Skip to content

chore(deps): update ghcr.io/oxsecurity/megalinter-python docker tag to v10 - #46

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ghcr.io-oxsecurity-megalinter-python-10.x
Open

chore(deps): update ghcr.io/oxsecurity/megalinter-python docker tag to v10#46
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/ghcr.io-oxsecurity-megalinter-python-10.x

Conversation

@renovate

@renovate renovate Bot commented Aug 8, 2026 •
edited
Loading

Copy link
Copy Markdown

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change
ghcr.io/oxsecurity/megalinter-python (source) major v9.0.1 → v10.1.0

Release Notes

oxsecurity/megalinter (ghcr.io/oxsecurity/megalinter-python)

v10.1.0

Compare Source

  • Core

    • MegaLinter now prints a crash traceback when it is killed by a fatal signal (SIGSEGV, SIGBUS…), instead of exiting silently with no clue about what happened (#​8779)
    • The LLM Advisor supports a new provider, OrcaRouter, an OpenAI-compatible AI gateway: set LLM_PROVIDER: orcarouter and ORCAROUTER_API_KEY in your environment to get fix suggestions routed through OrcaRouter (see the OrcaRouter provider page) (#​8826)

  • New linters

    • biome, one fast toolchain linting, formatting and sorting imports of JavaScript, TypeScript, JSX, TSX, JSON, CSS and GraphQL files, available as JAVASCRIPT_BIOME, TYPESCRIPT_BIOME, JSX_BIOME, TSX_BIOME, JSON_BIOME, CSS_BIOME and GRAPHQL_BIOME (#​8706)
      • Activated only when a biome.json or biome.jsonc configuration file is found in the repository
      • Supports APPLY_FIXES (safe fixes with --write) and native SARIF output
      • EXCLUDED_DIRECTORIES are forwarded in project lint mode through a generated configuration extending the workspace one
    • ApexGuru, the AI-driven engine of Salesforce Code Analyzer, available as SALESFORCE_CODE_ANALYZER_APEXGURU (#​8820)
      • Detects SOQL inefficiencies, critical anti-patterns and scalability hotspots in your .cls and .trigger files, with line-level highlights, severity ratings and suggested fixes
      • The analysis runs in a connected Salesforce org, not locally: store the auth url of the target org in a CI secret named SFDX_AUTH_URL, and MegaLinter logs in to that org before the scan
      • The scan is sent to that org explicitly, so a .sfdx/sfdx-config.json left at the root of the repository, usually naming a long gone scratch org, can not hijack it
      • Inactive by default: it activates only when SFDX_AUTH_URL is defined, so nothing changes for existing Salesforce projects
      • Requires ApexGuru to be enabled on the org: it needs Scale Center, and is available for Unlimited Edition production orgs, full copy sandboxes, Signature orgs and Scale Test customers
      • A run where the engine could not analyze anything is reported as an error rather than a silent success, together with the reason and how to fix it
      • Supports native SARIF output, like the other Code Analyzer engines
    • tofu fmt, the built-in formatter of OpenTofu (the MPL-2.0 licensed fork of Terraform), available as TERRAFORM_TOFU_FMT (#​8729)
      • Analyzes .tofu files only, the OpenTofu specific extension, so it never doubles up with TERRAFORM_TERRAFORM_FMT which keeps .tf
      • To format your .tf files with OpenTofu instead, set TERRAFORM_TOFU_FMT_FILE_EXTENSIONS: [".tofu", ".tf", ".tfvars"] and DISABLE_LINTERS: [TERRAFORM_TERRAFORM_FMT]
      • Supports APPLY_FIXES to rewrite files in the canonical OpenTofu style
    • tofu validate, the built-in validator of OpenTofu, available as TERRAFORM_TOFU_VALIDATE (#​8793)
      • Reports what formatters and rule-based linters can not see: unsupported or missing arguments, wrong attribute types, references to undeclared variables, locals or outputs, and broken module input contracts
      • Analyzes .tofu files only, like TERRAFORM_TOFU_FMT, leaving .tf free for a future terraform validate linter. To validate .tf files, set TERRAFORM_TOFU_VALIDATE_FILE_EXTENSIONS: [".tofu", ".tf"]
      • Validates one whole module per directory, so every .tf and .tofu file of a selected directory is parsed and can produce diagnostics
      • Every directory is initialized with tofu init -backend=false beforehand, so no state is read, no state lock is taken and no cloud credentials are needed
      • Set TERRAFORM_TOFU_VALIDATE_INIT_ARGUMENTS to change those initialization arguments, for example adding -lockfile=readonly to have an out-of-sync .terraform.lock.hcl reported as an error instead of being updated

  • Disabled linters

    • COFFEE_COFFEELINT is disabled: CoffeeScript tooling is discontinued, and coffeelint can not receive EXCLUDED_DIRECTORIES in project lint mode (it has no exclusion option and reads .coffeelintignore only from its working directory). The linter will be removed in a future version (#​8720)
    • GRAPHQL_GRAPHQL_SCHEMA_LINTER is disabled: graphql-schema-linter is unmaintained, with no release or commit since May 2022, and its peer dependency range pins graphql to ^15 || ^16, which held the whole GraphQL install back from graphql v17. Use GRAPHQL_BIOME to lint your GraphQL files. The linter will be removed in a future version (#​8894)

