-word-characters.html#unicode
 [a-zA-Z]*[ÀÁÂÃÄÅÆČÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæčçèéêëìíîïðñòóôõöøùúûüýÿĀāŁłŃńŅņŒœŚśŠšŜŝŸŽžź][a-zA-Z]{3}[a-zA-ZÀÁÂÃÄÅÆČÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæčçèéêëìíîïðñòóôõöøùúûüýÿĀāŁłŃńŅņŒœŚśŠšŜŝŸŽžź]*|[a-zA-Z]{3,}[ÀÁÂÃÄÅÆČÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæčçèéêëìíîïðñòóôõöøùúûüýÿĀāŁłŃńŅņŒœŚśŠšŜŝŸŽžź]|[ÀÁÂÃÄÅÆČÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæčçèéêëìíîïðñòóôõöøùúûüýÿĀāŁłŃńŅņŒœŚśŠšŜŝŸŽžź][a-zA-Z]{3,}
 
 # highlighted letters
@@ -663,10 +703,16 @@ TeX/AMS
 "varsIgnorePattern": ".+"
 
 # nolint
-nolint:\w+
+nolint:\s*[\w,]+
 
 # Windows short paths
-[/\\][^/\\]{5,6}~\d{1,2}[/\\]
+[/\\][^/\\]{5,6}~\d{1,2}(?=[/\\])
+
+# Windows Resources with accelerators
+#\b[A-Z]&[a-z]+\b(?!;)
+
+# signed off by
+(?i)Signed-off-by: .*
 
 # cygwin paths
 /cygdrive/[a-zA-Z]/(?:Program Files(?: \(.*?\)| ?)(?:/[-+.~\\/()\w ]+)*|[-+.~\\/()\w])+
@@ -700,29 +746,31 @@ W/"[^"]+"
 
 # Compiler flags (Unix, Java/Scala)
 # Use if you have things like `-Pdocker` and want to treat them as `docker`
-#(?:^|[\t ,>"'`=(])-(?:(?:J-|)[DPWXY]|[Llf])(?=[A-Z]{2,}|[A-Z][a-z]|[a-z]{2,})
+#(?:^|[\t ,>"'`=(#])-(?:(?:J-|)[DPWXY]|[Llf])(?=[A-Z]{2,}|[A-Z][a-z]|[a-z]{2,})
 
 # Compiler flags (Windows / PowerShell)
 # This is a subset of the more general compiler flags pattern.
 # It avoids matching `-Path` to prevent it from being treated as `ath`
-#(?:^|[\t ,"'`=(])-(?:[DPL](?=[A-Z]{2,})|[WXYlf](?=[A-Z]{2,}|[A-Z][a-z]|[a-z]{2,}))
+#(?:^|[\t ,"'`=(#])-(?:[DPL](?=[A-Z]{2,})|[WXYlf](?=[A-Z]{2,}|[A-Z][a-z]|[a-z]{2,}))
 
 # Compiler flags (linker)
 ,-B
 
-# libraries
-(?:\b|_)lib(?:re(?=office)|)(?!era[lt]|ero|erty|rar(?:i(?:an|es)|y))(?=[a-z])
-
-# WWNN/WWPN (NAA identifiers)
-\b(?:0x)?10[0-9a-f]{14}\b|\b(?:0x|3)?[25][0-9a-f]{15}\b|\b(?:0x|3)?6[0-9a-f]{31}\b
+# Library prefix
+# e.g., `lib`+`archive`, `lib`+`raw`, `lib`+`unwind`
+# (ignores some words that happen to start with `lib`)
+(?:\b|_)[Ll]ib(?:re(?=office)|)(?!era[lt]|ero|erty|rar(?:i(?:an|es)|y))(?=[a-z])
 
