chore(deps): update ghcr.io/oxsecurity/megalinter-python docker tag to v10 - #46
Open
renovate[bot] wants to merge 1 commit into
Open
chore(deps): update ghcr.io/oxsecurity/megalinter-python docker tag to v10#46renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Collaborator
❌MegaLinter analysis: Error
Detailed Issues❌ REPOSITORY / betterleaks - 1 errorLinter output file not found ❌ PYTHON / ruff - 2 errorsLinter output file not found ❌ REPOSITORY / trufflehog - 1 errorLinter output file not found Notices
See detailed reports in MegaLinter artifacts Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v9.0.1→v10.0.0Release Notes
oxsecurity/megalinter (ghcr.io/oxsecurity/megalinter-python)
v10.0.0Compare Source
Breaking changes
API,MAKEFILEandPUPPETdescriptors, which had no other linter left. MegaLinter does not provide Makefile and Puppet linting anymore. See the new Removed linters page for the full list and suggested replacements. (#8606)REPOSITORY_GITLEAKShas been removed: migrate to REPOSITORY_BETTERLEAKS, which reads your existing.gitleaks.tomland.gitleaksignorefiles unchanged. (#8606).mega-linter.ymlfiles keep working: configuration variables of removed linters are simply ignored (a single notice lists any found in your configuration) and remain valid in the JSON schema. (#8606)linter_run_*becomesmegalinter_linter_run_*, plus new run-levelmegalinter_run_*series), and the olddocs/grafanadashboards are superseded. Re-provision the new dashboards withnpx mega-linter-runner --upload-dashboards grafana— see the migration notes. LegacyNOTIF_API_*variables remain supported as aliases. (#8661)LINTER_TIMEOUT_SECONDS: 300): a linter exceeding it is killed and reported as an error (exit code 124) instead of running (or hanging) unbounded. If some of your linters legitimately run longer, raise the limit globally withLINTER_TIMEOUT_SECONDS, per linter with<LINTER_KEY>_TIMEOUT_SECONDS, or restore the previous unbounded behavior with value0. (#8665)Core
Coding agents integration: MegaLinter can now be driven by Claude Code, Cursor CLI, GitHub Copilot CLI, Codex and many other coding agents — see the new Coding Agents documentation page (#8614)
npx skills add oxsecurity/megalintermegalinter-setup), watch CI or local runs (megalinter-check) or fix lint errors (megalinter-fix)PARALLEL_PROCESS_NUMBERto 4 on local computers (CI runs keep one parallel linter process per CPU core), so linting does not saturate the machineExcluded directories are now forwarded to project-mode linters, massively speeding up local runs, fixes #8645
REPOSITORY_TRIVY,REPOSITORY_CHECKOV,REPOSITORY_GRYPE,REPOSITORY_TRUFFLEHOG,REPOSITORY_SEMGREPand 50+ others) used to crawl everything, including build caches andnode_modules: a seconds-long CI lint could take hours on a local checkoutEXCLUDED_DIRECTORIES,ADDITIONAL_EXCLUDED_DIRECTORIES, and directories detected inFILTER_REGEX_EXCLUDE) to each of these linters, through its native exclusion flags or a generated ignore/config fileFORWARD_EXCLUDED_DIRECTORIES: false, or per linter with<LINTER_KEY>_FORWARD_EXCLUDED_DIRECTORIES: falseDefault excluded directories now also include common build/cache folders:
.wireit,.turbo,.nx,.yarn/cache,.pnpm-store,.parcel-cache,.angular, and the Salesforce CLI.sf/.sfdxstate folders (#8646)New per-linter timeout: a linter still running after 5 minutes (
LINTER_TIMEOUT_SECONDS: 300by default) is killed along with all its child processes and reported as an error (exit code 124) with an actionable message, while the other linters keep running. Raise the limit globally withLINTER_TIMEOUT_SECONDS, per linter with<LINTER_KEY>_TIMEOUT_SECONDS, or disable it with value0(#8665)New prerun analysis mode (
mega-linter-runner --prerun, orMEGALINTER_PRERUN=trueenvironment variable): MegaLinter identifies active linters and collects files, then stops before running any linter and suggests configuration improvements, in the console and inmegalinter-reports/prerun-report.json(#8653)site,dist,vendor...) still containing lintable files (to confirm by the user)megalinter-checkagent skill uses it on the first local run to tune.mega-linter.ymlwith the user before the real lint.gitignored files enumerated every individual file inside large ignored folders (node_modules, build output...) instead of stopping at the folder boundary, which could make the file collection step (including prerun) take several minutes on big repositoriesMuch lighter Docker images: the main image download shrinks by 9%, flavors by 9% to 22%, and standalone
