chore(deps): bump oxsecurity/megalinter from 8 to 10

[dependabot]

Bumps oxsecurity/megalinter from 8 to 10.

Release notes

Sourced from oxsecurity/megalinter's releases.

v10.0.0

What's Changed

• Breaking changes

  • Removed 14 deprecated or long-disabled linters, and the API, MAKEFILE and PUPPET descriptors, which had no other linter left. MegaLinter does not provide Makefile and Puppet linting anymore. See the new Removed linters page for the full list and suggested replacements. (#8606)
  • REPOSITORY_GITLEAKS has been removed: migrate to REPOSITORY_BETTERLEAKS, which reads your existing .gitleaks.toml and .gitleaksignore files unchanged. (#8606)
  • Existing .mega-linter.yml files keep working: configuration variables of removed linters are simply ignored (a single notice lists any found in your configuration) and remain valid in the JSON schema. (#8606)
  • API Reporter payload v2 replaces the v1 payload: metric series are renamed (linter_run_* becomes megalinter_linter_run_*, plus new run-level megalinter_run_* series), and the old docs/grafana dashboards are superseded. Re-provision the new dashboards with npx mega-linter-runner --upload-dashboards grafana — see the migration notes. Legacy NOTIF_API_* variables remain supported as aliases. (#8661)
  • Linters now time out after 5 minutes by default (LINTER_TIMEOUT_SECONDS: 300): a linter exceeding it is killed and reported as an error (exit code 124) instead of running (or hanging) unbounded. If some of your linters legitimately run longer, raise the limit globally with LINTER_TIMEOUT_SECONDS, per linter with <LINTER_KEY>_TIMEOUT_SECONDS, or restore the previous unbounded behavior with value 0. (#8665)

• Core

  • Coding agents integration: MegaLinter can now be driven by Claude Code, Cursor CLI, GitHub Copilot CLI, Codex and many other coding agents — see the new Coding Agents documentation page (#8614)
    • Install the MegaLinter agent skills with npx skills add oxsecurity/megalinter
    • Then ask your agent to set up MegaLinter (megalinter-setup), watch CI or local runs (megalinter-check) or fix lint errors (megalinter-fix)
    • Before the first local run, the skills now make sure the user is aware that MegaLinter is Docker-based and needs a good computer configuration and internet connection (the image download can weigh several GB), and suggest watching CI results instead when that is a problem
    • Local runs launched by the skills now cap PARALLEL_PROCESS_NUMBER to 4 on local computers (CI runs keep one parallel linter process per CPU core), so linting does not saturate the machine
    • Local runs launched by the skills now always activate the JSON reporter (not generated by default) to read results reliably, and fall back to the report folder configuration then the console output instead of waiting for report files that a repository configuration may have disabled
  • Excluded directories are now forwarded to project-mode linters, massively speeding up local runs, fixes #8645
    • Linters that scan the whole workspace by themselves (REPOSITORY_TRIVY, REPOSITORY_CHECKOV, REPOSITORY_GRYPE, REPOSITORY_TRUFFLEHOG, REPOSITORY_SEMGREP and 50+ others) used to crawl everything, including build caches and node_modules: a seconds-long CI lint could take hours on a local checkout
    • MegaLinter now automatically passes the excluded directories (defaults, EXCLUDED_DIRECTORIES, ADDITIONAL_EXCLUDED_DIRECTORIES, and directories detected in FILTER_REGEX_EXCLUDE) to each of these linters, through its native exclusion flags or a generated ignore/config file
    • Every forwarded exclusion is logged in the linter's console section, and the ">300 gitignored files" performance warning now names the heaviest directories it found
    • Opt out globally with FORWARD_EXCLUDED_DIRECTORIES: false, or per linter with <LINTER_KEY>_FORWARD_EXCLUDED_DIRECTORIES: false
  • Default excluded directories now also include common build/cache folders: .wireit, .turbo, .nx, .yarn/cache, .pnpm-store, .parcel-cache, .angular, and the Salesforce CLI .sf / .sfdx state folders (#8646)
  • New per-linter timeout: a linter still running after 5 minutes (LINTER_TIMEOUT_SECONDS: 300 by default) is killed along with all its child processes and reported as an error (exit code 124) with an actionable message, while the other linters keep running. Raise the limit globally with LINTER_TIMEOUT_SECONDS, per linter with <LINTER_KEY>_TIMEOUT_SECONDS, or disable it with value 0 (#8665)
  • New prerun analysis mode (mega-linter-runner --prerun, or MEGALINTER_PRERUN=true environment variable): MegaLinter identifies active linters and collects files, then stops before running any linter and suggests configuration improvements, in the console and in megalinter-reports/prerun-report.json (#8653)
    • Suggested exclusions: top-level directories containing only gitignored files (safe: linting scope is unchanged, and project-mode linters stop scanning them), and well-known generated/vendored folder names (site, dist, vendor...) still containing lintable files (to confirm by the user)
    • A lighter matching flavor is also suggested when available
    • The megalinter-check agent skill uses it on the first local run to tune .mega-linter.yml with the user before the real lint
    • Fixed a performance issue where detecting .gitignored files enumerated every individual file inside large ignored folders (node_modules, build output...) instead of stopping at the folder boundary, which could make the file collection step (including prerun) take several minutes on big repositories
  • Much lighter Docker images: the main image download shrinks by 9%, flavors by 9% to 22%, and standalone megalinter-only-* images are 35% to 65% smaller (#8621)