  • Re-enabled linters

    • spectral is back as API_SPECTRAL, together with the API descriptor, to lint your OpenAPI, AsyncAPI and Arazzo specifications (#​8717)
      • It was removed in v10.0.0 because it crashed at startup on every run: the cause has been found and fixed
      • Nothing to change in your configuration: API_SPECTRAL works again in ENABLE_LINTERS / DISABLE_LINTERS, and the default ruleset file is still .spectral.yaml

  • Linters enhancements

    • TERRAFORM_TFLINT now documents the tflint native GITHUB_TOKEN_github_com variable to authenticate plugin downloads on github.com, which is the recommended way to fix tflint --init failures when your GITHUB_TOKEN targets a GitHub Enterprise instance (#​8795)
      • Set your github.com token in GITHUB_TOKEN_github_com, then list it in TERRAFORM_TFLINT_UNSECURED_ENV_VARIABLES: tflint gives it priority over GITHUB_TOKEN, which other linters and reporters keep using
      • PAT_GITHUB_COM is deprecated: it still works and now logs a warning, and will be removed in a future major release
    • CLOJURE_CLJSTYLE now forwards EXCLUDED_DIRECTORIES through its native repeatable --ignore argument, instead of a temporary .cljstyle written in your repository. Exclusions are now also applied when your repository already has a .cljstyle config, whose own ignore patterns are preserved (#​8720)
    • SQL_SQLFLUFF does not receive EXCLUDED_DIRECTORIES in project lint mode anymore: sqlfluff reads path exclusions only from a .sqlfluffignore, .sqlfluff or pyproject.toml located inside the analyzed sources, where MegaLinter used to write a temporary file. List the directories to skip in your own .sqlfluffignore, or keep the default list_of_files lint mode where MegaLinter filters the files itself (#​8720)
    • SARIF output is now available for 13 more linters: zizmor, bicep_linter, cppcheck, clj-kondo, roslynator, htmlhint, protolint, sqlfluff, swiftlint, osv-scanner, trufflehog, jscpd and lintr. Enable it the same way as any other SARIF-capable linter, with SARIF_REPORTER: true (optionally scoped with SARIF_REPORTER_LINTERS) (#​8715)
      • The 4 Salesforce Code Analyzer engines (SALESFORCE_CODE_ANALYZER_APEX, _AURA, _LWC, _FLOW) also gained SARIF output: their report switches from CSV to SARIF automatically when SARIF reporting is requested
      • csharp_roslynator is bumped from 0.12.0 to 0.13.0, the first release including its SARIF output support
      • clj-kondo's upstream SARIF output currently nests the region property one level too deep, which may affect line/column display in strict SARIF consumers (clj-kondo/clj-kondo#2345)
    • Prettier linters (JSON_PRETTIER, YAML_PRETTIER, JAVASCRIPT_PRETTIER, TYPESCRIPT_PRETTIER) now tell you how to install a Prettier plugin when one declared in your .prettierrc fails to load with Cannot find package ... imported from noop.js (#​6980)
      • Prettier v3 resolves plugins with a native ESM import() from the workspace and ignores NODE_PATH, so plugins installed with the default cwd: root land in /node-deps where Prettier never looks for them
      • The guidance surfaced in the log is to install them through <LINTER_KEY>_PRE_COMMANDS with cwd: workspace, which keeps plain package names in .prettierrc so the very same config still works when you run Prettier locally without MegaLinter