megalinter-only-*images are 35% to 65% smaller (#8621)If your
PRE_COMMANDScompile native code: the compilation toolchain is no longer shipped in the images, install it back withapk add --no-cache gcc make musl-devMain and flavor images, compressed download size on ghcr.io, linux/amd64 (before = v9.6.0, so deltas also include the linters removed in this version):
megalinter(main)megalinter-c_cppmegalinter-ci_lightmegalinter-cupcakemegalinter-documentationmegalinter-dotnetmegalinter-dotnetwebmegalinter-formattersmegalinter-gomegalinter-javamegalinter-javascriptmegalinter-phpmegalinter-pythonmegalinter-rubymegalinter-rustmegalinter-salesforcemegalinter-securitymegalinter-swiftmegalinter-terraformStandalone single-linter images, uncompressed size on linux/amd64 (before = previous beta):
megalinter-only-groovy_npm_groovy_lintmegalinter-only-r_lintrmegalinter-only-spell_proselintmegalinter-only-css_stylelintmegalinter-only-spell_cspellmegalinter-only-ruby_rubocopmegalinter-only-perl_perlcriticmegalinter-only-spell_valemegalinter-only-yaml_yamllintmegalinter-only-bash_shellcheckmegalinter-only-lua_luacheckmegalinter-only-xml_xmllintFaster startup on every run (~5 seconds saved) (#8624)
--versionLLM_ADVISOR_ENABLEDis trueVERSION_GET_AT_RUNTIME: truevariable if yourPRE_COMMANDSinstall different linter versions and you want the really installed versions reportedFaster linting when fixes are applied (
APPLY_FIXES): the check-only linters of a language now run in parallel as soon as its fixer linters are done, instead of all linters of the language running one after another (#8624)Faster standalone images and file-list runs:
megalinter-only-*images only parse the descriptor of their single linter, and the repository-wide.gitignoreenumeration is skipped when an explicit list of files is passed (e.g.mega-linter-runner [files...]on a large repository) (#8614)Runtime speed-ups combined, measured on the MegaLinter repository itself and on real-world repositories upgraded to this version (average of the last successful CI runs before / first CI runs after the upgrade):
import megalinter)Better secrets masking in logs, now powered by the betterleaks ruleset: redaction coverage nearly doubles (218 to 408 patterns), with no more network call at startup (#8606)
FILTER_REGEX_INCLUDEandFILTER_REGEX_EXCLUDE(global, per-descriptor and per-linter) can now be defined as a list of regexes combined with a logical OR, so filter regexes can be appended acrossEXTENDSconfigs viaCONFIG_PROPERTIES_TO_APPEND; single-string values remain fully supported, fixes #8361New
ENABLE_DISABLE_LINTERS_PRIORITYvariable to letDISABLE_LINTERSoverrideENABLE_LINTERSwhen a linter is in both lists (e.g. to trim an inheritedENABLE_LINTERSlist viaEXTENDS), fixes #8296New
MEGALINTER_FLAVORandMEGALINTER_VERSIONproperties in.mega-linter.yml, to pin the flavor and version of the MegaLinter Docker image once in the repository and have them reused by mega-linter-runner and the agent skills (#8614)Display a distinct ☑️ status icon (instead of⚠️ ) for linters that found errors without blocking the run because the error count stayed under
<LINTER>_DISABLE_ERRORS_IF_LESS_THAN, and show the configured maximum in the console and Pull Request summary tables (#8496)A
<LINTER>_CLI_LINT_MODEoverride targeting a lint mode the linter does not support is now rejected with an explicit error instead of failing at lint time, fixes #7120New linters
Removed linters
JSON_PRETTIERorJSON_JSONLINTinstead (#8606)LUA_LUACHECKinstead (#8606)MARKDOWN_MARKDOWNLINTinstead (#8606)REPOSITORY_BETTERLEAKSinstead (#8606)REPOSITORY_CHECKOVinstead (#8606)SALESFORCE_CODE_ANALYZER_FLOWinstead (#8606)SALESFORCE_CODE_ANALYZER_*linters instead (#8606)REPOSITORY_CHECKOVinstead (#8606)Linters enhancements
REPOSITORY_CHECKOVnow skips itssecretsframework (--skip-framework secrets) when a dedicated secret scanner (betterleaks, kingfisher, secretlint or trufflehog) is active in the same run: the duplicated secrets scan added minutes to every run and could stall for hours on bind-mounted workspaces. Define--frameworkor--skip-frameworkinREPOSITORY_CHECKOV_ARGUMENTS(or in your checkov config file) to keep checkov's own secrets scan (#8665)Fixes
