Merging upstream version 5.3.3+dfsg.

Signed-off-by: Daniel Baumann <daniel@debian.org>

.github/workflows/calibreapp-image-actions.yml

@@ -8,15 +8,21 @@ on:
       - '**.png'
       - '**.webp'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     # Only run on Pull Requests within the same repository, and not from forks.
     if: github.event.pull_request.head.repo.full_name == github.repository
     name: calibreapp/image-actions
     runs-on: ubuntu-latest
+    permissions:
+      # allow calibreapp/image-actions to update PRs
+      pull-requests: write
     steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v3
+      - name: Clone repository
+        uses: actions/checkout@v4
         with:
           persist-credentials: false