[dependabot]

Bumps super-linter/super-linter/slim from 8.7.0 to 9.0.0.

Release notes

Sourced from super-linter/super-linter/slim's releases.

v9.0.0

9.0.0 (2026-10-01)

⚠ BREAKING CHANGES

• update stylelint config file (super-linter/super-linter#7957), closes #7644
• rely on jscpd config file for gitignore (#7958)
• remove nbqa (#7697)

🚀 Features

• editorconfig-checker fix mode (#8129) (d23a77f)
• print version and revision on summary footer (#8131) (108536f), closes #7635
• publish linter versions file (#8136) (29e44ea), closes #7919
• tag slim images as version-slim (#8154) (958b6c0), closes #7598
• update stylelint config file (super-linter/super-linter#7957), closes #7644 (c358755)

🐛 Bugfixes

• codespell: skip root package lockfiles (#8094) (d3bc059)
• go_modules: scan module sub-packages with golangci-lint (#7884) (262ba6b)
• jscpd gitgnore option (#7951) (70dc6a6), closes #7949
• rely on jscpd config file for gitignore (#7958) (9fa9f40)
• tag local image instead of editing action.yml (#8166) (8802b51)

⬆️ Dependency updates

• all: add dependency cooldowns (#7990) (123c30b)
• bundler: bump rubocop (#8051) (8439a0b)
• bundler: bump rubocop (#8124) (c55d5ad)
• bundler: bump rubocop-minitest (#8005) (29e2320)
• bundler: bump the rubocop group across 1 directory with 3 updates (#7977) (fe04526)
• bundler: bump the rubocop group across 1 directory with 3 updates (#8085) (5d61d4a)
• docker: bump python (#8048) (6c757dc)
• docker: bump scalameta/scalafmt in the docker group (#8001) (07267f1)
• docker: bump terraform-linters/tflint in the docker group (#8006) (260eccc)
• docker: bump the docker group across 1 directory with 10 updates (#7997) (f89bfb7)
• docker: bump the docker group across 1 directory with 13 updates (#8091) (2066911)
• docker: bump the docker group across 1 directory with 5 updates (#8141) (0c4e34c)
• docker: bump the docker group across 1 directory with 6 updates (#8050) (7d5c0e4)
• docker: bump the docker group across 1 directory with 9 updates (#8118) (8a24b4b)
• java: bump com.puppycrawl.tools:checkstyle (#7969) (a363fc9)
• java: bump com.puppycrawl.tools:checkstyle (#7996) (b27705a)
• java: bump com.puppycrawl.tools:checkstyle (#8026) (541db66)
• java: bump com.puppycrawl.tools:checkstyle (#8075) (921de44)
• java: bump the java-gradle group across 2 directories with 2 updates (#8060) (7ff6f35)
• npm: bump @​stoplight/spectral-cli in /dependencies (#7973) (1779ac9)

... (truncated)

Changelog

Sourced from super-linter/super-linter/slim's changelog.

Changelog

9.0.0 (2026-10-01)

⚠ BREAKING CHANGES

• update stylelint config file (super-linter/super-linter#7957), closes #7644
• rely on jscpd config file for gitignore (#7958)
• remove nbqa (#7697)

🚀 Features

• editorconfig-checker fix mode (#8129) (d23a77f)
• print version and revision on summary footer (#8131) (108536f), closes #7635
• publish linter versions file (#8136) (29e44ea), closes #7919
• tag slim images as version-slim (#8154) (958b6c0), closes #7598
• update stylelint config file (super-linter/super-linter#7957), closes #7644 (c358755)

🐛 Bugfixes

• codespell: skip root package lockfiles (#8094) (d3bc059)
• go_modules: scan module sub-packages with golangci-lint (#7884) (262ba6b)
• jscpd gitgnore option (#7951) (70dc6a6), closes #7949
• rely on jscpd config file for gitignore (#7958) (9fa9f40)
• tag local image instead of editing action.yml (#8166) (8802b51)