 # iSCSI iqn (approximate regex)
 \biqn\.[0-9]{4}-[0-9]{2}(?:[\.-][a-z][a-z0-9]*)*\b
 
+# WWNN/WWPN (NAA identifiers)
+\b(?:0x)?10[0-9a-f]{14}\b|\b(?:0x|3)?[25][0-9a-f]{15}\b|\b(?:0x|3)?6[0-9a-f]{31}\b
+
 # curl arguments
 \b(?:\\n|)curl(?:\.exe|)(?:\s+-[a-zA-Z]{1,2}\b)*(?:\s+-[a-zA-Z]{3,})(?:\s+-[a-zA-Z]+)*
 # set arguments
-\b(?:bash|sh|set)(?:\s+-[abefimouxE]{1,2})*\s+-[abefimouxE]{3,}(?:\s+-[abefimouxE]+)*
+\b(?:bash|sh|set)(?:\s+[-+][abefimouxE]{1,2})*\s+[-+][abefimouxE]{3,}(?:\s+[-+][abefimouxE]+)*
 # tar arguments
 \b(?:\\n|)g?tar(?:\.exe|)(?:(?:\s+--[-a-zA-Z]+|\s+-[a-zA-Z]+|\s[ABGJMOPRSUWZacdfh-pr-xz]+\b)(?:=[^ ]*|))+
 # tput arguments -- https://man7.org/linux/man-pages/man5/terminfo.5.html -- technically they can be more than 5 chars long...
diff --git a/.github/actions/spell-check/expect.txt b/.github/actions/spell-check/expect.txt
index 4241cfe886..8b0d0ea06f 100644
--- a/.github/actions/spell-check/expect.txt
+++ b/.github/actions/spell-check/expect.txt
@@ -1,5 +1,5 @@
 aaaarecord
-aaldering
+Aaldering
 aborttransaction
 Abraitis
 ACLTo
@@ -14,18 +14,17 @@ Afek
 afl
 afnic
 afsdb
-AFYER
 agentx
 agentxperms
+aggr
 Aguiar
 ahupowerdns
 Aips
 Aki
+AKq
 Alenichev
-alexa
 algoroll
 aliasmode
-allocs
 Altpeter
 andersbrownworth
 Anderton
@@ -62,17 +61,12 @@ ATHENE
 Atlassian
 Atomia
 aton
-atype
-authanswers
 Authoritativedoc
-auths
 authzone
 autobuilt
 autocalculation
-autodetecting
 autofilling
 automagically
-automake
 Automattic
 autoprimary
 autoptr
@@ -83,7 +77,6 @@ autotools
 axfrfilter
 Baan
 backgrounding
-backported
 backticks
 BADALG
 BADCOOKIE
@@ -95,23 +88,23 @@ BADSIG
 BADTIME
 BADTRUNC
 BADVERS
+bagbug
 Bakhos
 Bakker
 Baltus
 basedn
 basepath
 Bastiaan
-bayour
 bbc
 bbd
 bearggg
 beenthere
 bellis
 Belyshev
-benchmarketing
 Benetasso
 Bernd
 bert
+berthub
 Besselink
 bestwho
 Biege
@@ -128,10 +121,8 @@ bitmaps
 bla
 Bleker
 blockfilter
-blogpost
 blogspot
 bmigrate
-bodyfont
 bodysize
 bodywrapper
 bolditalic
@@ -168,9 +159,9 @@ Cairney
 calculatesoaserial
 calidns
 capf
+catzone
 Cauquil
 ccache
-ccc
 ccls
 ccounts
 cdb
@@ -186,12 +177,10 @@ changetype
 chashed
 chbruyand
 Chiavacci
-chopoff
 Christof
 chrooted
 chrooting
 clangd
-clientanswers
 Cloos
 closesocket
 clusions
@@ -208,13 +197,11 @@ cnn
 cockroachlabs
 Cockroft
 codebgcolor
-codeninja
 codetextcolor
 Colemarcus
 collapsiblesidebar
 colm
 comboaddress
-commandline
 committransaction
 compiledb
 conaxis
@@ -225,7 +212,7 @@ configsetting
 confs
 conntrack
 Conntracking
-Consolas
+constexpr
 controllen
 controlsocket
 coprocess
@@ -254,7 +241,6 @@ cve
 cvename
 cvs
 cvstrac
-CWE
 CXXFLAGS
 cxxsettings
 cxxsupport
@@ -268,9 +254,9 @@ darix
 Darron
 dataformat
 datatracker
+datetimes
 Daugaard
 Davids
-davidtmiller
 Dayneko
 dbfile
 dblacka
@@ -285,18 +271,17 @@ deactivatedomainkey
 debian
 Deduktiva
 defcontent
+defmacro
 defpol
 defttl
 Dehaine
 DENIC
-depfile
 descclassname
 descname
 Dessel
 destname
 Detlef
 devicename
-devonly
 devtoolset
 DHCID
 dhcpd
@@ -316,7 +301,7 @@ dlg
 dlmalloc
 DLV
 Dmitry
-dname
+DNAMEs
 Dnn
 dnsapi
 dnsbulktest
@@ -356,8 +341,8 @@ dnsviz
 dnswasher
 dnszone
 Dobrawy
-docdefault
 docnamecachelookup
+documentclass
 documentwrapper
 Dohmen
 domaininfo
@@ -376,7 +361,6 @@ Draschl
 droprate
 dscontent
 dsrecord
-DTS
 Dufberg
 dumpluaraw
 dumresp
@@ -404,29 +388,31 @@ ednssubnet
 EDNSTo
 edu
 eglot
-ejones
+Eif
 Ekkelenkamp
 eldoc
 elgoog
 elisp
 elpa
+emacs
+Emph
+endblock
 endbr
 Enden
 enp
 Ensar
-ent
+ents
 envoutput
 epel
 eqno
 Eriksson
 errlog
 errorlevels
-esr
 EUips
+evanjones
 evildomain
 examplekey
 exceedfuncs
-Exort
 externalrefs
 extrahead
 Exx
@@ -443,7 +429,6 @@ ffipolicy
 filedescriptor
 finalised
 findclientpolicy
-Firefox
 firewalled
 firewalls
 fixednow
@@ -459,17 +444,16 @@ forwardzone
 framestream
 freakshow
 Freenet
-freesans
 freetds
 freshports
 Froemel
 frontends
 fstrm
+fullchain
 fulltoc
 fullycapable
 Furnell
 Fusl
-fuzzers
 fwzones
 FYhvws
 FZq
@@ -494,7 +478,6 @@ Gerwin
 getaddrs
 getalldomainmetadata
 getbeforeandafternamesabsolute
-getbootstrap
 getcarbonhostname
 getdomaininfo
 getdomainkeys
@@ -539,6 +522,7 @@ gss
 gssapi
 gtld
 guilabel
+gutenberg
 Gyselinck
 Hakulinen
 Hannu
@@ -547,7 +531,6 @@ Hausberger
 headbgcolor
 headerline
 headerlink
-headfont
 headlinkcolor
 headtextcolor
 healthcheck
@@ -584,7 +567,6 @@ httpdomain
 hubert
 iana
 icann
-ict
 idprotect
 iers
 ietf
@@ -608,17 +590,13 @@ innodb
 installable
 internic
 interoperation
-iowait
-IPbackend
 ipcipher
-ipcom
 ipcrypt
 ipdecrypt
 ipencrypt
 ipfilter
 IPSECKEY
 iputils
-ironsummitmedia
 isane
 ismaster
 isoc
@@ -663,7 +641,6 @@ KEYBITS
 keyblock
 keydir
 keyids
-keyname
 keypair
 keypairgen
 keyroll
@@ -709,7 +686,6 @@ latlonloc
 latomic
 Laurient
 Laursen
-lcov
 LCUP
 LDA
 ldapbackend
@@ -749,6 +725,7 @@ lochiiconnectivity
 lockfree
 loglevels
 logmessage
+lon
 Loopia
 Lorbach
 lordievader
@@ -758,12 +735,13 @@ lowerroman
 Lrhazi
 lsock
 lsp
+lte
+lto
 luaaction
 luabackend
 luac
 luajit
 luaroundrobin
-luarule
 luawrapper
 Lutter
 Luuk
@@ -772,6 +750,7 @@ Machard
 Maik
 Maikel
 MAILA
+mailarchive
 MAILB
 Majer
 Makefiles
@@ -786,7 +765,6 @@ Markmann
 Massar
 matchtype
 Mavrommatis
-maxdepth
 maxlistdepth
 maxmind
 maxqps
@@ -812,7 +790,6 @@ Miek
 Miell
 Mieslinger
 Milas
-Mimimization
 minbody
 mindex
 minipatch
@@ -835,13 +812,11 @@ mrtg
 msdcs
 MSDNS
 msphinx
-msrv
 mtasker
 mthread
 mtid
 Mulholland
 multimaster
-munmap
 Muraro
 Mwaikambo
 mxrecord
@@ -849,11 +824,13 @@ mybackend
 mycompany
 mydns
 mydnsbackend
+mygroup
 myhost
 myinstance
 myname
 mypassword
 mypgsql
+mypolicy
 myset
 myspecialmetric
 mysqlbackend
@@ -885,11 +862,11 @@ netmasks
 netms
 netsnmp
 NETWORKMASK
-Neue
 Neuf
 newcomment
 newcontent
 nftables
+nginx
 nic
 Niklas
 Nilsen
@@ -901,13 +878,11 @@ NNNN
 noaction
 noad
 noall
-nocookie
-NODCACHEDIRNOD
-NODCACHEDIRUDR
+nodata
 noedns
 noerrors
+NOLINT
 NOLINTNEXTLINE
-NOLOCK
 nometasync
 Nominet
 noncompliantqueries
@@ -919,6 +894,7 @@ noout
 noping
 noport
 norve
+nosniff
 nostrip
 NOSUBDIR
 nosync
@@ -934,6 +910,7 @@ NPTL
 NSes
 NSID
 nsis
+nsl
 nsrecord
 nsset
 nsspeeds
@@ -977,6 +954,7 @@ OPNUM
 optcode
 Opteron
 optmem
+oqz
 oraclebackend
 ordername
 orsn
@@ -996,6 +974,7 @@ packethandler
 pacnal
 papersize
 PARAMKEYWORDS
+passthrough
 PATC
 patchlevels
 pathconfig
@@ -1012,7 +991,6 @@ pdnscontrol
 pdnskeyroller
 pdnsldap
 pdnslog
-pdnsodbx
 pdnsrandom
 pdnsrec
 pdnssec
@@ -1040,7 +1018,6 @@ pickwhashed
 pickwrandom
 piddir
 pidfile
-PIDs
 pilindex
 Pinski
 pipebackend
@@ -1063,10 +1040,10 @@ poolers
 poolname
 portnum
 portnumber
+postgres
 postgresql
 postinst
 postresolve
-powerdnsrecursor
 powerdnssec
 powerdnssuffix
 powerldap
@@ -1080,10 +1057,14 @@ prequery
 prerpz
 presignedness
 primetime
+princ
 prioritization
 privs
 profdata
 profraw
+progid
+progn
+protobuf
 protozero
 providername
 proxymapping
@@ -1093,9 +1074,11 @@ pseudonymize
 pseudorecord
 pthread
 ptrrecord
+ptrs
 Publieke
 publishdomainkey
 pullreq
+PVjx
 qclass
 qdcount
 qdomain
@@ -1115,10 +1098,10 @@ querycount
 querytime
 qytpe
 ragel
+raii
 Rak
 randombackend
 randombit
-randombytes
 randomisation
 randomises
 randomloader
@@ -1127,7 +1110,6 @@ rawaddress
 rawtypes
 RBL
 rcode
-rcodezero
 rcvd
 rcvmmsg
 rdata
@@ -1145,7 +1127,6 @@ recvbuf
 recverr
 recvmmsg
 redelegations
-redhat
 redjack
 reentrantly
 refman
@@ -1165,7 +1146,6 @@ remi
 remoteaddr
 remotebackend
 remoteip
-remoting
 removedomainkey
 replacerrset
 requery
@@ -1174,7 +1154,6 @@ respawned
 respawning
 respout
 respsizes
-resynchronise
 reuseds
 reuseport
 RFCs
@@ -1196,10 +1175,7 @@ rping
 rpms
 rpz
 rpzstatistics
-rrcontent
-rrdata
 rrdtool
-rrname
 rrs
 rrset
 rrsig
@@ -1230,7 +1206,6 @@ schwer
 scopebits
 scopemask
 sdfn
-sdfoijdfio
 sdig
 secnumdepth
 secpoll
@@ -1248,9 +1223,7 @@ servfail
 servicemode
 setaffinity
 setcontent
-setcounter
 setdomainmetadata
-seting
 setkey
 setnotified
 SETPIPE
@@ -1309,6 +1282,7 @@ Soroceanu
 sortlist
 sourcecode
 SOURCEDIR
+sourceforge
 sourcelink
 sourceware
 Spaans
@@ -1329,11 +1303,11 @@ srandom
 srcname
 SRecord
 Srule
+srv
 sshfp
 ssi
 SSQ
 stacksize
-startbootstrap
 starttransaction
 Stasic
 statbag
@@ -1360,6 +1334,7 @@ stubquery
 stubresolver
 Stussy
 stutiredboy
+subdomain
 subkeys
 submitters
 subnamespace
@@ -1407,6 +1382,7 @@ tdsodbc
 teeaction
 Telenet
 testsdir
+textcolor
 Tful
 thel
 thelog
@@ -1414,7 +1390,6 @@ Thessalonikefs
 Thiago
 thinko
 Thomassen
-Thorton
 threadmessage
 throttlemap
 thrysoee
@@ -1434,7 +1409,6 @@ tmpfs
 tobool
 TOCTOU
 toctree
-todos
 toint
 tokenuser
 Tolstov
@@ -1449,10 +1423,9 @@ tribool
 trixie
 trustanchor
 trustanchorfile
-trusteer
+Trusteer
 trx
 trxid
-TSAN
 tsig
 tsigalgo
 tsigkey
@@ -1478,9 +1451,7 @@ UIDs
 Uisms
 ukleinek
 UMEM
-unauth
 unbreak
-unescaping
 unfresh
 unhash
 uninett
@@ -1494,8 +1465,6 @@ UNPRIV
 unpublishdomainkey
 unreachables
 unshadowing
-untruncated
-unzero
 updatepolicy
 upgradeable
 upperalpha
@@ -1503,7 +1472,6 @@ upperroman
 urandom
 usecase
 userbase
-uwaterloo
 Valentei
 Valentini
 valgrind
@@ -1526,14 +1494,12 @@ vla
 Voegeli
 Volker
 Volodymyr
-voxel
 Vranken
 VRF
 vulns
 Waidner
 WAITFORONE
 wal
-wallclock
 warnlog
 wds
 webbased
@@ -1556,6 +1522,7 @@ Wielicki
 Wijk
 Wijnand
 Wijngaards
+wikipedia
 wildcarded
 Willcott
 windr
@@ -1580,7 +1547,6 @@ xchacha
 xdb
 xdp
 Xek
-Xeon
 XForwarded
 XFRs
 Xiang
diff --git a/.github/actions/spell-check/line_forbidden.patterns b/.github/actions/spell-check/line_forbidden.patterns
index c3bc7fadd2..4c62621748 100644
--- a/.github/actions/spell-check/line_forbidden.patterns
+++ b/.github/actions/spell-check/line_forbidden.patterns
@@ -8,6 +8,31 @@
 # you might not want to check in code where you skip all the other tests.
 #\bfit\(
 