    • If your PRE_COMMANDS compile native code: the compilation toolchain is no longer shipped in the images, install it back with apk add --no-cache gcc make musl-dev

    • Main and flavor images, compressed download size on ghcr.io, linux/amd64 (before = v9.6.0, so deltas also include the linters removed in this version):

      Image	Before	After	Delta
      megalinter (main)	4.55 GB	4.13 GB	-9%
      megalinter-c_cpp	1.61 GB	1.35 GB	-16%
      megalinter-ci_light	724 MB	657 MB	-9%
      megalinter-cupcake	2.52 GB	2.24 GB	-11%
      megalinter-documentation	1.47 GB	1.21 GB	-18%
      megalinter-dotnet	2.23 GB	1.86 GB	-17%
      megalinter-dotnetweb	2.25 GB	1.88 GB	-17%
      megalinter-formatters	936 MB	849 MB	-9%
      megalinter-go	1.55 GB	1.35 GB	-13%
      megalinter-java	1.59 GB	1.32 GB	-17%
      megalinter-javascript	1.49 GB	1.23 GB	-18%
      megalinter-php	1.51 GB	1.26 GB	-17%
      megalinter-python	1.61 GB	1.26 GB	-22%
      megalinter-ruby	1.49 GB	1.22 GB	-18%
      megalinter-rust	1.99 GB	1.80 GB	-10%

... (truncated)

Changelog

Sourced from oxsecurity/megalinter's changelog.

[v10.0.0] - 2026-08-08

• Breaking changes

  • Removed 14 deprecated or long-disabled linters, and the API, MAKEFILE and PUPPET descriptors, which had no other linter left. MegaLinter does not provide Makefile and Puppet linting anymore. See the new Removed linters page for the full list and suggested replacements. (#8606)
  • REPOSITORY_GITLEAKS has been removed: migrate to REPOSITORY_BETTERLEAKS, which reads your existing .gitleaks.toml and .gitleaksignore files unchanged. (#8606)
  • Existing .mega-linter.yml files keep working: configuration variables of removed linters are simply ignored (a single notice lists any found in your configuration) and remain valid in the JSON schema. (#8606)
  • API Reporter payload v2 replaces the v1 payload: metric series are renamed (linter_run_* becomes megalinter_linter_run_*, plus new run-level megalinter_run_* series), and the old docs/grafana dashboards are superseded. Re-provision the new dashboards with npx mega-linter-runner --upload-dashboards grafana — see the migration notes. Legacy NOTIF_API_* variables remain supported as aliases. (#8661)
  • Linters now time out after 5 minutes by default (LINTER_TIMEOUT_SECONDS: 300): a linter exceeding it is killed and reported as an error (exit code 124) instead of running (or hanging) unbounded. If some of your linters legitimately run longer, raise the limit globally with LINTER_TIMEOUT_SECONDS, per linter with <LINTER_KEY>_TIMEOUT_SECONDS, or restore the previous unbounded behavior with value 0. (#8665)