⬆️ Dependency updates

• all: add dependency cooldowns (#7990) (123c30b)
• bundler: bump rubocop (#8051) (8439a0b)
• bundler: bump rubocop (#8124) (c55d5ad)
• bundler: bump rubocop-minitest (#8005) (29e2320)
• bundler: bump the rubocop group across 1 directory with 3 updates (#7977) (fe04526)
• bundler: bump the rubocop group across 1 directory with 3 updates (#8085) (5d61d4a)
• docker: bump python (#8048) (6c757dc)
• docker: bump scalameta/scalafmt in the docker group (#8001) (07267f1)
• docker: bump terraform-linters/tflint in the docker group (#8006) (260eccc)
• docker: bump the docker group across 1 directory with 10 updates (#7997) (f89bfb7)
• docker: bump the docker group across 1 directory with 13 updates (#8091) (2066911)
• docker: bump the docker group across 1 directory with 5 updates (#8141) (0c4e34c)
• docker: bump the docker group across 1 directory with 6 updates (#8050) (7d5c0e4)
• docker: bump the docker group across 1 directory with 9 updates (#8118) (8a24b4b)
• java: bump com.puppycrawl.tools:checkstyle (#7969) (a363fc9)
• java: bump com.puppycrawl.tools:checkstyle (#7996) (b27705a)
• java: bump com.puppycrawl.tools:checkstyle (#8026) (541db66)
• java: bump com.puppycrawl.tools:checkstyle (#8075) (921de44)
• java: bump the java-gradle group across 2 directories with 2 updates (#8060) (7ff6f35)

... (truncated)

Commits

• 2da1369 chore(main): release 9.0.0 (#7950)
• 8802b51 fix: tag local image instead of editing action.yml (#8166)
• cd17c95 chore: scan pip requirements files with trivy (#8153)
• 958b6c0 feat: tag slim images as version-slim (#8154)
• 8afae23 build: upgrade to Alpine 3.24, PHP 8.5, Clang 22 (#8151)
• c648681 ci: publish release after uploading assets (#8150)
• 1167157 deps(npm): bump qs (#8149)
• 568db29 deps(python): bump the pip group across 1 directory with 6 updates (#8127)
• 05bfa30 deps(npm): bump js-yaml (#8147)
• f8ac9fb chore: group yq updates (#8148)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

AI review: approve for 6c1adfa

Dependabot bump of super-linter/slim from v8.7.0 to v9.0.0 in .github/workflows/linter.yml. The action is still pinned to a full commit SHA (2da1369, the 9.0.0 release commit named in the PR's commit list). I tried to confirm that the v9.0.0 tag points to this SHA through the GitHub API, but the command needed approval, so that check didn't run. None of the three breaking changes affect this repo: JSCPD is already turned off (VALIDATE_JSCPD: false), and the repo has no stylelint config, CSS or Jupyter notebooks (nbqa was removed). The workflow's permissions and env settings are unchanged. Change-management note: this is a major version bump of the CI linter. v9.0.0 also upgrades the image to Alpine 3.24, PHP 8.5 and Clang 22, and updates bundled linters such as rubocop and checkstyle. New lint findings could show up in CI, but none of this affects runtime code. Nothing blocks the merge.

Review run

[github-actions]

AI review: approve for f78ccd1

This Dependabot PR changes one line in .github/workflows/linter.yml. It moves super-linter/slim from v8.7.0 to v9.0.0, and the action stays pinned to a full commit SHA (2da1369, the release commit listed in the PR's changelog). I couldn't confirm that the SHA matches the v9.0.0 tag because the tool permissions blocked the gh api lookup.

I checked the three v9 breaking changes against this repo, and none of them affect it:

• stylelint config change: the repo has no stylelint config.
• jscpd gitignore handling: VALIDATE_JSCPD is already false.
• nbqa removal: the repo has no notebooks.

The workflow's permissions, env, and token handling are unchanged. The lint job on this PR will show whether the new linter versions flag anything. I found no blocking issues, so I didn't post any inline comments.

Review run