diff --git a/.github/workflows/octocheese.yml b/.github/workflows/octocheese.yml
index 1b0e1b1..ab44ca7 100644
--- a/.github/workflows/octocheese.yml
+++ b/.github/workflows/octocheese.yml
@@ -6,6 +6,9 @@ on:
   schedule:
     - cron: 0 12 * * *
 
+permissions:
+  contents: write
+
 jobs:
   Run:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/python_ci_linux.yml b/.github/workflows/python_ci_linux.yml
index 39803f3..a88c912 100644
--- a/.github/workflows/python_ci_linux.yml
+++ b/.github/workflows/python_ci_linux.yml
@@ -158,7 +158,7 @@ jobs:
 
       - name: Upload distribution to PyPI 🚀
         if: startsWith(github.ref, 'refs/tags/')
-        uses: pypa/gh-action-pypi-publish@v1.4.2
+        uses: pypa/gh-action-pypi-publish@v1.13.0
         with:
           user: __token__
           password: ${{ secrets.PYPI_TOKEN }}
diff --git a/.github/workflows/python_ci_macos.yml b/.github/workflows/python_ci_macos.yml
index 0529130..2ebd2ef 100644
--- a/.github/workflows/python_ci_macos.yml
+++ b/.github/workflows/python_ci_macos.yml
@@ -28,7 +28,7 @@ jobs:
       fail-fast: False
       matrix:
         config:
-          - {python-version: "3.7", os-ver: "13", testenvs: "py37-sphinx{3.3,3.4,3.5,4.0,4.1,4.2,4.3,4.4,4.5,5.0,5.1,5.2,5.3},py37-docutils{0.16,0.17,0.18},build", experimental: False}
+          - {python-version: "3.7", os-ver: "15-intel", testenvs: "py37-sphinx{3.3,3.4,3.5,4.0,4.1,4.2,4.3,4.4,4.5,5.0,5.1,5.2,5.3},py37-docutils{0.16,0.17,0.18},build", experimental: False}
           - {python-version: "3.8", os-ver: "14", testenvs: "py38-sphinx{3.3,3.4,3.5,4.0,4.1,4.2,4.3,4.4,4.5,5.0,5.1,5.2,5.3,6.0,6.1,6.2,7.0,7.1},py38-docutils{0.16,0.17,0.18},build", experimental: False}
           - {python-version: "3.9", os-ver: "14", testenvs: "py39-sphinx{3.3,3.4,3.5,4.0,4.1,4.2,4.3,4.4,4.5,5.0,5.1,5.2,5.3,6.0,6.1,6.2,7.0,7.1,7.2,7.3,7.4},py39-docutils{0.16,0.17,0.18},build", experimental: False}
           - {python-version: "3.10", os-ver: "14", testenvs: "py310-sphinx{3.3,3.4,3.5,4.0,4.1,4.2,4.3,4.4,4.5,5.0,5.1,5.2,5.3,6.0,6.1,6.2,7.0,7.1,7.2,7.3,7.4,8.0,8.1},py310-docutils{0.16,0.17,0.18},build", experimental: False}
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index d1833af..dcf1aac 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -43,7 +43,7 @@ repos:
     - id: bind-requirements
 
  - repo: https://github.com/python-formate/flake8-dunder-all
-   rev: v0.4.1
+   rev: v0.5.0
    hooks:
     - id: ensure-dunder-all
       files: ^html_section/.*\.py$
@@ -62,11 +62,11 @@ repos:
     - id: rst-inline-touching-normal
 
  - repo: https://github.com/asottile/pyupgrade
-   rev: v2.12.0
+   rev: v3.3.0
    hooks:
     - id: pyupgrade
       args:
-       - --py36-plus
+       - --py37-plus
        - --keep-runtime-typing
 
  - repo: https://github.com/Lucas-C/pre-commit-hooks
diff --git a/formate.toml b/formate.toml
index 08a2c03..72f181d 100644
--- a/formate.toml
+++ b/formate.toml
@@ -31,6 +31,7 @@ known_third_party = [
     "coincidence",
     "coverage",
     "coverage_pyver_pragma",
+    "defusedxml",
     "docutils",
     "domdf_python_tools",
     "importlib_metadata",
diff --git a/tox.ini b/tox.ini
index d93a3d4..d55b937 100644
--- a/tox.ini
+++ b/tox.ini
@@ -109,6 +109,7 @@ deps =
     flake8-sphinx-links>=0.0.4
     flake8-strftime>=0.1.1
     flake8-typing-imports>=1.10.0
+    git+https://github.com/domdfcoding/restructuredtext-lint.git@fix-deprecations
     git+https://github.com/domdfcoding/flake8-rst-docstrings-sphinx.git
     git+https://github.com/domdfcoding/flake8-rst-docstrings.git
     git+https://github.com/python-formate/flake8-unused-arguments.git@magic-methods