  • Fixes

    • MegaLinter does not crash anymore with This module only works with the 'fork' start method right after Processing linters on [N] parallel cores, which made every v10.0.0 run fail unless PARALLEL: false was set (#​8808)
      • The PARALLEL: false workaround is not needed anymore, on the main image as well as on custom flavors
      • Messages logged by linters running in parallel are back in the console and in megalinter.log, including the extra output of LOG_LEVEL: DEBUG
    • PAT_GITHUB_COM is now hidden from the linters commands, like every other credential variable (#​8795)
      • The GitHub Personal Access Token used by TERRAFORM_TFLINT was sent in cleartext to every linter, as it matched no pattern of SECURED_ENV_VARIABLES_DEFAULT
      • The default list now hides any variable named PAT, PAT_* or *_PAT (PAT_GITHUB_COM, AZURE_PAT...), and tflint --init still receives the real token
      • Add such a variable to <LINTER_KEY>_UNSECURED_ENV_VARIABLES if one of your linters really needs to read it
    • Fixed random Segmentation fault crashes of MegaLinter itself, which stopped the whole run with no error message (#​8733). MegaLinter threads now get a full-size stack instead of the 128 KiB default of the Alpine images
    • Fixed leaked git processes when APPLY_FIXES is active: one was left behind by every fixer linter, which could exhaust the available file descriptors on long runs (#​8779)
    • Fixed random crashes of project-mode linters (REPOSITORY_TRIVY, REPOSITORY_GRYPE, REPOSITORY_SYFT…) caused by MegaLinter writing temporary ignore files inside the analyzed sources: a file appearing then disappearing while another linter walked the repository aborted its scan (walk dir error: ... no such file or directory). MegaLinter now writes only in REPORT_OUTPUT_FOLDER, never in your sources (#​8720)
    • EXCLUDED_DIRECTORIES and ADDITIONAL_EXCLUDED_DIRECTORIES are now forwarded to project lint mode linters even when the directory is nested, not only when it sits at the root of your repository (#​8806)
      • A directory like infrastructure/cdk.out was previously scanned anyway, for example by REPOSITORY_BETTERLEAKS, which reported findings in generated files
      • Excluded entries are now looked up the same way MegaLinter filters files: by directory name, at any nesting level
      • Nothing changes when the excluded directory does not exist in your repository: it is still not sent to the linters
      • This also covers PYTHON_BANDIT, YAML_V8R, CSHARP_DOTNET_FORMAT, VBDOTNET_DOTNET_FORMAT and REPOSITORY_LS_LINT, whose exclusions are anchored on the repository root: they now receive the path of each nested directory found
      • A ^-anchored FILTER_REGEX_EXCLUDE keeps excluding root-level directories only: ^docs/ does not silence findings in packages/a/docs anymore
      • Looking up the excluded directories never descends into an excluded directory, and costs no extra repository scan: it reuses the one MegaLinter already does to list your files, and falls back to a single scan when only changed files are analyzed
    • REPOSITORY_TRUFFLEHOG does not silently skip findings anymore in a directory whose name merely ends with an excluded one: with dist excluded, secrets in my-dist/ were not reported (#​8811)
    • REPORT_OUTPUT_FOLDER is now always excluded from what linters analyze, even when you override EXCLUDED_DIRECTORIES, and even when the folder does not exist yet when a linter starts (#​8720)
    • The API reporter variables (API_REPORTER, API_REPORTER_URL…) are not flagged as deprecated anymore in the configuration JSON schema: they were collateral damage of the removal of the API descriptor in v10.0.0, and IDEs displayed them as obsolete (#​8718)
    • REPOSITORY_BETTERLEAKS does not crash the whole MegaLinter run anymore when REPOSITORY_BETTERLEAKS_PR_COMMITS_SCAN: true is used on Azure Pipelines with the default shallow checkout (#​8732)
      • The target branch commit is now searched across several reference spellings, so a branch available only locally is found too
      • When the Pull Request commit range can not be determined — on any platform — betterleaks now logs a warning explaining how to fix your checkout and scans the whole repository, instead of aborting the run
      • The Pull Request scan setup documentation lost when gitleaks was replaced by betterleaks is restored on the betterleaks page: checkout depth for each platform, Azure Pipelines variables to forward to the container, and how to compute the SHAs yourself (#​8731)
    • The REPOSITORY_BETTERLEAKS Pull Request scan variables (REPOSITORY_BETTERLEAKS_PR_COMMITS_SCAN, REPOSITORY_BETTERLEAKS_PR_SOURCE_SHA, REPOSITORY_BETTERLEAKS_PR_TARGET_SHA) are now declared in the configuration JSON schema, so your IDE stops flagging them as unknown keys in .mega-linter.yml (#​8805)
    • Bitbucket Pipelines is now recognized as a Pull Request context: PULL_REQUEST optimizations that were silently skipped there are applied again (#​8780)
      • REPOSITORY_CHECKOV and REPOSITORY_BETTERLEAKS only analyze the Pull Request changes when asked to
      • Set BITBUCKET_PR_ID in your pipeline (Bitbucket provides it on Pull Request builds) to benefit from it
    • A run where all linters pass does not exit with an error anymore when MegaLinter can not list the files updated by the linters (#​8649)
      • Happens on a read-only workspace whose repository uses git-lfs: the required LFS filter has nowhere to write its temporary files, so the git diff used to detect updated files exits 128
      • MegaLinter now logs a warning naming the workspace and the failed command, reports no updated source file, and completes the run. The UPDATED_SOURCES_REPORTER: false workaround is not needed anymore
    • REPOSITORY_CHECKOV does not fail anymore with argument -f/--file: expected at least one argument in a Pull Request where no file has been updated (#​8802)
      • With VALIDATE_ALL_CODEBASE: false, checkov is now skipped when the Pull Request contains no updated file, instead of scanning the whole project or building an invalid command
      • Any linter using the list_of_files lint mode with no file to analyze is skipped the same way, instead of being called with an empty list of files

  • Reporters

    • Linters reporting in SARIF format no longer show No output available in Pull Request comments and summaries: the details section now names the SARIF report to open and links the MegaLinter artifacts (#​8730)
      • Applies to the GitHub, GitLab, Azure and Bitbucket comment reporters and to the markdown summary
      • The link points where the reporter already links its detailed reports, so it follows REPORTERS_ACTION_RUN_URL when you set it

  • Doc

    • Comments are back at the bottom of every documentation page, powered by Giscus and backed by MegaLinter GitHub Discussions: ask a question or share a tip right from the page it applies to. The previous utteranc.es widget had silently stopped rendering
    • megalinter.io gets a dark mode: use the toggle in the header, or let it follow your system preference (#​8848)
    • Refreshed look and feel, aligned with the OX Security brand: navy, indigo and lime replace the previous purple palette, and the Satoshi typeface is now actually loaded (it was silently falling back to the default font) (#​8848)
    • New Docker pulls per month graph, showing the growth of MegaLinter adoption since October 2020, displayed in the README and on the Flavors statistics page (#​8698)
    • Refreshed the MegaLinter references in linters documentation (linter_megalinter_ref_url): verified all existing links, updated moved pages (ktlint, robocop, csharpier, zizmor, ruff, proselint), and opened 47 suggestion PRs on linters repositories that did not mention MegaLinter yet (#​8701, #​8777)
    • New Security linting with ESLint section in the JAVASCRIPT_ES and TYPESCRIPT_ES documentation: states that no security plugin is bundled, shows the PRE_COMMANDS recipe and the createRequire reference needed under flat config, and lists commonly used plugins. Closes the gap left by the "Security Issues (with security plugins)" line, which previously named no plugin and had no working example (#​8712)