FutureWarning: Possible nested setwarnings appearing in the console at startup: a secret-masking regex used a POSIX character class ([[:alnum:]]) unsupported by Python. Such classes are now translated, which also makes the affected masking rule (Airtable personal access tokens) actually match (#8684)megalinter-only-*Docker images: they were mistakenly published for a single architecture, linux/amd64 + linux/arm64 are back (#8247)SPELL_CSPELL) linting zero files when run through their standalonemegalinter-only-*Docker image (#8614)LINTER_RULES_PATHnot being used to resolve config files for linters usingactive_only_if_file_found(e.g.REPOSITORY_LS_LINT,SPELL_PROSELINT,SPELL_VALE), fixes #8416EXCLUDED_DIRECTORIESandADDITIONAL_EXCLUDED_DIRECTORIESin changed-files mode (VALIDATE_ALL_CODEBASE: false), the same way they are honored during full-codebase validation (#8360)MEGALINTER_CONFIGandEXTENDSfiles fetched over HTTP) resilient to transient network failures with a request timeout and retries (#8349)git ls-files) with a 120 seconds timeout: on workspaces with pathologically slow file access (e.g. bind-mounted from Windows into a WSL2-backed container engine) this internal git call could hang the whole run before any linter started; it now degrades to an actionable warning and the run continues (#8665)CSS_STYLELINT_COMMAND_REMOVE_ARGUMENTSto remove--config-basedir, and stop raising an error when an argument listed in<LINTER>_COMMAND_REMOVE_ARGUMENTSis not in the command line, fixes #8552artifactChangesarrays before report aggregation, fixes #8474SARIF_TO_HUMANproducing empty linter logs when the SARIF-to-text conversion crashed; raw SARIF is now shown as a fallback (#8294)REPOSITORY_CHECKOV's transient GitHub-configuration scan files (branch_protection_rules.jsonand similar) out of the linted repository — they are now written inside the report folder, so they no longer appear in other linters' results (#8406)REPOSITORY_SECRETLINTcrash (ENOENT) when it scanned report files being written at the same time by other linters (#8624)COPYPASTE_JSCPDnow runs on linux/amd64 only: jscpd v5 provides no ARM64 binary compatible with MegaLinter images, so it always failed withUnsupported platform linux/arm64on ARM (#8610)Reporters
API_REPORTER_DETAILS: false)API_REPORTER_PROVIDERvariable: comma-separated list of target providers (grafanaby default,datadog,elastic,newrelic) with per-provider auth variables (API_REPORTER_DATADOG_*,API_REPORTER_ELASTIC_*,API_REPORTER_NEWRELIC_*)npx mega-linter-runner --upload-dashboards <provider>(idempotent create-or-update), also proposed during--installand--upgradeAPI_REPORTER_PAYLOAD_FORMATvariable (auto,lokiordefault) to force the payload format sent by the API Reporter, instead of only deducing it from the endpoint URL (#8661)npx mega-linter-runner --upload-dashboards <provider>(#8667)\ntext), and Elastic and New Relic gain the missing "Linters dragging the score down" and "Time saved by auto-fixes" elementsrunId, which burned metric cardinality for no query valueDoc
npx skills add oxsecurity/megalinterthen "setup megalinter") is now the first suggested option (#8625)--prerunanalysis, so the user can validate the suggested.mega-linter.ymlperformance tuning before the real lint (#8653)[Activation]notices, deprecations) are now extracted from the persisted log file and returned to the calling agent in atipsfield, instead of being lost when reading only the JSON report (#8665)AGPL-3.0LICENSEfile to your flavor repository and keep the link to the MegaLinter source in its README, fixes #8681docs/descriptors/repository_kingfisher.md(#8364)mega-linter-runner