• Core

  • Coding agents integration: MegaLinter can now be driven by Claude Code, Cursor CLI, GitHub Copilot CLI, Codex and many other coding agents — see the new Coding Agents documentation page (#8614)
    • Install the MegaLinter agent skills with npx skills add oxsecurity/megalinter
    • Then ask your agent to set up MegaLinter (megalinter-setup), watch CI or local runs (megalinter-check) or fix lint errors (megalinter-fix)
    • Before the first local run, the skills now make sure the user is aware that MegaLinter is Docker-based and needs a good computer configuration and internet connection (the image download can weigh several GB), and suggest watching CI results instead when that is a problem
    • Local runs launched by the skills now cap PARALLEL_PROCESS_NUMBER to 4 on local computers (CI runs keep one parallel linter process per CPU core), so linting does not saturate the machine
    • Local runs launched by the skills now always activate the JSON reporter (not generated by default) to read results reliably, and fall back to the report folder configuration then the console output instead of waiting for report files that a repository configuration may have disabled
  • Excluded directories are now forwarded to project-mode linters, massively speeding up local runs, fixes #8645
    • Linters that scan the whole workspace by themselves (REPOSITORY_TRIVY, REPOSITORY_CHECKOV, REPOSITORY_GRYPE, REPOSITORY_TRUFFLEHOG, REPOSITORY_SEMGREP and 50+ others) used to crawl everything, including build caches and node_modules: a seconds-long CI lint could take hours on a local checkout
    • MegaLinter now automatically passes the excluded directories (defaults, EXCLUDED_DIRECTORIES, ADDITIONAL_EXCLUDED_DIRECTORIES, and directories detected in FILTER_REGEX_EXCLUDE) to each of these linters, through its native exclusion flags or a generated ignore/config file
    • Every forwarded exclusion is logged in the linter's console section, and the ">300 gitignored files" performance warning now names the heaviest directories it found
    • Opt out globally with FORWARD_EXCLUDED_DIRECTORIES: false, or per linter with <LINTER_KEY>_FORWARD_EXCLUDED_DIRECTORIES: false
  • Default excluded directories now also include common build/cache folders: .wireit, .turbo, .nx, .yarn/cache, .pnpm-store, .parcel-cache, .angular, and the Salesforce CLI .sf / .sfdx state folders (#8646)
  • New per-linter timeout: a linter still running after 5 minutes (LINTER_TIMEOUT_SECONDS: 300 by default) is killed along with all its child processes and reported as an error (exit code 124) with an actionable message, while the other linters keep running. Raise the limit globally with LINTER_TIMEOUT_SECONDS, per linter with <LINTER_KEY>_TIMEOUT_SECONDS, or disable it with value 0 (#8665)
  • New prerun analysis mode (mega-linter-runner --prerun, or MEGALINTER_PRERUN=true environment variable): MegaLinter identifies active linters and collects files, then stops before running any linter and suggests configuration improvements, in the console and in megalinter-reports/prerun-report.json (#8653)
    • Suggested exclusions: top-level directories containing only gitignored files (safe: linting scope is unchanged, and project-mode linters stop scanning them), and well-known generated/vendored folder names (site, dist, vendor...) still containing lintable files (to confirm by the user)
    • A lighter matching flavor is also suggested when available
    • The megalinter-check agent skill uses it on the first local run to tune .mega-linter.yml with the user before the real lint
    • Fixed a performance issue where detecting .gitignored files enumerated every individual file inside large ignored folders (node_modules, build output...) instead of stopping at the folder boundary, which could make the file collection step (including prerun) take several minutes on big repositories
  • Much lighter Docker images: the main image download shrinks by 9%, flavors by 9% to 22%, and standalone megalinter-only-* images are 35% to 65% smaller (#8621)

    • If your PRE_COMMANDS compile native code: the compilation toolchain is no longer shipped in the images, install it back with apk add --no-cache gcc make musl-dev

    • Main and flavor images, compressed download size on ghcr.io, linux/amd64 (before = v9.6.0, so deltas also include the linters removed in this version):