+# English does not use a hyphen between adverbs and nouns
+# https://twitter.com/nyttypos/status/1894815686192685239
+(?:^|\s)[A-Z]?[a-z]+ly-(?=[a-z]{3,})(?:[.,?!]?\s|$)
+
+# Smart quotes should match
+\s’[^.?!‘’]+’[^.?!‘’]+‘[^.?!‘’]+’|\s‘[^.?!‘’]+’[^.?!‘’]+’[^.?!‘’]+’|\s”[^.?!“”]+”[^.?!“”]+“[^.?!“”]+”|\s“[^.?!“”]+”[^.?!“”]+”[^.?!“”]+”
+
+# Don't use `requires that` + `to be`
+# https://twitter.com/nyttypos/status/1894816551435641027
+\brequires that \w+\b[^.]+to be\b
+
+# A fully parenthetical sentence’s period goes inside the parentheses, not outside.
+# https://twitter.com/nyttypos/status/1898844061873639490
+\([A-Z][a-z]{2,}(?: [a-z]+){3,}\)\.\s
+
+# Complete sentences shouldn't be in the middle of another sentence as a parenthetical.
+(?<!\.)(?<!\betc)\.\),
+
+# Complete sentences in parentheticals should not have a space before the period.
+\s\.\)(?!.*\}\})
+
+# This probably indicates Mojibake https://en.wikipedia.org/wiki/Mojibake
+# You probably should try to unbake this content
+Ã(?:Â[¤¶¥]|[£¢])|Ã
+
 # Should be `HH:MM:SS`
 \bHH:SS:MM\b
 