--upload-dashboards <provider>option: provision or refresh the MegaLinter observability dashboards in Grafana, Datadog, Elastic (Kibana) or New Relic, using the provider auth environment variables (documentation) (#8661)--installand--upgrade, or with--setup-dashboards <provider>in non-interactive mode--installcan now run without prompts (#8614)--no-promptwith the new--setup-*options (--setup-ci,--setup-copy-paste,--setup-spelling-mistakes,--setup-default-branch,--setup-validate-all-code-base,--setup-ox) and the existing--flavor,--releaseand--fixflags<file>.megalinter-setup.bakbefore being overwritten, so customizations can be merged back--linter <LINTER_KEY>option to run a single linter using its standalonemegalinter-only-<linter_key>Docker image, with an optional list of files to lint (#8614)megalinter-reports/<linter_key>, so several standalone runs can execute in parallelMEGALINTER_FLAVORandMEGALINTER_VERSIONfrom.mega-linter.ymlwhen--flavor/--releaseare not passed on the command line, and the install generator writes both properties in the generated configuration (#8614)--fixnow respects anAPPLY_FIXESvalue (other thannone) defined in.mega-linter.ymlinstead of overriding it withall(#8614)--upgradealso bumps a pinnedMEGALINTER_VERSIONproperty of.mega-linter.ymlto the current major version (#8614)--upgradenow migrates v9 references to v10: GitHub Action (oxsecurity/megalinter@v9, flavors) and Docker image (ghcr.io/oxsecurity/megalinter:v9, flavors) references are rewritten tov10, and--installdefaults tov10--prerunoption: analysis-only run that outputs configuration suggestions to improve performances (see the prerun mode in Core section). Combine with--jsonto print the prerun report on stdout (#8653)--timeout <seconds>option (-t): bound the whole run; on expiration the runner prints the container's last log lines, stops and removes the container (no orphan left behind, even on Windows where killing the CLI process does not stop the container), and exits with code 124 (#8665)docker pullwhen the requested version is a pinned release tag (vX.Y.Z, immutable) and the image is already available locally, removing a useless registry round-trip (#8614)SKIP_CLI_LINT_MODES=projectto keep local runs fast (#8646)--custom-flavor-setup: the generated README now has a License section stating the flavor is covered by AGPL-3.0, with a link to the MegaLinter source repository (#8682)--custom-flavor-setupnow generates a MegaLinter-clean repository, so a new custom flavor repo starts green instead of failing its own first MegaLinter run, fixes #8680.github/zizmor.ymlis generated to waive the one deliberate exception: the flavor builder tracks@mainso your image is always built by the builder matching the MegaLinter release you targetghcr.io/<owner>/<repo>:<tag>instead ofghcr.io/<owner>/<repo>/megalinter-custom-flavor:<tag>REPOSITORY_CHECKOV_ARGUMENTS: "--skip-check CKV_GHA_7"needed by the builder'sworkflow_dispatchinputsDev
ApiProviderclasses (megalinter/api_providers/: Grafana, Datadog, Elastic, New Relic), and dashboards are generated byDashboardBuilderclasses (.automation/dashboard_builders/) from a shared metrics contract intodocs/dashboards/—build_dashboards.py --checkfails when dashboards and contract drift apart, and the internalsync-dashboardsClaude skill maintains them (#8661)megalinter/removed_linters.pyas the single source of truth for every linter and descriptor removed since v6, used both at runtime and by the build system, and generate the Removed linters documentation page from it (#8606)supported_cli_lint_modesdescriptor property to declare which CLI lint modes (file,list_of_files,project) each linter supports, and generatesuccess/failuretests for every supported mode (#7150)ACTION_ZIZMOR,BASH_SHFMTandGO_REVIVEnow declare their real modes instead of falling back to thefile-only defaultcli_lint_mode_project_exclude_*descriptor properties (native exclusion flag templates, ignore-file arguments, generated workspace ignore files) consumed by genericLinterbase-class code: forwarding is pure descriptor data on 41 linters.wireit/test fixtures make the project-lint-mode success tests fail if forwarding regressesinstall.apk_buildfor apk packages needed only while pip/gem packages compile native extensions: they join a virtual apk package removed from the final image layers (#8621)llmpip extra excluded from standalonemegalinter-only-*images (~200 MB per standalone image)__pycache__layercpplintPython venv that was mistakenly declared in the CSS_STYLELINT descriptordocs/index.mdin sync by havingdocker_stats.pyalso update the hardcoded badge total in.automation/build.py(#8258).claude/skills/) asinternalsonpx skills add oxsecurity/megalinteronly offers the four MegaLinter agent skills from theskills/folder (#8627).claude/skills/(grafana-dashboarding,grafana-promql,kibana-dashboards,datadog-dashboards) to guide observability dashboard maintenance alongside thesync-dashboardsskill — New Relic publishes no official agent skill (only an MCP server) (#8667)/buildcontribution skill being accidentally gitignored by thebuild/packaging pattern, so it is now actually versioned (#8627)CI
