chore(deps): bump oxsecurity/megalinter from 8 to 10

[dependabot]

Description

Updates oxsecurity/megalinter from v8 to v10.0.0 and completes the required migration so the repository gate stays green.

• Pins all external Actions to full commit SHAs with version comments (actions/checkout@3d3c42e..., oxsecurity/megalinter@15e5b4..., actions/upload-artifact@043fb4..., pnpm/action-setup@b906af..., actions/setup-node@820762..., alstr/todo-to-issue-action@37bb7b...).
• Stops persisting credentials on read-only checkouts (persist-credentials: false) and scopes push authentication to the Todo Checker step via gh auth setup-git with GH_TOKEN.
• Removes inert APPLY_FIXES apply logic now that APPLY_FIXES: none is enforced; MegaLinter no longer attempts to push fixes.
• Runs the project-local ESLint binary under MegaLinter 10 ESM resolution via PRE_COMMANDS: CI=true npx --yes pnpm@10.32.0 install --frozen-lockfile --ignore-scripts and JAVASCRIPT_ES_CLI_EXECUTABLE / TSX_ESLINT_CLI_EXECUTABLE.
• Allows Zizmor online reference audit to use the job's read-capable GITHUB_TOKEN via ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES.
• Drops the removed MARKDOWN_MARKDOWN_LINK_CHECK reference and adds zizmor to the CSpell allowlist.

MegaLinter 10 verified locally (ghcr.io/oxsecurity/megalinter-javascript:v10.0.0): all blocking linters pass (zizmor, eslint, cspell) with only existing non-blocking shfmt and markdown-table-formatter warnings. Upstream release notes: https://github.com/oxsecurity/megalinter/releases/tag/v10.0.0

Type of Change

• Dependency maintenance
• Bug fix
• New feature
• Breaking change

How Has This Been Tested?

• CI=true npx --yes pnpm@10.32.0 install --frozen-lockfile --ignore-scripts inside MegaLinter 10 container
• pnpm test --run (21 tests passed)
• pnpm type-check (tsc --noEmit)
• Local MegaLinter 10 run with GITHUB_TOKEN – all blocking linters pass, only known non-blocking warnings remain
• Remote CI on this PR: MegaLinter success with warnings, test and type-check pass

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• Any dependent changes have been merged and published in downstream modules
• I have checked my code and corrected any misspellings

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
website-3g7t	Ready	Preview	Aug 26, 2026 9:47pm

[github-actions]

	Messages
📖	Thanks! We ❤️ removing more lines than added!
📖	Thanks! We ❤️ small PRs!

Generated by 🚫 dangerJS against 8e7028e

[github-actions]

✅⚠️MegaLinter analysis: Success with warnings

Descriptor	Linter	Files	Fixed	Errors	Max errors	Warnings	Elapsed time
✅ ACTION	actionlint	5		0		0	0.07s
✅ ACTION	zizmor	5		0		0	2.13s
✅ BASH	bash-exec	1		0		0	0.01s
✅ BASH	shellcheck	1		0		0	0.2s
⚠️ BASH	shfmt	1		1		0	0.01s
✅ COPYPASTE	jscpd	yes		no		no	2.28s
✅ EDITORCONFIG	editorconfig-checker	176		0		0	0.19s
✅ JAVASCRIPT	eslint	1		0		0	2.51s
✅ JAVASCRIPT	standard	1		0		0	1.44s
✅ JSON	jsonlint	10		0		0	0.13s
✅ JSON	npm-package-json-lint	yes		no		no	0.88s
✅ JSON	prettier	10		0		0	0.46s
✅ JSON	v8r	10		0		0	11.72s
✅ MARKDOWN	markdownlint	10		0		0	0.76s
⚠️ MARKDOWN	markdown-table-formatter	10		1		0	0.23s
✅ REPOSITORY	betterleaks	yes		no		no	1.13s
✅ REPOSITORY	checkov	yes		no		no	17.23s
✅ REPOSITORY	git_diff	yes		no		no	0.02s
✅ REPOSITORY	osv-scanner	yes		no		no	1.64s
✅ REPOSITORY	secretlint	yes		no		no	2.99s
✅ REPOSITORY	trivy	yes		no		no	16.33s
✅ REPOSITORY	trufflehog	yes		no		no	3.85s
✅ SPELL	cspell	177		0		0	4.89s
✅ TSX	eslint	100		0		0	5.33s
✅ YAML	prettier	13		0		0	0.72s
✅ YAML	yamllint	13		0		0	0.78s

Detailed Issues

⚠️ MARKDOWN / markdown-table-formatter - 1 error

1 files contain markdown tables to format:
- README.md

⚠️ BASH / shfmt - 1 error

diff public/install.sh.orig public/install.sh
--- public/install.sh.orig
+++ public/install.sh
@@ -25,7 +25,10 @@
 GITHUB_DOWNLOAD="${GITHUB_DOWNLOAD:-https://github.com}"
 
 info() { printf '%s\n' "$*" >&2; }
-die() { printf 'error: %s\n' "$*" >&2; exit 1; }
+die() {
+	printf 'error: %s\n' "$*" >&2
+	exit 1
+}
 
 need_cmd() {
 	command -v "$1" >/dev/null 2>&1 || die "required command not found: $1"

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx mega-linter-runner@10.0.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,ACTION_ZIZMOR,BASH_EXEC,BASH_SHELLCHECK,BASH_SHFMT,COPYPASTE_JSCPD,EDITORCONFIG_EDITORCONFIG_CHECKER,JAVASCRIPT_ES,JAVASCRIPT_STANDARD,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_TRIVY,REPOSITORY_TRUFFLEHOG,SPELL_CSPELL,TSX_ESLINT,YAML_PRETTIER,YAML_YAMLLINT

Show us your support by starring ⭐ the repository

[ulises-jeremias]

Triage 2026-08-25 (maintenance sweep): BLOCKED — not safe to merge.

All 8 open dependabot PRs fail the same MegaLinter gate as main (32756066890):

• cspell 46 errors (vmodules/vweb/… Spanish i18n, pnpm-lock) — needs combined .cspell.json allowlist PR
• trivy HIGH vuln on pnpm-lock.yaml (brace-expansion CVE-2026-14257/69152, sharp→libvips) + tools/danger/package-lock.json undici CVE-2026-13697 — needs lockfile bump (none of these 8 PRs fixes all 3)
• editorconfig-checker on public/install.sh / non-blocking markdown-table-formatter & yaml prettier
• Danger / pr-review also failing (ts.transpileModule in danger bundle)

test/type-check/Vercel are green, so this is not a code regression from the dep bump. Keep open; do not merge until a combined cspell+trivy+editorconfig fix lands on main, then rebase these dependabots. One-per-lockfile-dir rule applies — batch by / vs /tools/danger.

Post-merge gate on main: tests ✅, type-check ✅, todo ✅, dynamic dependabot updates ✅, MegaLinter ❌ (same 3 linters). No merge attempted.

[ulises-jeremias]

@dependabot rebase