Skip to content

bot: bump oxsecurity/megalinter from 8 to 9 #44

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
dependabot merged 1 commit into from
Sep 29, 2025
Merged

bot: bump oxsecurity/megalinter from 8 to 9 #44

dependabot merged 1 commit into from
Sep 29, 2025

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Sep 22, 2025 •
edited
Loading

Bumps oxsecurity/megalinter from 8 to 9.

Release notes

Sourced from oxsecurity/megalinter's releases.

v9.0.0

What's Changed

  • Core

    • Create your own Megalinter Custom Flavors to dramatically improve your performances
      • See documentation for usage
      • Use npx mega-linter-runner@beta --custom-flavor-setup to initialize repo
      • Suggest new flavors in reporters with a mega-linter-runner including the list of linters
    • New LLM Advisor: call external LLMs to get hints to solve linter errors, available in:
      • Console Reporter
      • Text Reporter
      • Git platforms PR/MR comments Reporter
    • Use ghcr.io docker images by default because of rate limits on docker.io
    • Use uv to create the venv folder for pip-installed linters
    • Add copilot instructions for GitHub Copilot
    • Update base image to python:3.13-alpine3.21 (also embeds go 1.24)

  • Disabled linters

  • Removed linters

    • markdown-link-check has been removed because lychee can be used instead, and has much better performances

  • Linters enhancements

    • PHP-CS-Fixer is able to run on PHP 8.4 without error (change default configuration) by @​llaville
    • cspell: Filter output lines that do not contain found issues
    • hadolint: Extend DOCKERFILE_HADOLINT_FILE_NAMES_REGEX to include the purpose.Dockerfile convention eg service.Dockerfile.
    • sqlfluff: Handle fixing of issues

  • Fixes

    • When linter is docker based, force --platform=linux/amd64 so it works when running locally on Mac
    • Added checking of *.pyi and *.ipynb files to the ruff and ruff-format linters

  • Reporters

    • New default display for Pull Request comments, with expandable sections containing the first 1000 lines of the output log. Former display remains available by defining REPORTERS_MARKDOWN_SUMMARY_TYPE=table
    • Markdown summary reporter:
      • Write a file for Github integration if GITHUB_STEP_SUMMARY is set
      • Truncate less linter output lines
    • Text reporter: Change the output file names to put the linter name first, then the status
    • Enhance display of markdown summary

  • Doc

    • Update documentation in all megalinter descriptor files to improve accuracy and consistency
    • Fix incorrect information in linters documentation and descriptors
    • Remove dead links
    • Add linter description (linter_text) in all linter descriptor, to generate a more exhaustive documentation.
    • Update contributing guide to explain how to manage python dependencies in the codebase

  • Flavors

... (truncated)

Changelog

Sourced from oxsecurity/megalinter's changelog.

[v8.4.1] - 2025-01-28

[v8.4.0] - 2025-01-26

... (truncated)

Commits
  • 0dcbedd Release MegaLinter v9.0.1
  • 9f48fcd Fix v9 release issue (#6197)
  • 139ebb5 chore(deps): update dependency uvicorn to v0.36.0 (#6189)
  • b23f125 [automation] Auto-update linters version, help and documentation (#6194)
  • 0214a3a Update README with v9 announcement (#6193)
  • e552e5c chore(deps): update tflint plugin terraform-linters/tflint-ruleset-aws to v0....
  • ecfbd88 chore(deps): update dependency sfdx-hardis to v6.5.1 (#6188)
  • 60af444 chore(deps): update dependency mega-linter-runner to v9 (#6191)
  • ff177bf Release MegaLinter v9.0.0
  • a6b6815 release changelog
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 22, 2025
@dependabot dependabot bot requested a review from Klintrup as a code owner September 22, 2025 08:21
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 22, 2025
@codara-ai-code-review
Copy link

codara-ai-code-review bot commented Sep 22, 2025

Potential issues, bugs, and flaws that can introduce unwanted behavior.