@@ -24,18 +49,68 @@
 # Should be `a priori` or `and prior`
 (?i)(?<!posteriori)\sand priori\s
 
+# Should be `a`
+\san (?=(?:[bcdgjklnpqtvwz]|f(?!d\b)|h(?!our|tml|ttp)|m(?!thread)|r(?!code|tf)|s(?!sh|qlite|vg)|x(?!or))[a-z])
+
 # Should only be one of `a`, `an`, or `the`
 \b(?:(?:an?|the)\s+){2,}\b
 
+# Should be a list `something, a second thing, or a third thing` or `something, a thing to do a thing`
+# -- This rule is experimental, if you find it has a high false-positive rate, please let the maintainer know
+#(?:^|[?!.] )[^()?!;,.]+, a(?:\s+(?!to\b)\w+)+?\s+an?\b
+
+# Should only be `are` or `can`, not both
+\b(?:(?:are|can)\s+){2,}\b
+
+# Should probably be `ABCDEFGHIJKLMNOPQRSTUVWXYZ`
+(?i)(?!ABCDEFGHIJKLMNOPQRSTUVWXYZ)ABC[A-Z]{21}YZ
+
+# Should be `an`
+(?<!\b[Ii] )(?<!\.)\bam\b
+
 # Should be `anymore`
 \bany more[,.]
 
+# Should be `Ask`
+(?:^|[.?]\s+)As\s+[A-Z][a-z]{2,}\s[^.?]*?(?:how|if|wh\w+)\b
+
+# Should be `at one fell swoop`
+# and only when talking about killing, not some other completion
+# Act 4 Scene 3, Macbeth
+# https://www.opensourceshakespeare.org/views/plays/play_view.php?WorkID=macbeth&Act=4&Scene=3&Scope=scene
+\bin one fell s[lw]?oop\b
+
 # Should be `'`
-(?i)\b(?:(?:i|s?he|they|what|who|you)"ll|(?:are|ca|did|do|does|ha[ds]|have|is|should|were|wo|would)n"t|(?:s?he|let|that|there|what|where|who)"s|(?:i|they|we|what|who|you)"ve)\b
+(?i)\b(?:(?:i|s?he|they|what|who|you)[`"]ll|(?:are|ca|did|do|does|ha[ds]|have|is|should|were|wo|would)n[`"]t|(?:s?he|let|that|there|what|where|who)[`"]s|(?:i|they|we|what|who|you)[`"]ve)\b
+
+# Should be `background` / `intro text` / `introduction` / `prologue` unless it's a brand or relates to _subterfuge_
+(?i)\bpretext\b
+
+# Should be `bearer`
+\b(?<=the )burden(?= of bad news\b)
+
+# Should be `bona`
+# unless talking about bones
+\bbone(?= fide\b)
+
+# Should be `branches`
+# ... unless it's really about the meal that replaces breakfast and lunch.
+\b[Bb]runches\b
 