      Image	Before	After	Delta
      megalinter (main)	4.55 GB	4.13 GB	-9%
      megalinter-c_cpp	1.61 GB	1.35 GB	-16%
      megalinter-ci_light	724 MB	657 MB	-9%
      megalinter-cupcake	2.52 GB	2.24 GB	-11%
      megalinter-documentation	1.47 GB	1.21 GB	-18%
      megalinter-dotnet	2.23 GB	1.86 GB	-17%
      megalinter-dotnetweb	2.25 GB	1.88 GB	-17%
      megalinter-formatters	936 MB	849 MB	-9%
      megalinter-go	1.55 GB	1.35 GB	-13%
      megalinter-java	1.59 GB	1.32 GB	-17%
      megalinter-javascript	1.49 GB	1.23 GB	-18%
      megalinter-php	1.51 GB	1.26 GB	-17%
      megalinter-python	1.61 GB	1.26 GB	-22%
      megalinter-ruby	1.49 GB	1.22 GB	-18%
      megalinter-rust	1.99 GB	1.80 GB	-10%
      megalinter-salesforce	2.09 GB	1.87 GB	-10%

... (truncated)

Commits

• 15e5b45 Release MegaLinter v10.0.0
• 861855a megalinter-setup skill: enforce ghcr.io image references in upgrade mode (#8694)
• 572dc81 [automation] Auto-update linters version, help and documentation (#8695)
• 2f62977 Refresh OX Security PR comment banner and home page banner (#8692)
• 3b8c632 chore(deps): update dependency mongodb/kingfisher to v1.112.0 (#8691)
• 7efac01 chore(deps): update mstruebing/editorconfig-checker docker tag to v3.10.0 (#8...
• 8cea326 Make custom flavor generator output pass MegaLinter (#8686)
• a057dcb [automation] Auto-update linters version, help and documentation (#8690)
• 6dece72 chore(deps): update dependency virtualenv to v21.7.2 (#8683)
• 08a6d16 docs: highlight impactful contributors in the Special thanks section (#8688)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
create-awesome-python-app-website	Ready	Preview	Aug 24, 2026 5:17am

[github-actions]

	Fails
🚫	📋 Missing Section - Please include the section: ## Description in your PR description.
🚫	📋 Missing Section - Please include the section: ## Type of Change in your PR description.
🚫	📋 Missing Section - Please include the section: ## How Has This Been Tested? in your PR description.
🚫	📋 Missing Section - Please include the section: ## Checklist in your PR description.

	Warnings
⚠️	📋 Unchecked Checklist Item - Please check the item: My code follows the style guidelines of this project in your PR description.
⚠️	📋 Unchecked Checklist Item - Please check the item: I have performed a self-review of my code in your PR description.
⚠️	📋 Unchecked Checklist Item - Please check the item: I have commented my code, particularly in hard-to-understand areas in your PR description.
⚠️	📋 Unchecked Checklist Item - Please check the item: I have made corresponding changes to the documentation in your PR description.
⚠️	📋 Unchecked Checklist Item - Please check the item: My changes generate no new warnings in your PR description.
⚠️	📋 Unchecked Checklist Item - Please check the item: Any dependent changes have been merged and published in downstream modules in your PR description.
⚠️	📋 Unchecked Checklist Item - Please check the item: I have checked my code and corrected any misspellings in your PR description.

	Messages
📖	Thanks! We ❤️ small PRs!

Generated by 🚫 dangerJS against ab482a8

[github-actions]

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Fixed	Errors	Max errors	Warnings	Elapsed time
✅ ACTION	actionlint	5		0		0	0.07s
❌ ACTION	zizmor	5		1		0	0.19s
✅ COPYPASTE	jscpd	yes		no		no	1.08s
✅ EDITORCONFIG	editorconfig-checker	172		0		0	0.32s
❌ JAVASCRIPT	eslint	1		1		0	0.44s
✅ JAVASCRIPT	standard	1		0		0	1.99s
✅ JSON	jsonlint	9		0		0	0.22s
✅ JSON	npm-package-json-lint	yes		no		no	0.54s
✅ JSON	prettier	9		0		0	0.8s
✅ JSON	v8r	9		0		0	13.4s
✅ MARKDOWN	markdownlint	9		0		0	0.83s
✅ MARKDOWN	markdown-table-formatter	9		0		0	0.4s
✅ REPOSITORY	betterleaks	yes		no		no	1.13s
✅ REPOSITORY	checkov	yes		no		no	18.25s
✅ REPOSITORY	git_diff	yes		no		no	0.04s
❌ REPOSITORY	osv-scanner	yes		8		no	1.95s
✅ REPOSITORY	secretlint	yes		no		no	2.79s
✅ REPOSITORY	trivy	yes		no		no	11.55s
✅ REPOSITORY	trufflehog	yes		no		no	3.34s
✅ SPELL	cspell	173		0		0	4.72s
❌ TSX	eslint	100		1		0	0.5s
⚠️ YAML	prettier	13		1		2	0.77s
✅ YAML	yamllint	13		0		0	1.14s