  • mega-linter-runner

    • Node.js 22 or higher is now required (was 20) (#​8710)
    • 8 npm dependencies removed (chalk, fs-extra, which, uuid, find-package-json, simple-git, mem-fs, assert), replaced by Node.js built-in modules: faster npx mega-linter-runner startup and a smaller supply-chain attack surface (#​8710)
    • Fixed mega-linter-runner --version displaying error instead of the version when the npm_package_version environment variable is not set (#​8710)

  • Agent Skills

    • The MegaLinter agent plugin now ships its three sub-agents to GitHub Copilot clients (VS Code, Copilot CLI, the Copilot app) (#​8821)
      • Agent Plugins 1.0 standardizes skills but not sub-agents, so Copilot loads them from com.github.copilot/agents: the plugin now carries them there, generated from the Claude Code definitions so the two can not drift
      • megalinter-setup installs them correctly outside the plugin too: on Copilot the file name must end with .agent.md in .github/agents/, and the model: haiku override must be dropped
      • The skills stop guessing how they were installed from the skill naming, which only some platforms namespace: the install mode is now read from the filesystem, and you are asked when it stays ambiguous
      • The licence frontmatter key of the four skills is corrected to license, the spelling agents actually read
    • megalinter-check now handles the commit MegaLinter pushes itself when the repository uses APPLY_FIXES_MODE: commit (#​8713)
      • CI providers ignore pushes made with the CI token, so the branch used to stay stuck on the stale checks of the run that produced the fixes
      • The commit is amended with a 🤖 prefix and re-pushed with --force-with-lease, which re-triggers the checks (you are asked first on the default branch)
      • Nothing is amended when another commit landed after the auto-fix one, when it was already amended, or when you have local commits left to push — a normal push already re-triggers the checks in those cases
    • megalinter-setup can now set up a custom flavor repository on request, from creating the repository to publishing and maintaining the image (#​8713)
      • It first looks for a custom flavor you already own or administer, to reuse or extend it instead of maintaining a second one
    • megalinter-setup in upgrade mode now also updates the installed skills and sub-agents (npx skills update), so the guidance you run matches the MegaLinter version you just upgraded to (#​8713)
    • The MegaLinter skills are now installable as an agent plugin, so one command brings the four skills and the three sub-agents at once, and keeps them updated (#​8791)
      • Claude Code: /plugin marketplace add oxsecurity/megalinter then /plugin install megalinter@megalinter
      • Cursor, GitHub Copilot, Codex, Gemini CLI and Antigravity each have their own install command, listed on the Coding Agents (Plugins) page
      • The sub-agents ship with the plugin on Claude Code and Cursor; elsewhere the skills install alone and run inline
      • npx skills add oxsecurity/megalinter/skills keeps working for every other coding agent