Speed up PR jobs by handing the built Docker image over to consumer jobs through ghcr.io (
megalinter-devper-commit tags, pruned daily) instead of a workflow artifact +docker load(#8624)Build only the per-linter Docker images impacted by the changed files of a PR (descriptor edits, per-linter Dockerfiles, single-linter test fixtures); any change to shared code or unrecognized files keeps building the full matrix (#8624)
Remove duplicate self-lint and mega-linter-runner test runs on PR branches: the
pushtrigger is now restricted to main-line branches, thepull_requesttrigger already covers PR commits (~15 duplicated job-minutes saved per PR commit) (#8624)Speed up the test suite by skipping the
fileCLI lint mode tests for linters that also supportlist_of_files, sincelist_of_filesexercises the same code path more cheaply (#8624)CI jobs before/after, measured on the deploy-DEV workflow (average of 3 successful runs each, before = early July 2026, after = 2026-08-05):
TAP reporter golden-file tests move from the 120+ generated per-linter test classes (where most of them skipped) to a dedicated
tap_reporter_testclass running on a curated sample of linters (bash, css, protobuf, cloudformation); stale Super-Linter-era expected files (some of them unreachable by the test suite) have been removed (#8624)Make
test_api_outputresilient to remote server outages: probe several public echo endpoints, run the test with the ones that are up, retry with another server when a post fails, and skip the test when none of them is reachable, as a remote outage is not a MegaLinter issue (#8538)Fix per-linter Docker images being published single-arch: the BETA and RELEASE linter workflows split each linter into independent per-platform jobs that all pushed the same tag, so the last push won and overwrote the other architecture. They now push each platform by digest and a dedicated merge job assembles a proper multi-arch manifest list per linter (#8247)
Linter versions upgrades (50)
v9.6.0Compare Source
Breaking changes
cli_docker_image,cli_docker_image_versionandcli_docker_argsdescriptor properties (and the matching<LINTER>_DOCKER_IMAGE_VERSIONvariable) have been removed, and MegaLinter no longer mounts/var/run/docker.sock(inmega-linter-runner, the GitHub Actionaction.ymlfiles, and the Docker daemon previously bundled in flavor images). This closes the host-privilege escalation surface that the mounted Docker socket exposed. The only linter that used this mechanism wasSWIFT_SWIFTLINT, now installed natively (see below). (#8216)SWIFT_SWIFTLINTis now installed from the staticswiftlint-staticbinary instead of running theghcr.io/realm/swiftlintcontainer. It runs natively on the Alpine image with no Docker socket required. SourceKit-dependent rules are disabled in this build and reported to the console when encountered; pure-syntax style rules are unaffected. (#8216)@eslint/eslintrcshim removed from JavaScript/TypeScript/JSX/TSX Docker images (was only needed for legacyFlatCompat); MegaLinter's bundled test fixtures use native flat config. (#7869).eslintrc.*:JAVASCRIPT_ES,TYPESCRIPT_ES,JSX_ESLINT,TSX_ESLINTactivate when they find anyeslint.config.*or any deprecated.eslintrc.*/package.json#eslintConfig. In the legacy case the linter does not call ESLint at all — it emits a single hard failure with a migration message so the build stays red until the config is migrated to flat config. See the ESLint flat-config migration guide. To opt out, setDISABLE_LINTERSorDISABLEto exclude the affected linter/descriptor. (#7869)JSON_ESLINT_PLUGIN_JSONCremoved: upstream bug ota-meshi/eslint-plugin-jsonc#328 blocks ESLint v10 compatibility and will not be fixed. UseJSON_JSONLINT,JSON_PRETTIER, orJSON_V8Rfor JSON validation instead. (#7869)Core
common_linter_errors: declare known non-lint failure patterns (config issue, remote service down, missing credentials…) and the guidance message shown to users, directly in YAML — no custom Python class needed. (#7907)MARKDOWN_RUMDL: MARKDOWN_DEFAULT_STYLE=markdownlint (set MARKDOWN_DEFAULT_STYLE=rumdl to activate)), fixing #8017.New linters