Detailed Issues

❌ JAVASCRIPT / eslint - 1 error

Oops! Something went wrong! :(

ESLint: 10.8.0

Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'eslint-plugin-import' imported from eslint.config.mjs
    at Object.getPackageJSONURL (node:internal/modules/package_json_reader:301:9)
    at packageResolve (node:internal/modules/esm/resolve:768:81)
    at moduleResolve (node:internal/modules/esm/resolve:859:18)
    at defaultResolve (node:internal/modules/esm/resolve:992:11)
    at #cachedDefaultResolve (node:internal/modules/esm/loader:704:20)
    at #resolveAndMaybeBlockOnLoaderThread (node:internal/modules/esm/loader:724:38)
    at ModuleLoader.resolveSync (node:internal/modules/esm/loader:762:56)
    at #resolve (node:internal/modules/esm/loader:686:17)
    at ModuleLoader.getOrCreateModuleJob (node:internal/modules/esm/loader:606:35)
    at ModuleJob.syncLink (node:internal/modules/esm/module_job:163:33)


[JAVASCRIPT_ES_ERROR_FLAT_CONFIG_MODULE_NOT_FOUND] ESLint v9+/v10 flat config (`eslint.config.mjs`) uses native ESM resolution, which does not honor `NODE_PATH`. Bare imports like `import js from '@eslint/js'` fail when ESLint runs from MegaLinter's bundled install.
Resolutions:
  - Use `createRequire` in your `eslint.config.mjs` (see the "ESLint v10" section in this linter's documentation above).
  - Or install your project's dependencies and run the project-local ESLint binary:
      JAVASCRIPT_ES_PRE_COMMANDS:
        - command: yarn install --frozen-lockfile --ignore-scripts
          cwd: workspace
          continue_if_failed: false
      JAVASCRIPT_ES_CLI_EXECUTABLE: node_modules/.bin/eslint

❌ TSX / eslint - 1 error

Oops! Something went wrong! :(

ESLint: 10.8.0

Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'eslint-plugin-import' imported from eslint.config.mjs
    at Object.getPackageJSONURL (node:internal/modules/package_json_reader:301:9)
    at packageResolve (node:internal/modules/esm/resolve:768:81)
    at moduleResolve (node:internal/modules/esm/resolve:859:18)
    at defaultResolve (node:internal/modules/esm/resolve:992:11)
    at #cachedDefaultResolve (node:internal/modules/esm/loader:704:20)
    at #resolveAndMaybeBlockOnLoaderThread (node:internal/modules/esm/loader:724:38)
    at ModuleLoader.resolveSync (node:internal/modules/esm/loader:762:56)
    at #resolve (node:internal/modules/esm/loader:686:17)
    at ModuleLoader.getOrCreateModuleJob (node:internal/modules/esm/loader:606:35)
    at ModuleJob.syncLink (node:internal/modules/esm/module_job:163:33)


[TSX_ESLINT_ERROR_FLAT_CONFIG_MODULE_NOT_FOUND] ESLint v9+/v10 flat config (`eslint.config.mjs`) uses native ESM resolution, which does not honor `NODE_PATH`. Bare imports like `import tsPlugin from '@typescript-eslint/eslint-plugin'` fail when ESLint runs from MegaLinter's bundled install.
Resolutions:
  - Use `createRequire` in your `eslint.config.mjs` (see the "ESLint v10" section in this linter's documentation above).
  - Or install your project's dependencies and run the project-local ESLint binary:
      TSX_ESLINT_PRE_COMMANDS:
        - command: yarn install --frozen-lockfile --ignore-scripts
          cwd: workspace
          continue_if_failed: false
      TSX_ESLINT_CLI_EXECUTABLE: node_modules/.bin/eslint