  1. .github/workflows/megalinter.yml - Updating to a new version (v9) of MegaLinter might introduce breaking changes or modify existing behaviors. Ensure that all configurations and linting rules are compatible with v9 before merging this change to avoid unexpected linting failures.

Code suggestions and improvements for better exception handling, logic, standardization, and consistency.

  1. .github/workflows/megalinter.yml - Consider adding a version lock (e.g., @v9.0.0) if specific versions are known to be stable. This avoids unexpected issues due to automatic updates in the v9 series.
  2. .github/workflows/megalinter.yml - If any new features or rules are introduced in v9, update the documentation files or comments to reflect these changes so that future developers can understand the context of this upgrade.

@github-actions
Copy link

github-actions bot commented Sep 22, 2025 •
edited
Loading

✅MegaLinter analysis: Success

Descriptor Linter Files Fixed Errors Warnings Elapsed time
✅ BASH bash-exec 1 0 0 0.25s
✅ BASH shellcheck 1 0 0 0.08s
✅ BASH shfmt 1 0 0 0 0.01s
✅ COPYPASTE jscpd yes no no 1.34s
✅ MARKDOWN markdownlint 2 0 0 0 0.57s
✅ MARKDOWN markdown-table-formatter 3 0 0 0 0.24s
✅ REPOSITORY gitleaks yes no no 0.13s
✅ REPOSITORY git_diff yes no no 0.27s
✅ REPOSITORY grype yes no no 24.76s
✅ REPOSITORY syft yes no no 1.08s
✅ REPOSITORY trivy yes no no 4.23s
✅ REPOSITORY trivy-sbom yes no no 0.09s
✅ REPOSITORY trufflehog yes no no 2.15s

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

  • Documentation: Custom Flavors
  • Command: npx mega-linter-runner@9.0.1 --custom-flavor-setup --custom-flavor-linters BASH_EXEC,BASH_SHELLCHECK,BASH_SHFMT,COPYPASTE_JSCPD,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG

MegaLinter is graciously provided by OX Security

@Klintrup
Copy link
Owner

Klintrup commented Sep 29, 2025

@dependabot rebase

@dependabot dependabot bot force-pushed the dependabot/github_actions/oxsecurity/megalinter-9 branch from ac90ab9 to 549668a Compare September 29, 2025 19:38
@Klintrup
Copy link
Owner

Klintrup commented Sep 29, 2025

@dependabot recreate

@dependabot dependabot bot force-pushed the dependabot/github_actions/oxsecurity/megalinter-9 branch from 549668a to 82ed628 Compare September 29, 2025 19:49
@Klintrup
Copy link
Owner

Klintrup commented Sep 29, 2025

@dependabot rebase

@dependabot
bot: bump oxsecurity/megalinter from 8 to 9
b378761 
Bumps [oxsecurity/megalinter](https://github.com/oxsecurity/megalinter) from 8 to 9.
- [Release notes](https://github.com/oxsecurity/megalinter/releases)
- [Changelog](https://github.com/oxsecurity/megalinter/blob/main/CHANGELOG.md)
- [Commits](oxsecurity/megalinter@v8...v9)

---
updated-dependencies:
- dependency-name: oxsecurity/megalinter
  dependency-version: '9'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/github_actions/oxsecurity/megalinter-9 branch from 82ed628 to b378761 Compare September 29, 2025 19:57
@sonarqubecloud
Copy link

sonarqubecloud bot commented Sep 29, 2025

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@Klintrup
Copy link
Owner

Klintrup commented Sep 29, 2025

@dependabot merge

@dependabot dependabot bot merged commit 9aa23af into main Sep 29, 2025
7 checks passed
@dependabot dependabot bot deleted the dependabot/github_actions/oxsecurity/megalinter-9 branch September 29, 2025 20:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Klintrup Klintrup Awaiting requested review from Klintrup Klintrup is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Klintrup