  • Dev

    • REPOSITORY_TRUFFLEHOG tests no longer depend on a third-party endpoint. The good and bad fixtures differed only by a basic-auth credential that trufflehog validated over the network, so the whole test suite went red whenever the runner could not reach that site (#​8848)
      • The fixtures now differ by what is detected, the good ones carrying no secret material at all, and the tests drop --only-verified, which stays the production default
      • The .wireit poison fixture gains a private key, so the excluded-directories forwarding guard actually fires instead of being vacuous
    • The documentation site is now built with Zensical, the successor of Material for MkDocs, replacing mkdocs, mkdocs-material and mkdocs-glightbox (#​8848)
      • mkdocs.yml stays the configuration file, so .automation/build.py nav generation is unchanged; hatch run docs:serve and hatch run docs:build now call zensical
      • Versioned deploys still use mike, from the Zensical-compatible fork squidfunk/mike pinned to a commit SHA and watched by a new Renovate custom manager
      • The Check MkDocs generation workflow becomes Check documentation generation (test-docs.yml) and also runs on docs/** changes
      • Three long-dead pieces of documentation configuration were found and removed or fixed on the way: the disqus template block (Material has no such block, so comments never rendered), the Satoshi, sans-serif theme font (one quoted family name that matched nothing), and the h1[content~=Home] CSS rule (h1 has no content attribute)
    • Parallel linters logging does not depend on the multiprocessing start method anymore: init_worker() installs a QueueHandler on the worker root logger, built from the queue and the level passed by process_linters_parallel(), instead of relying on the handlers a forked worker inherits (#​8808)
      • Python 3.14 changed the default start method on Linux from fork to forkserver: workers then started with no handler and the default WARNING level, so their records were lost or written directly to their own stdout, bypassing the queue listener and the log file
      • The AssertionError crash itself came from multiprocessing_logging.install_mp_handler(), which asserts the fork start method; the dependency was already dropped in this version
      • New parallel_logging_test.py runs a worker with every start method available on the platform and checks that its records reach the main process handlers
    • replacement_env_vars is now declared in the MegaLinter configuration JSON schema (command_info definition, with its var_src / var_dest items) and documented in the Pre-commands page: it was implemented but validated by nothing, as additionalProperties is unset (#​8812)
      • pre_post_factory.build_command_env() extracts the child environment build from run_command(), and resolves var_src from the raw configuration instead of the already secured environment, so a secured source variable is not copied as HIDDEN_BY_MEGALINTER
    • Crash diagnostics: megalinter.run.enable_crash_diagnostics() enables faulthandler and raises the thread stack size to 8 MiB (the glibc default) before any thread is started, and worker processes enable faulthandler too. musl gives threads a 128 KiB stack and CPython below 3.14.7 miscomputed its stack guard there (cpython#148260), so C-level recursion in a thread - such as pickling the linter object graph in the multiprocessing.Pool handler threads, which reaches the whole Megalinter instance through Linter.master - crashed the process with SIGSEGV instead of raising RecursionError (#​8779)
      • Verified on python:3.14.6-alpine: pickling a deeply nested object in a thread exits with signal 11, and either raising the thread stack size or moving to python:3.14.7-alpine turns it into a plain RecursionError
      • faulthandler can not report a stack overflow itself (the handler has no stack left to run on), which is why the crash in #​8733 left no output at all; it does report every other fatal signal
    • The Docker images assert a Python 3.14.7 floor at build time, the first release carrying the CPython musl thread stack fixes. The python:3.14-alpine3.24 tag stays floating because renovate.json5 scopes the dockerfile manager away from the main Dockerfile, whose FROM lines are generated from descriptors (#​8779)
    • Retired the cli_lint_mode_project_exclude_workspace_file_name descriptor property and the write_workspace_generated_file() helper, and removed the property from the descriptor JSON schema so a future descriptor can not silently reintroduce a write inside the analyzed sources. Exclusion forwarding now offers three mechanisms only: native CLI flag, generated ignore file in the report folder, generated config via manage_excluded_directories_config() (#​8720)
    • Deprecation flags of removed linters are now reversible in the configuration JSON schema: build.py clears the deprecated flag and the (deprecated) title prefix of variables whose linter or descriptor is back, instead of only ever adding them (#​8718)
    • New megalinter/ci_providers/ package, mirroring the api_providers pattern: CiProvider base class plus CiProviderAzurePipelines, CiProviderGithubActions and CiProviderGitlab, exposing get_pr_commit_shas() and a platform specific get_pr_commit_shas_hint() (#​8780)
      • ci_providers.get_pr_ci_provider() returns the provider matching the current Pull Request context, falling back to the neutral base provider so callers never handle a missing provider
      • The Azure Pipelines and GitHub Pull Request SHA lookups moved out of BetterleaksLinter, which keeps only the orchestration, and are now covered by ci_providers_test.py outside Docker
    • CI platform knowledge is concentrated in megalinter/ci_providers/ instead of being spread across utils, utils_reporter, MegaLinter and the reporters (#​8780)
      • reporters/jenkins_ci_vars.py becomes ci_providers/CiProviderJenkins.py: it was never a reporter, it is called from Megalinter.__init__
      • New CiProviderBitbucket, and every provider implements is_current(), so get_ci_provider() resolves the platform running the build
      • CiProvider exposes get_repo_name(), get_branch_name(), get_job_url(), log_section_start/end(), set_output(), publish_job_summary() and markdown_supports_html_details
      • utils.get_git_context_info() and utils_reporter.log_section_start/end() delegate to the provider instead of their platform if/elif chains, and the GitHub run URL (built in 3 places), the Bitbucket step URL (2 places) and the Azure BUILD_BUILDID/BUILD_BUILD_ID fallback are deduplicated
      • utils.is_ci() and utils.is_pr() were missing Bitbucket Pipelines; new utils.is_bitbucket_pr()
      • The comment reporters (GithubCommentReporter, GitlabCommentReporter, AzureCommentReporter, BitbucketCommentReporter) and GithubStatusReporter now get their repository, Pull Request number, tokens, API urls and headers from their provider instead of reading platform variables themselves; they keep only the comment transport and rendering
      • Each reporter instantiates its own platform provider directly rather than calling get_ci_provider(): under Jenkins the running platform is Jenkins, which maps its variables onto the other platforms', so a factory lookup would disable the comment reporters there
      • CiProviderAzurePipelines owns the repository id resolution (SYSTEM_PULLREQUEST_SOURCEREPOSITORYURI parsing, API lookup, BUILD_REPOSITORY_ID fallback) and build_git_api_url(); CiProviderGitlab owns the merge request iid resolution and the python-gitlab auth options
      • GitHub keeps get_auth_token() (GITHUB_TOKEN) and get_user_auth_token() (PAT) separate on purpose: commit statuses need the statuses:write scope that the documented fine-grained PAT does not carry
    • spectral is installed in its own node_modules tree (/node-deps-spectral) instead of the shared /node-deps one, which is what made it crash: @prantlf/jsonlint pins ajv to exactly 8.17.1 and so owns the hoisted root copy, while @stoplight/spectral-core requires ajv >= 8.18.0 and gets a nested one, so its hoisted ajv-errors bound to the other ajv instance and ajv generated invalid JavaScript (SyntaxError: Unexpected token ':' at new Function). Any npm linter sharing the tree with an exact-pinned transitive dependency can hit the same trap (#​8718)
    • 6 Python dependencies removed from the MegaLinter runtime, replaced by standard library equivalents: commentjson, terminaltables and multiprocessing_logging (unmaintained), plus termcolor, regex and the obsolete importlib-metadata backport (#​8710)
    • Shared linter definitions: linter entries duplicated across several descriptors (eslint, prettier, v8r, dotnet-format, cpplint, cppcheck, clang-format) are now factorized in megalinter/descriptors/shared/*.megalinter-linter.yml files, referenced from descriptors with the new linter-level extends property (shallow merge, descriptor entry properties override the shared ones) (#​8705)
    • Docker pulls monthly chart: the auto-update workflow now regenerates docs/assets/images/docker-pulls-monthly.svg (new pulls per month since October 2020, all images and registries), via the new .automation/docker_pulls_chart.py called by build.py after the pull counters update (#​8698)
      • Historical monthly points are frozen in .automation/generated/docker-pulls-monthly.json (built once from the tracked stats plus a Web Archive reconstruction of the collection gaps); the script only appends newly completed months computed from flavors-stats.json
    • Docker pull counters now also track the standalone megalinter-only-* images: their download counts are stored in flavors-stats.json and included in the README badge total (#​8698)
    • New descriptor activation_rules type variable_is_set, activating a linter as soon as a variable holds a value. The existing variable type can only compare a variable to a fixed expected_value, which can not express "a credential is present" - the condition SALESFORCE_CODE_ANALYZER_APEXGURU needs on SFDX_AUTH_URL (#​8820)
      • Linter tests gated on such a variable skip themselves when it is missing, instead of failing: LinterTestRoot.skip_if_required_variables_missing() guards the per-lint-mode and SARIF tests, while the version and help tests keep running since they need no credential
    • The release build stages newly generated documentation pages too: build.py staged only already-tracked files (git add -u), so a page created for the first time was left out of the release commit and 404ed on megalinter.io — as docs/licenses/rumdl.md and docs/licenses/zizmor.md still do since v10.0.0