 # Should be `briefcase`
 \bbrief-case\b
 
+# Should be `by far` or `far and away`
+\bby far and away\b
+
+# Should be `by and large`
+\bby in large\b
+
+# Should be `bytes`
+# unless talking about sports where a team gets to skip a game, or
+# saying `goodbyes` (even this is questionable)
+(?<!\\)\bbyes\b
+
 # Should be `can, not only ..., ... also...`
 \bcan not only.*can also\b
 
@@ -46,7 +121,45 @@
 # > In formal writing and where contractions are frowned upon, use `cannot`.
 # > It is possible to write `can not`, but you generally find it only as part of some other construction, such as `not only . . . but also.`
 # - if you encounter such a case, add a pattern for that case to patterns.txt.
-\b[Cc]an not\b
+\b[Cc]an not\b(?! only\b)
+
+# Should be `chart`
+(?i)\bhelm\b.*\bchard\b
+
+# Do not use `(click) here` links
+# For more information, see:
+# * https://www.w3.org/QA/Tips/noClickHere
+# * https://webaim.org/techniques/hypertext/link_text
+# * https://granicus.com/blog/why-click-here-links-are-bad/
+# * https://heyoka.medium.com/dont-use-click-here-f32f445d1021
+(?i)(?:>|\[)(?:(?:click |)here|link|(?:read |)more)(?:</|\]\()
+
+# Including "image of" or "picture of" in alt text is unnecessary.
+\balt=['"](?:an? |)(?:image|picture) of
+
+# Alt text should be short
+\balt=(?:'[^']{126,}'|"[^"]{126,}")
+
+# Should be `effect`
+(?<=\btake )affect\b
+
+# Should be `-endian`
+\b(?i)(?<=big|little) endian\b
+
+# Should be `equals` to `is equal to`
+\bequals to\b
+
+# Should be `ECMA` 262 (JavaScript)
+(?i)\bTS\/EMCA\b|\bEMCA(?: \d|\s*Script)|\bEMCA\b(?=.*\bTS\b)
+
+# Should be `ECMA` 340 (Near Field Communications)
+(?i)EMCA[- ]340
+
+# Should be `fall back`
+\b(?<!\bon )fallback(?= to)\b
+
+# Should be `for`, `for, to` or `to`
+\b(?:for to|(?<!bind )to for)\b
 
 # Should be `GitHub`
 (?<![&*.]|// |\b(?:from|import|type) )\bGithub\b(?![{()])
@@ -54,6 +167,19 @@
 # Should be `GitLab`
 (?<![&*.]|// |\b(?:from|import|type) )\bGitlab\b(?![{()])
 
+# Should be `heartrending` unless talking about drawing hearts
+\b(?i)heart[- ]rendering\b(?![^.?!]*(?:hearts|quirk))
+
+# Should probably be `https://`...
+# Markdown generally doesn't assume that links are to urls
+\]\(www\.\w
+
+# Should be `https://`...
+(?<=<)http://(?!localhost|127|example|wiki\.powerdns\.com|www\.lmdb\.tech|BetterCGI\.com|ocsp\.int-x3\.letsencrypt\.org|=)(?:[^>]+)
+
+# Should be `intents and purposes`
+(?<=[Ff]or all )intensive purposes\b
+
 # Should be `JavaScript`
 \bJavascript\b
 
@@ -69,11 +195,14 @@
 # Should be `RabbitMQ`
 \bRabbitmq\b
 
+# Should be `TensorFlow`
+\bTensorflow\b
+
 # Should be `TypeScript`
 \bTypescript\b
 
 # Should be `another`
-\ban[- ]other\b
+\ban[- ]other(?!-)\b
 
 # Should be `case-(in)sensitive`
 \bcase (?:in|)sensitive\b
@@ -90,11 +219,17 @@
 # Should be `has`
 \b[Ii]t only have\b
 
+# Should be `here-in`, `the`, `them`, `this`, `these` or reworded in some other way
+\bthe here(?:\.|,| (?!and|defined))
+
+# Should be `going to bed` or `going to a bad`
+\bgoing to bad(?!-)\b
+
 # Should be `greater than`
 \bhigher than\b
 
-# Should be `ID`
-\bId\b
+# Should be `ID` (unless it's a flag/property)
+(?<![-\.])\bId\b(?![(])
 
 # Should be `in front of`
 \bin from of\b
@@ -107,14 +242,26 @@
 # Should be `use`
 \sin used by\b
 
+# Should be `in-depth` if used as an adjective (but `in depth` when used as an adverb)
+\bin depth\s(?!rather\b)\w{6,}
+
+# Should be `in-flight` or `on the fly` (unless actually talking about airline flights)
+\bon[- ]flight\b(?!=\s+(?:(?:\w{2}|)\d+|availability|booking|computer|data|delay|departure|management|performance|radar|reservation|scheduling|software|status|ticket|time|type|.*(?:hotel|taxi)))
+
 # Should be `is obsolete`
 \bis obsolescent\b
 
 # Should be `it's` or `its`
-\bits['’]
+(?<![.'])\bits['’]
 
 # Should be `its`
-\bit's(?= own\b)
+\bit's(?= (?:child|only purpose|own(?:er|)|parent|sibling)\b)
+
+# Should be `for its` (possessive) or `because it is`
+\bfor it(?:'s| is)\b
+
+# Should be `lends`
+\bleads(?= credence)
 
 # Should be `log in`
 \blogin to the
@@ -122,9 +269,34 @@
 # Should be `long-standing`
 \blong standing\b
 
+# Should be `lose`
+(?<=\bwill )loose\b
+
+# `apt-key` is deprecated
+# ... instead you should be writing a pair of files:
+# ... * the gpg key added to a distinct key ring file based on your project/distro/key...
+# ... * the sources.list in a district file -- not simply appended to `/etc/apt/sources.list` -- (there is a newer format [DEB822](https://manpages.debian.org/bookworm/dpkg-dev/deb822.5.en.html)) that references the gpg key.
+# Consider:
+# ````sh
+# curl http://download.something.example.com/$DISTRO/Release.key | \
+#     gpg --dearmor --yes --output /usr/share/keyrings/something-distro.gpg
+# echo "deb [signed-by=/usr/share/keyrings/something-distro.gpg] http://download.something.example.com/repositories/home:/$DISTRO ./" \
+#     >> /etc/apt/sources.list.d/something-distro.list
+# ````
+\bapt-key add\b
+
+# Should be `nearby`
+\bnear by\b
+
 # Should probably be a person named `Nick` or the abbreviation `NIC`
 \bNic\b
 