Disabled linters
SALESFORCE_SFDX_SCANNER_APEX,SALESFORCE_SFDX_SCANNER_AURAandSALESFORCE_SFDX_SCANNER_LWC— disabled because sfdx-scanner 4.12.0 crashes on Node.js 22+ (TypeError: Cannot read properties of undefined (reading 'prototype'), caused by the removal ofSlowBuffer.prototype), which is shipped with Alpine 3.24. These linters were already deprecated; use theSALESFORCE_CODE_ANALYZER_APEX/SALESFORCE_CODE_ANALYZER_AURA/SALESFORCE_CODE_ANALYZER_LWCvariants instead (#8080).Deprecated linters
REPOSITORY_GITLEAKS— deprecated in favour ofREPOSITORY_BETTERLEAKS(same author, fully compatible config, significantly better detection). Will be removed in the next major release. Disable it by addingREPOSITORY_GITLEAKStoDISABLE_LINTERSin your.mega-linter.yml. (#8186)Removed linters
JSON_ESLINT_PLUGIN_JSONC— permanently broken by upstream bug (see Breaking changes) (#7869)Linters enhancements
REPOSITORY_CHECKOV: in pull-request mode, scan only the files modified in the PR instead of the whole repository (#7119)Fixes
REPOSITORY_BETTERLEAKS: default scan now runs in filesystem (dir) mode instead of auto-switching to git-history (git) mode when a git repository is detected. betterleaks does not read the global gitsafe.directoryconfig, so git mode failed withfatal: detected dubious ownership in repositoryin CI environments (e.g. GitHub Actions/github/workspace). Git-history mode is still used for the opt-inREPOSITORY_BETTERLEAKS_PR_COMMITS_SCANfeature. (#8186)REPOSITORY_BETTERLEAKS: added--verboseso detected findings (file, line and rule) are reported instead of only theleaks found: Nsummary, matching gitleaks behavior. Secret values stay redacted via--redact. (#8186)REPOSITORY_OSV_SCANNER: exit code 128 ("No package sources found") is now treated as a clean pass instead of a failure — osv-scanner returns this code when the repo contains no lockfiles/manifests/SBOMs, which is not a vulnerability finding (#7917).ansible-lintload-failure[not-found]error ongithub_conf/branch_protection_rules.jsoncaused by a race condition withcheckovrunning in parallel. Checkov's transient GitHub-conf directory is now written to a hidden path (.megalinter_github_conf) that project-mode linters skip, eliminating the conflict (#8092).python:3.14-alpine3.24base image (#8080).DeprecationWarning/ future breakage on Python 3.14 by no longer passingcountandflagsas positional arguments tore.sub(#8211).REPORT_OUTPUT_FOLDERfrom linting when configured as an absolute path inside the workspace (e.g./tmp/lint/megalinter-reports), fixing #7845.DOTNET_ROSLYNATOR) where a crafted.csprojfilename could break out ofdotnet restorearguments and execute arbitrary shell commands. The command is now invoked via argv list instead of a shell string. Reported by Francesco Sabiu. (#7857)IndexErrorwhen building the single-linter Docker image for a linter whose activation depends on a file (e.g.SPELL_VALErequires.vale.ini):python -m megalinter.run --linterversionnow bypasses activation filtering since the per-linter image is built for that linter unconditionally.make bootstrapappearing to hang because exported Make color variables re-evaluatedtputduring recursivemakeinvocations. (#8090)examplesin the Dart descriptor that were dropped from the generated documentation (#7913).Reporters
Doc
flavors-stats.jsonwith latest ghcr.io statspeter-evans/create-pull-requestto v8 in the documented workflow examples (#8089)mega-linter-runner
--user-map/--no-user-mapto control whether the MegaLinter container runs in non-root mode. On POSIX systems--user-mapuses the current host UID:GID; on other hosts it falls back to1000:1000. (#8120)--no-promptflag tomega-linter-runner --upgradefor non-interactive upgrades (#8093)mega-linter-runner/index.jsas executable in git (#8091)Dev
pr-monitor,security-analyst,version-bumper) and assign cost-effective models to mechanical tasks, to speed up and reduce the token cost of contributor workflows (#7906)./fix-issueClaude Code skill for end-to-end GitHub issue fixes (gather context, implement on a branch, open a PR, watch CI) (#7848).disabled: truein their descriptor. The matching images were already excluded from the build matrix (linters_matrix.json) and nevConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.