  • CI

    • The generated linter guides in skills/megalinter-fix/linters/ are excluded from the markdown linters: their error-format regexes end with a significant space that markdownlint --fix strips, which corrupted the documented regex and left the working tree dirty, failing the auto-fix commit step on every pull request (#​8848)
    • Supply-chain hardening of dependency updates: Renovate (minimumReleaseAge) and Dependabot (cooldown) now wait until a release is at least 7 days old before proposing an upgrade, so compromised releases can be caught by the community first. Security fixes are not delayed and still open immediately (#​8710)
    • New Check agent plugins manifests workflow validating the agent plugin manifests on every change to them or to skills/: .automation/validate_agent_plugins.py checks the root plugin.json against the published Agent Plugins 1.0 schema and keeps the per-vendor manifests consistent with it, then claude plugin validate ./ --strict checks the Claude Code marketplace and plugin manifests (#​8791)
    • The auto-update workflow patch-bumps the agent plugin version when it regenerates the skills: the plugin follows its own release train, since its fix guides change far more often than MegaLinter is released. plugin.json is the single source of truth, mirrored into the per-vendor manifests by .automation/agent_plugin_manifests.py (called by build.py) (#​8791)
    • The test workflows forward the SFDX_AUTH_URL repository secret to the test container, so the SALESFORCE_CODE_ANALYZER_APEXGURU lint tests can reach a connected org. The secret is not exposed on pull requests from forked repositories, where those tests skip themselves (#​8820)
    • The Auto-Update Linters workflow is fixed: entrypoint.sh still installed the MkDocs documentation stack, so build.sh aborted with zensical: command not found since the Zensical migration and no linter version update pull request could be created (#​8901)

  • Linter versions upgrades (44)

v10.0.0

Compare Source

  • Breaking changes

    • Removed 14 deprecated or long-disabled linters, and the API, MAKEFILE and PUPPET descriptors, which had no other linter left. MegaLinter does not provide Makefile and Puppet linting anymore. See the new Removed linters page for the full list and suggested replacements. (#​8606)
    • REPOSITORY_GITLEAKS has been removed: migrate to REPOSITORY_BETTERLEAKS, which reads your existing .gitleaks.toml and .gitleaksignore files unchanged. (#​8606)
    • Existing .mega-linter.yml files keep working: configuration variables of removed linters are simply ignored (a single notice lists any found in your configuration) and remain valid in the JSON schema. (#​8606)
    • API Reporter payload v2 replaces the v1 payload: metric series are renamed (linter_run_* becomes megalinter_linter_run_*, plus new run-level megalinter_run_* series), and the old docs/grafana dashboards are superseded. Re-provision the new dashboards with npx mega-linter-runner --upload-dashboards grafana — see the migration notes. Legacy NOTIF_API_* variables remain supported as aliases. (#​8661)
    • Linters now time out after 5 minutes by default (LINTER_TIMEOUT_SECONDS: 300): a linter exceeding it is killed and reported as an error (exit code 124) instead of running (or hanging) unbounded. If some of your linters legitimately run longer, raise the limit globally with LINTER_TIMEOUT_SECONDS, per linter with <LINTER_KEY>_TIMEOUT_SECONDS, or restore the previous unbounded behavior with value 0. (#​8665)

  • Core

    • Coding agents integration: MegaLinter can now be driven by Claude Code, Cursor CLI, GitHub Copilot CLI, Codex and many other coding agents — see the new Coding Agents documentation page (#​8614)