+# Should be `not supposed`
+\bsupposed not\b
+
+# Should be `Once this` or `On this` or even `One that`. Rarely `One, this`
+[?!.] One this\b
+
 # Should probably be `much more`
 \bmore much\b
 
@@ -132,7 +304,10 @@
 \bperform it's\b
 
 # Should be `opt-in`
-(?<!\scan|for)(?<!\sif)\sopt in\s
+(?<!\scan|for)(?<!\smust)(?<!\sif)\sopt in\s
+
+# Should be `out-of-date` if acting as an adjective before a noun
+\bout of date(?= \w{3,}\b)
 
 # Should be `less than`
 \bless then\b
@@ -149,24 +324,89 @@
 # Should be `on the other hand`
 \b(?i)on another hand\b
 
+# Reword to `on at runtime` or `enabled at launch`
+# The former if you mean it can be changed dynamically.
+# The latter if you mean that it can be changed without recompiling but not after the program starts.
+\bswitched on runtime\b
+
+# Should be `Of course,`
+[?.!]\s+Of course\s(?=[-\w\s]+[.?;!,])
+
 # Most people only have two hands. Reword.
 \b(?i)on the third hand\b
 
+# Should be `Open Graph`
+# unless talking about a specific Open Graph implementation:
+# - Java
+# - Node
+# - Py
+# - Ruby
+\bOpenGraph\b
+
+# Should be `OpenShift`
+\bOpenshift\b
+
 # Should be `otherwise`
 \bother[- ]wise\b
 
+# Should be `; otherwise` or `. Otherwise`
+# https://study.com/learn/lesson/otherwise-in-a-sentence.html
+, [Oo]therwise\b
+
+# Should probably be `Otherwise,`
+(?<=\. )Otherwise\s
+
 # Should be `or (more|less)`
 \bore (?:more|less)\b
 
+# Should be `or`
+\b(?i)true of .*false\b
+
+# Should be `pale`
+\b(?<=beyond the )pail\b
+
+# Should be reworded.
+# `passthrough` is an adjective
+# `pass-through` could be a noun
+# `pass through` would be a verb phrase
+\b(?i)passthrough(?= an?\b)
+
 # Should be `rather than`
 \brather then\b
 
+# Should be `Red Hat`
+\bRed[Hh]at\b
+
 # Should be `regardless, ...` or `regardless of (whether)`
 \b[Rr]egardless if you\b
 
+# Should be `self-signed`
+\bself signed\b
+
+# Should be `SendGrid`
+\bSendgrid\b
+
+# Should be `set up` (`setup` is a noun / `set up` is a verb)
+\b[Ss]etup(?= (?:an?|the)\b)
+
+# Should be `state`
+\bsate(?=\b|[A-Z])|(?<=[a-z])Sate(?=\b|[A-Z])|(?<=[A-Z]{2})Sate(?=\b|[A-Z])
+
+# Should be `this`
+\b[Tt]oday(?= morning\b)
+
+# Should be `let's` or `let us`
+\b[Ll]ets (?=throw\.)
+
 # Should be `no longer needed`
 \bno more needed\b(?! than\b)
 
+# Should be `<see|look> below for the`
+(?i)\bfind below the\b
+
+# Should be `then any` unless there's a comparison before the `,`
+, than any\b
+
 # Should be `did not exist`
 \bwere not existent\b
 
@@ -176,9 +416,18 @@
 # Should be `nonexistent`
 \b[Nn]o[nt][- ]existent\b
 
+# Should be `our`
+\bspending out time\b
+
 # Should be `@brief` / `@details` / `@param` / `@return` / `@retval`
 (?:^\s*|(?:\*|//|/*)\s+`)[\\@](?:breif|(?:detail|detials)|(?:params(?!\.)|prama?)|ret(?:uns?)|retvl)\b
 
+# Should be `more than` or `more, then`
+\bmore then\b
+
+# Should be `Pipeline`/`pipeline`
+(?:(?<=\b|[A-Z])p|P)ipeLine(?:\b|(?=[A-Z]))
+
 # Should be `preexisting`
 [Pp]re[- ]existing
 
@@ -194,6 +443,9 @@
 # Should be `prerequisite`
 [Pp]re[- ]requisite
 
+# Should be `QuickTime`
+\bQuicktime\b
+
 # Should be `recently changed` or `recent changes`
 [Rr]ecent changed
 
@@ -203,11 +455,27 @@
 # Should be `reentrant`
 [Rr]e[- ]entrant
 
+# Should be `room for`
+\brooms for (?!lease|rent|sale)
+
+# Should be `socioeconomic`
+# https://dictionary.cambridge.org/us/dictionary/english/socioeconomic
+socio-economic
+
+# Should be `strong suit`
+\b(?:my|his|her|their) strong suite\b
+
+# Should probably be `temperatures` unless actually talking about thermal drafts (things birds may fly on)
+\bthermals\b
+
+# Should be `there are` or `they are` (or `they're`)
+(?i)\btheir are\b
+
 # Should be `understand`
 \bunder stand\b
 
-# Should be `URI` or `uri` unless it refers to a person named `Uri`
-(?<!\.)\bUri\b(?![(])
+# Should be `URI` or `uri` unless it refers to a person named `Uri` (or a flag)
+(?<![-\.])\bUri\b(?![(])
 
 # Should be `it uses is`
 /\bis uses is\b/
@@ -215,15 +483,49 @@
 # Should be `uses it as`
 (?:^|\. |and )uses is as (?!an?\b|follows|livestock|[^.]+\s+as\b)
 