❌ REPOSITORY / osv-scanner - 8 errors

Scanning dir .
Starting filesystem walk for root: /
Scanned pnpm-lock.yaml file and found 827 packages
Scanned tools/danger/package-lock.json file and found 95 packages
End status: 34 dirs visited, 209 inodes visited, 2 Extract calls, 52.224451ms elapsed, 52.224632ms wall time

Total 3 packages affected by 8 known vulnerabilities (0 Critical, 0 High, 6 Medium, 2 Low, 0 Unknown) from 1 ecosystem.
8 vulnerabilities can be fixed.

+-------------------------------------+------+-----------+-----------+---------+---------------+----------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE   | VERSION | FIXED VERSION | SOURCE         |
+-------------------------------------+------+-----------+-----------+---------+---------------+----------------+
| https://osv.dev/GHSA-55q2-fjhq-7xh7 | 5.1  | npm       | dompurify | 3.4.11  | 3.4.13        | pnpm-lock.yaml |
| https://osv.dev/GHSA-c2j3-45gr-mqc4 | 2.1  | npm       | dompurify | 3.4.11  | 3.4.12        | pnpm-lock.yaml |
| https://osv.dev/GHSA-2v8p-3f2j-5mp7 | 5.3  | npm       | mermaid   | 11.16.0 | 11.16.1       | pnpm-lock.yaml |
| https://osv.dev/GHSA-3rrr-jr9j-h3q3 | 6.5  | npm       | mermaid   | 11.16.0 | 11.16.1       | pnpm-lock.yaml |
| https://osv.dev/GHSA-6x64-9x62-f2gx | 5.3  | npm       | mermaid   | 11.16.0 | 11.16.1       | pnpm-lock.yaml |
| https://osv.dev/GHSA-c4c3-pg64-4m4v | 2.4  | npm       | mermaid   | 11.16.0 | 11.16.1       | pnpm-lock.yaml |
| https://osv.dev/GHSA-rhh3-jpg6-66xh | 5.3  | npm       | mermaid   | 11.16.0 | 11.16.1       | pnpm-lock.yaml |
| https://osv.dev/GHSA-fxqj-rqcc-2cmp | 6.3  | npm       | postcss   | 8.5.21  | 8.5.23        | pnpm-lock.yaml |
+-------------------------------------+------+-----------+-----------+---------+---------------+----------------+

❌ ACTION / zizmor - 1 error

INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'ref-confusion' audit failed on file://.github/workflows/mega-linter.yml

Caused by:
    0: error in 'ref-confusion' audit
    1: couldn't list branches for actions/checkout
    2: request error while accessing GitHub API
    3: HTTP status client error (401 Unauthorized) for url (https://github.com/actions/checkout.git/git-upload-pack)


[ACTION_ZIZMOR_ERROR_GITHUB_API_UNREACHABLE] Zizmor could not access a repository referenced by a `uses:` clause via the GitHub API (missing token, insufficient scope, or cross-repo private access).
To allow zizmor to authenticate with GITHUB_TOKEN (or a PAT with `Contents: read-only`), whitelist the variable in your .mega-linter.yml:
ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
  - GITHUB_TOKEN
If the referenced workflow is in a private repo outside the current one, provide a PAT with cross-repo access instead of the default GITHUB_TOKEN, or run zizmor in offline mode.

⚠️ YAML / prettier - 1 error

Checking formatting...
[warn] .github/dependabot.yml
[warn] Code style issues found in the above file. Run Prettier with --write to fix.

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: MARKDOWN_MARKDOWN_LINK_CHECK. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx mega-linter-runner@10.0.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,ACTION_ZIZMOR,COPYPASTE_JSCPD,EDITORCONFIG_EDITORCONFIG_CHECKER,JAVASCRIPT_ES,JAVASCRIPT_STANDARD,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_TRIVY,REPOSITORY_TRUFFLEHOG,SPELL_CSPELL,TSX_ESLINT,YAML_PRETTIER,YAML_YAMLLINT

Show us your support by starring ⭐ the repository