      • Install the MegaLinter agent skills with npx skills add oxsecurity/megalinter
      • Then ask your agent to set up MegaLinter (megalinter-setup), watch CI or local runs (megalinter-check) or fix lint errors (megalinter-fix)
      • Before the first local run, the skills now make sure the user is aware that MegaLinter is Docker-based and needs a good computer configuration and internet connection (the image download can weigh several GB), and suggest watching CI results instead when that is a problem
      • Local runs launched by the skills now cap PARALLEL_PROCESS_NUMBER to 4 on local computers (CI runs keep one parallel linter process per CPU core), so linting does not saturate the machine
      • Local runs launched by the skills now always activate the JSON reporter (not generated by default) to read results reliably, and fall back to the report folder configuration then the console output instead of waiting for report files that a repository configuration may have disabled

    • Excluded directories are now forwarded to project-mode linters, massively speeding up local runs, fixes #​8645

      • Linters that scan the whole workspace by themselves (REPOSITORY_TRIVY, REPOSITORY_CHECKOV, REPOSITORY_GRYPE, REPOSITORY_TRUFFLEHOG, REPOSITORY_SEMGREP and 50+ others) used to crawl everything, including build caches and node_modules: a seconds-long CI lint could take hours on a local checkout
      • MegaLinter now automatically passes the excluded directories (defaults, EXCLUDED_DIRECTORIES, ADDITIONAL_EXCLUDED_DIRECTORIES, and directories detected in FILTER_REGEX_EXCLUDE) to each of these linters, through its native exclusion flags or a generated ignore/config file
      • Every forwarded exclusion is logged in the linter's console section, and the ">300 gitignored files" performance warning now names the heaviest directories it found
      • Opt out globally with FORWARD_EXCLUDED_DIRECTORIES: false, or per linter with <LINTER_KEY>_FORWARD_EXCLUDED_DIRECTORIES: false

    • Default excluded directories now also include common build/cache folders: .wireit, .turbo, .nx, .yarn/cache, .pnpm-store, .parcel-cache, .angular, and the Salesforce CLI .sf / .sfdx state folders (#​8646)

    • New per-linter timeout: a linter still running after 5 minutes (LINTER_TIMEOUT_SECONDS: 300 by default) is killed along with all its child processes and reported as an error (exit code 124) with an actionable message, while the other linters keep running. Raise the limit globally with LINTER_TIMEOUT_SECONDS, per linter with <LINTER_KEY>_TIMEOUT_SECONDS, or disable it with value 0 (#​8665)

    • New prerun analysis mode (mega-linter-runner --prerun, or MEGALINTER_PRERUN=true environment variable): MegaLinter identifies active linters and collects files, then stops before running any linter and suggests configuration improvements, in the console and in megalinter-reports/prerun-report.json (#​8653)

      • Suggested exclusions: top-level directories containing only gitignored files (safe: linting scope is unchanged, and project-mode linters stop scanning them), and well-known generated/vendored folder names (site, dist, vendor...) still containing lintable files (to confirm by the user)
      • A lighter matching flavor is also suggested when available
      • The megalinter-check agent skill uses it on the first local run to tune .mega-linter.yml with the user before the real lint
      • Fixed a performance issue where detecting .gitignored files enumerated every individual file inside large ignored folders (node_modules, build output...) instead of stopping at the folder boundary, which could make the file collection step (including prerun) take several minutes on big repositories

    • Much lighter Docker images: the main image download shrinks by 9%, flavors by 9% to 22%, and standalone megalinter-only-* images are 35% to 65% smaller (#​8621)

      • If your PRE_COMMANDS compile native code: the compilation toolchain is no longer shipped in the images, install it back with apk add --no-cache gcc make musl-dev

      • Main and flavor images, compressed download size on ghcr.io, linux/amd64 (before = v9.6.0, so deltas also include the linters removed in this version):

        Image Before After Delta
        megalinter (main) 4.55 GB 4.13 GB -9%
        megalinter-c_cpp 1.61 GB 1.35 GB -16%
        megalinter-ci_light 724 MB 657 MB -9%
        megalinter-cupcake 2.52 GB 2.24 GB -11%
        megalinter-documentation 1.47 GB 1.21 GB -18%
        megalinter-dotnet 2.23 GB 1.86 GB -17%
        megalinter-dotnetweb 2.25 GB 1.88 GB -17%
        megalinter-formatters 936 MB 849 MB -9%
        megalinter-go 1.55 GB 1.35 GB -13%
        megalinter-java 1.59 GB 1.32 GB -17%
        megalinter-javascript 1.49 GB 1.23 GB -18%
        megalinter-php 1.51 GB 1.26 GB -17%
        megalinter-python 1.61 GB 1.26 GB -22%
        megalinter-ruby 1.49 GB 1.22 GB -18%
        megalinter-rust 1.99 GB 1.80 GB -10%
        megalinter-salesforce 2.09 GB 1.87 GB -10%
        megalinter-security 1.30 GB 1.17 GB -10%
        megalinter-swift 1.51 GB 1.24 GB -18%
        megalinter-terraform 1.59 GB 1.30 GB -18%

      • Standalone single-linter images, uncompressed size on linux/amd64 (before = previous beta):