+# Should be `was`
+\bhas been(?= removed in v?\d)
+
 # Should be `where`
 \bwere they are\b
 
+# Should be `why`
+, way(?= is [^.]*\?)
+
 # should be `vCenter`
 \bV[Cc]enter\b
 
 # Should be `VM`
 \bVm\b
 
+# Should be `walkthrough(s)`
+\bwalk-throughs?\b
+
+# Should be `want`
+\bdon't ant\b
+
+# Should be `we'll`
+\bwe 'll\b
+
+# Should be `week`
+# unless you're really talking about people or pointers
+\bevery weak[.,?!]
+
+# Should be `well`
+\b[Yy]ou(?:'re| are) doing good\b
+
+# Should be `whereas`
+\bwhere as\b
+
+# Should be `WinGet`
+\bWinget\b
+
+# Should be `without` (unless `out` is a modifier of the next word)
+\bwith out\b(?!-)
+
+# Should be `work around`
+\b[Ww]orkaround(?= an?\b)
+
 # Should be `workarounds`
 \bwork[- ]arounds\b
 
@@ -233,11 +535,22 @@
 # Should be `worst`
 (?i)worse-case
 
+# Should be `you are not` or reworded
+\byour not\b
+
 # Should be `(coarse|fine)-grained`
 \b(?:coarse|fine) grained\b
 
+# Homoglyph (Cyrillic) should be `A`/`B`/`C`/`E`/`H`/`I`/`I`/`J`/`K`/`M`/`O`/`P`/`S`/`T`/`Y`
+# It's possible that your content is intentionally mixing Cyrillic and Latin scripts, but if it isn't, you definitely want to correct this.
+(?<=[A-Z]{2})[АВСЕНІӀЈКМОРЅТУ]|[АВСЕНІӀЈКМОРЅТУ](?=[A-Z]+(?:\b|[a-z]+)|[a-z]+(?:[^a-z]|$))
+
+# Homoglyph (Cyrillic) should be `a`/`b`/`c`/`e`/`o`/`p`/`x`/`y`
+# It's possible that your content is intentionally mixing Cyrillic and Latin scripts, but if it isn't, you definitely want to correct this.
+[авсеорху](?=[A-Za-z]{2,})|(?<=[A-Za-z]{2})[авсеорху]|(?<=[A-Za-z])[авсеорху](?=[A-Za-z])
+
 # Should be `neither/nor` -- or reword
-#(?!<do )\bnot\b([^.?!"/(](?!neither|,.*?,))+\bnor\b
+#(?<!do )\bnot\b([^.?!"/(](?!neither|,.*?,))+\bnor\b
 
 # Should be `neither/nor` (plus rewording the beginning)
 # This is probably a double negative...
diff --git a/.github/actions/spell-check/only.txt b/.github/actions/spell-check/only.txt
index 5cb67a541f..ce710cf126 100644
--- a/.github/actions/spell-check/only.txt
+++ b/.github/actions/spell-check/only.txt
@@ -1,5 +1,7 @@
 /docs/
 ^docs/
 \.md$
+\.rst$
+pdns/dnsdistdist/dnsdist-settings-definitions\.yml
 pdns/recursordist/settings/table.py
 regression-tests.*/description
diff --git a/.github/actions/spell-check/patterns.txt b/.github/actions/spell-check/patterns.txt
index a49e9372f8..4795aca701 100644
--- a/.github/actions/spell-check/patterns.txt
+++ b/.github/actions/spell-check/patterns.txt
@@ -58,6 +58,10 @@ DoH
 # libraries
 (?:\b|_)lib(?:re(?=office|ssl)|)(?!era[lt]|ero|erty|rar(?:i(?:an|es)|y))(?=[a-z])
 
+# hit-count: 124 file-count: 50
+# Repeated letters
+\b([a-z])\g{-1}{2,}\b
+
 # hit-count: 89 file-count: 7
 # hex digits including css/html color classes:
 (?:[\\0][xX]|\\u?|[uU]\+|#x?|%23)[0-9_a-fA-FgGrR]*?[a-fA-FgGrR]{2,}[0-9_a-fA-FgGrR]*(?:[uUlL]{0,3}|[iu]\d+)\b
@@ -78,6 +82,14 @@ DoH
 # Non-English
 [a-zA-Z]*[ÀÁÂÃÄÅÆČÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæčçèéêëìíîïðñòóôõöøùúûüýÿĀāŁłŃńŅņŒœŚśŠšŜŝŸŽžź][a-zA-Z]{3}[a-zA-ZÀÁÂÃÄÅÆČÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæčçèéêëìíîïðñòóôõöøùúûüýÿĀāŁłŃńŅņŒœŚśŠšŜŝŸŽžź]*|[a-zA-Z]{3,}[ÀÁÂÃÄÅÆČÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæčçèéêëìíîïðñòóôõöøùúûüýÿĀāŁłŃńŅņŒœŚśŠšŜŝŸŽžź]|[ÀÁÂÃÄÅÆČÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæčçèéêëìíîïðñòóôõöøùúûüýÿĀāŁłŃńŅņŒœŚśŠšŜŝŸŽžź][a-zA-Z]{3,}
 
+# hit-count: 17 file-count: 11
+# DNS rr data
+(?:\d+\s+){3}(?:[-+/=.\w]{2,}\s*){1,2}
+
+# hit-count: 15 file-count: 3
+# css fonts
+\bfont(?:-family|):[^;}]+
+
 # hit-count: 12 file-count: 5
 # base64 encoded content
 ([`'"])[-a-zA-Z=;:/0-9+]{3,}=\g{-1}
@@ -153,13 +165,16 @@ DoH
 # to opt in
 \bto opt in\b
 
+# pass(ed|ing) in
+\bpass(?:ed|ing) in\b
+
 # acceptable duplicates
 # ls directory listings
 [-bcdlpsw](?:[-r][-w][-SsTtx]){3}[\.+*]?\s+\d+\s+\S+\s+\S+\s+[.\d]+(?:[KMGT]|)\s+
 # mount
 \bmount\s+-t\s+(\w+)\s+\g{-1}\b
 # C types and repeated CSS values
-\s(auto|buffalo|center|div|inherit|long|LONG|none|normal|solid|thin|transparent|very)(?: \g{-1})+\s
+\s(auto|buffalo|center|div|inherit|long|LONG|none|normal|solid|thin|transparent|very)(?:\s\g{-1})+\s
 # C enum and struct
 \b(?:enum|struct)\s+(\w+)\s+\g{-1}\b
 # go templates
@@ -168,7 +183,7 @@ DoH
 (?:[\\@](?:brief|defgroup|groupname|link|t?param|return|retval)|(?:public|private|\[Parameter(?:\(.+\)|)\])(?:\s+(?:static|override|readonly|required|virtual))*)(?:\s+\{\w+\}|)\s+(\w+)\s+\g{-1}\s
 
 # macOS file path
-/MacOS
+(?:Contents\W+|(?!iOS)/)MacOS\b
 
 # Python package registry has incorrect spelling for macOS / Mac OS X
 "Operating System :: MacOS :: MacOS X"
diff --git a/.github/actions/spell-check/reject.txt b/.github/actions/spell-check/reject.txt
index 5cc86ef80c..48a5833d12 100644
--- a/.github/actions/spell-check/reject.txt
+++ b/.github/actions/spell-check/reject.txt
@@ -1,8 +1,17 @@
 ^attache$
-^bellow$
+^bellows?$
 benefitting
 occurences?
 ^dependan.*
+^develope$
+^developement$
+^developpe
+^Devers?$
+^devex
+^devide
+^Devinn?[ae]
+^devisal
+^devisor
 ^diables?$
 ^oer$
 Sorce
@@ -10,4 +19,5 @@ Sorce
 ^Teh$
 ^untill$
 ^untilling$
+^venders?$
 ^wether.*
diff --git a/.github/workflows/spelling3.yml b/.github/workflows/spelling3.yml
index 1f0c5fd2b5..6196d8b99b 100644
--- a/.github/workflows/spelling3.yml
+++ b/.github/workflows/spelling3.yml
@@ -24,10 +24,6 @@ jobs:
       contents: read
       # pull-requests-read is needed for suppress_push_for_open_pull_request in private repositories
       pull-requests: read
-      # actions-read is needed (possibly only for private repositories)
-      # to identify the workflow's filename until
-      # https://github.com/actions/runner/issues/853 is fixed
-      actions: read
       # security-events-write is needed according to the documentation:
       # https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github#uploading-a-code-scanning-analysis-with-github-actions
       security-events: write
@@ -42,7 +38,7 @@ jobs:
     steps:
       - name: check-spelling
         id: spelling
-        uses: check-spelling/check-spelling@v0.0.24
+        uses: check-spelling/check-spelling@v0.0.25
         with:
           config: .github/actions/spell-check
           suppress_push_for_open_pull_request: ${{ github.actor != 'dependabot[bot]' && 1 }}
@@ -52,34 +48,29 @@ jobs:
           post_comment: 0
           use_magic_file: 1
           warnings: bad-regex,binary-file,deprecated-feature,ignored-expect-variant,large-file,limited-references,no-newline-at-eof,noisy-file,non-alpha-in-dictionary,token-is-substring,unexpected-line-ending,whitespace-in-dictionary,minified-file,unsupported-configuration,no-files-to-check,unclosed-block-ignore-begin,unclosed-block-ignore-end
-          use_sarif: ${{ (!github.event.pull_request || (github.event.pull_request.head.repo.full_name == github.repository)) && 1 }}
+          use_sarif: ${{ (!github.event.pull_request || (github.event.pull_request.head.repo.full_name == github.repository)) && !env.DO_NOT_USE_SARIF_REPORTING && 1 }}
+          dictionary_source_prefixes: >
+            {
+            "cspell": "https://raw.githubusercontent.com/check-spelling/cspell-dicts/v20241114/dictionaries/"
+            }
           extra_dictionaries: |
-            cspell:software-terms/dict/softwareTerms.txt
-            cspell:python/src/common/extra.txt
-            cspell:node/dict/node.txt
-            cspell:php/dict/php.txt
-            cspell:python/src/python/python-lib.txt
-            cspell:python/src/python/python.txt
-            cspell:fullstack/dict/fullstack.txt
-            cspell:golang/dict/go.txt
+            cspell:software-terms/softwareTerms.txt
+            cspell:node/node.txt
+            cspell:php/php.txt
+            cspell:python/common/extra.txt
+            cspell:python/python/python-lib.txt
+            cspell:golang/go.txt
+            cspell:cpp/stdlib-cpp.txt
             cspell:aws/aws.txt
-            cspell:k8s/dict/k8s.txt
-            cspell:cpp/src/stdlib-cpp.txt
             cspell:filetypes/filetypes.txt
-            cspell:typescript/dict/typescript.txt
-            cspell:html/dict/html.txt
-            cspell:django/dict/django.txt
-            cspell:java/src/java.txt
-            cspell:dotnet/dict/dotnet.txt
-            cspell:r/src/r.txt
-            cspell:npm/dict/npm.txt
-            cspell:lisp/lisp.txt
-            cspell:cpp/src/lang-jargon.txt
-            cspell:rust/dict/rust.txt
-            cspell:cpp/src/lang-keywords.txt
-            cspell:latex/dict/latex.txt
-            cspell:cpp/src/stdlib-c.txt
-            cspell:cpp/src/ecosystem.txt
-            cspell:lua/dict/lua.txt
-            cspell:java/src/java-terms.txt
-          check_extra_dictionaries: ''
+            cspell:dart/dart.txt
+            cspell:rust/rust.txt
+            cspell:npm/npm.txt
+            cspell:cpp/stdlib-c.txt
+            cspell:fullstack/fullstack.txt
+            cspell:python/python/python.txt
+            cspell:typescript/typescript.txt
+            cspell:html/html.txt
+            cspell:java/java.txt
+            cspell:lua/lua.txt
+          check_extra_dictionaries: ""
-- 
2.47.2