        Image Before After Delta
        megalinter-only-groovy_npm_groovy_lint 1.07 GB 695 MB -35%
        megalinter-only-r_lintr 996 MB 405 MB -59%
        megalinter-only-spell_proselint 813 MB 284 MB -65%
        megalinter-only-css_stylelint 780 MB 360 MB -54%
        megalinter-only-spell_cspell 755 MB 357 MB -53%
        megalinter-only-ruby_rubocop 702 MB 301 MB -57%
        megalinter-only-perl_perlcritic 696 MB 293 MB -58%
        megalinter-only-spell_vale 683 MB 286 MB -58%
        megalinter-only-yaml_yamllint 668 MB 271 MB -59%
        megalinter-only-bash_shellcheck 660 MB 263 MB -60%
        megalinter-only-lua_luacheck 652 MB 252 MB -61%
        megalinter-only-xml_xmllint 645 MB 246 MB -62%

    • Faster startup on every run (~5 seconds saved) (#​8624)

      • Linter versions now come from a manifest built into the Docker image, instead of calling every linter's --version
      • LLM Advisor libraries are only loaded when LLM_ADVISOR_ENABLED is true
      • Set the new VERSION_GET_AT_RUNTIME: true variable if your PRE_COMMANDS install different linter versions and you want the really installed versions reported

    • Faster linting when fixes are applied (APPLY_FIXES): the check-only linters of a language now run in parallel as soon as its fixer linters are done, instead of all linters of the language running one after another (#​8624)

    • Faster standalone images and file-list runs: megalinter-only-* images only parse the descriptor of their single linter, and the repository-wide .gitignore enumeration is skipped when an explicit list of files is passed (e.g. mega-linter-runner [files...] on a large repository) (#​8614)

    • Runtime speed-ups combined, measured on the MegaLinter repository itself and on real-world repositories upgraded to this version (average of the last successful CI runs before / first CI runs after the upgrade):

      Measure Before After Delta
      MegaLinter repository: full run (all linters, fixes applied) 4m26s 3m18s -26%
      MegaLinter startup (import megalinter) ~7s ~0.9s -87%
      sfdx-hardis CI MegaLinter job (v9.6.0 → beta, javascript flavor) 6m02s 3m17s -45%
      vscode-sfdx-hardis CI MegaLinter job (late-July → current beta) 3m10s 2m34s -19%

    • Better secrets masking in logs, now powered by the betterleaks ruleset: redaction coverage nearly doubles (218 to 408 patterns), with no more network call at startup (#​8606)

    • FILTER_REGEX_INCLUDE and FILTER_REGEX_EXCLUDE (global, per-descriptor and per-linter) can now be defined as a list of regexes combined with a logical OR, so filter regexes can be appended across EXTENDS configs via CONFIG_PROPERTIES_TO_APPEND; single-string values remain fully supported, fixes #​8361

    • New ENABLE_DISABLE_LINTERS_PRIORITY variable to let DISABLE_LINTERS override ENABLE_LINTERS when a linter is in both lists (e.g. to trim an inherited ENABLE_LINTERS list via EXTENDS), fixes #​8296

    • New MEGALINTER_FLAVOR and MEGALINTER_VERSION properties in .mega-linter.yml, to pin the flavor and version of the MegaLinter Docker image once in the repository and have them reused by mega-linter-runner and the agent skills (#​8614)

    • Display a **distinct

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@pipekit-ci

pipekit-ci commented Aug 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

❌MegaLinter analysis: Error

Descriptor Linter Files Fixed Errors Max errors Warnings Elapsed time
✅ JSON jsonlint 3 0 0 0.13s
✅ JSON prettier 1 0 0 0.23s
✅ MARKDOWN markdownlint 9 0 0 0.42s
✅ MARKDOWN markdown-table-formatter 9 0 0 0.23s
✅ PYTHON isort 7 0 0 0.46s
✅ PYTHON nbqa 2 0 0 3.23s
❌ PYTHON ruff 9 2 0 0.05s
❌ REPOSITORY betterleaks yes 1 no 0.03s
✅ REPOSITORY git_diff yes no no 0.11s
✅ REPOSITORY grype yes no no 68.76s
✅ REPOSITORY osv-scanner yes no no 0.09s
✅ REPOSITORY secretlint yes no no 0.8s
✅ REPOSITORY syft yes no no 1.38s
✅ REPOSITORY trivy-sbom yes no no 0.16s
❌ REPOSITORY trufflehog yes 1 no 3.71s
✅ SPELL cspell 32 0 0 3.84s
✅ YAML prettier 7 0 0 0.37s

Detailed Issues

❌ REPOSITORY / betterleaks - 1 error

Linter output file not found

❌ PYTHON / ruff - 2 errors

Linter output file not found

❌ REPOSITORY / trufflehog - 1 error

Linter output file not found

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: GIT, MARKDOWN_MARKDOWN_LINK_CHECK, REPOSITORY_GITLEAKS, REPOSITORY_KICS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

  • Documentation: Custom Flavors
  • Command: npx mega-linter-runner@10.1.0 --custom-flavor-setup --custom-flavor-linters PYTHON_ISORT,PYTHON_NBQA_MYPY,PYTHON_RUFF,JSON_JSONLINT,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_CSPELL,YAML_PRETTIER

MegaLinter is provided by OX Security
Show us your support by starring ⭐ the repository

@renovate
renovate Bot force-pushed the renovate/ghcr.io-oxsecurity-megalinter-python-10.x branch from c5df50e to 78b8021 Compare September 5, 2026 15:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@pipekit-ci