Bump oxsecurity/megalinter from 9 to 10 by dependabot[bot] · Pull Request #107 · github/issue-parser

dependabot · 2026-11-09T12:33:44Z

Bumps oxsecurity/megalinter from 9 to 10.

Release notes

Sourced from oxsecurity/megalinter's releases.

v10.0.0

What's Changed

Breaking changes

Removed 14 deprecated or long-disabled linters, and the API, MAKEFILE and PUPPET descriptors, which had no other linter left. MegaLinter does not provide Makefile and Puppet linting anymore. See the new Removed linters page for the full list and suggested replacements. (#8606)

REPOSITORY_GITLEAKS has been removed: migrate to REPOSITORY_BETTERLEAKS, which reads your existing .gitleaks.toml and .gitleaksignore files unchanged. (#8606)

Existing .mega-linter.yml files keep working: configuration variables of removed linters are simply ignored (a single notice lists any found in your configuration) and remain valid in the JSON schema. (#8606)

API Reporter payload v2 replaces the v1 payload: metric series are renamed (linter_run_* becomes megalinter_linter_run_*, plus new run-level megalinter_run_* series), and the old docs/grafana dashboards are superseded. Re-provision the new dashboards with npx mega-linter-runner --upload-dashboards grafana — see the migration notes. Legacy NOTIF_API_* variables remain supported as aliases. (#8661)

Linters now time out after 5 minutes by default (LINTER_TIMEOUT_SECONDS: 300): a linter exceeding it is killed and reported as an error (exit code 124) instead of running (or hanging) unbounded. If some of your linters legitimately run longer, raise the limit globally with LINTER_TIMEOUT_SECONDS, per linter with <LINTER_KEY>_TIMEOUT_SECONDS, or restore the previous unbounded behavior with value 0. (#8665)

Core

Coding agents integration: MegaLinter can now be driven by Claude Code, Cursor CLI, GitHub Copilot CLI, Codex and many other coding agents — see the new Coding Agents documentation page (#8614)

Install the MegaLinter agent skills with npx skills add oxsecurity/megalinter

Then ask your agent to set up MegaLinter (megalinter-setup), watch CI or local runs (megalinter-check) or fix lint errors (megalinter-fix)

Before the first local run, the skills now make sure the user is aware that MegaLinter is Docker-based and needs a good computer configuration and internet connection (the image download can weigh several GB), and suggest watching CI results instead when that is a problem

Local runs launched by the skills now cap PARALLEL_PROCESS_NUMBER to 4 on local computers (CI runs keep one parallel linter process per CPU core), so linting does not saturate the machine

Local runs launched by the skills now always activate the JSON reporter (not generated by default) to read results reliably, and fall back to the report folder configuration then the console output instead of waiting for report files that a repository configuration may have disabled

Excluded directories are now forwarded to project-mode linters, massively speeding up local runs, fixes #8645

Linters that scan the whole workspace by themselves (REPOSITORY_TRIVY, REPOSITORY_CHECKOV, REPOSITORY_GRYPE, REPOSITORY_TRUFFLEHOG, REPOSITORY_SEMGREP and 50+ others) used to crawl everything, including build caches and node_modules: a seconds-long CI lint could take hours on a local checkout

MegaLinter now automatically passes the excluded directories (defaults, EXCLUDED_DIRECTORIES, ADDITIONAL_EXCLUDED_DIRECTORIES, and directories detected in FILTER_REGEX_EXCLUDE) to each of these linters, through its native exclusion flags or a generated ignore/config file

Every forwarded exclusion is logged in the linter's console section, and the ">300 gitignored files" performance warning now names the heaviest directories it found

Opt out globally with FORWARD_EXCLUDED_DIRECTORIES: false, or per linter with <LINTER_KEY>_FORWARD_EXCLUDED_DIRECTORIES: false

Default excluded directories now also include common build/cache folders: .wireit, .turbo, .nx, .yarn/cache, .pnpm-store, .parcel-cache, .angular, and the Salesforce CLI .sf / .sfdx state folders (#8646)

New per-linter timeout: a linter still running after 5 minutes (LINTER_TIMEOUT_SECONDS: 300 by default) is killed along with all its child processes and reported as an error (exit code 124) with an actionable message, while the other linters keep running. Raise the limit globally with LINTER_TIMEOUT_SECONDS, per linter with <LINTER_KEY>_TIMEOUT_SECONDS, or disable it with value 0 (#8665)

New prerun analysis mode (mega-linter-runner --prerun, or MEGALINTER_PRERUN=true environment variable): MegaLinter identifies active linters and collects files, then stops before running any linter and suggests configuration improvements, in the console and in megalinter-reports/prerun-report.json (#8653)

Suggested exclusions: top-level directories containing only gitignored files (safe: linting scope is unchanged, and project-mode linters stop scanning them), and well-known generated/vendored folder names (site, dist, vendor...) still containing lintable files (to confirm by the user)

A lighter matching flavor is also suggested when available

The megalinter-check agent skill uses it on the first local run to tune .mega-linter.yml with the user before the real lint

Fixed a performance issue where detecting .gitignored files enumerated every individual file inside large ignored folders (node_modules, build output...) instead of stopping at the folder boundary, which could make the file collection step (including prerun) take several minutes on big repositories

Much lighter Docker images: the main image download shrinks by 9%, flavors by 9% to 22%, and standalone megalinter-only-* images are 35% to 65% smaller (#8621)

If your PRE_COMMANDS compile native code: the compilation toolchain is no longer shipped in the images, install it back with apk add --no-cache gcc make musl-dev

Main and flavor images, compressed download size on ghcr.io, linux/amd64 (before = v9.6.0, so deltas also include the linters removed in this version):

Image Before After Delta

megalinter (main) 4.55 GB 4.13 GB -9%

megalinter-c_cpp 1.61 GB 1.35 GB -16%

megalinter-ci_light 724 MB 657 MB -9%

megalinter-cupcake 2.52 GB 2.24 GB -11%

megalinter-documentation 1.47 GB 1.21 GB -18%

megalinter-dotnet 2.23 GB 1.86 GB -17%

megalinter-dotnetweb 2.25 GB 1.88 GB -17%

megalinter-formatters 936 MB 849 MB -9%

megalinter-go 1.55 GB 1.35 GB -13%

megalinter-java 1.59 GB 1.32 GB -17%

megalinter-javascript 1.49 GB 1.23 GB -18%

megalinter-php 1.51 GB 1.26 GB -17%

megalinter-python 1.61 GB 1.26 GB -22%

megalinter-ruby 1.49 GB 1.22 GB -18%

megalinter-rust 1.99 GB 1.80 GB -10%

... (truncated)

Changelog

Sourced from oxsecurity/megalinter's changelog.

[v9.2.0] - 2025-11-29

New linters

Salesforce Code Analyzer, by @abdeslamads

SALESFORCE_CODE_ANALYZER_APEX

SALESFORCE_CODE_ANALYZER_AURA

SALESFORCE_CODE_ANALYZER_LWC

Disabled linters

Reactivate checkov

Deprecated linters

Deprecate terrascan as the project is discontinued. Will be completely removed in a future version.

SALESFORCE_SFDX_SCANNER_* linters have been deprecated and will be removed in a future version. (they are replaced by SALESFORCE_CODE_ANALYZER_* linters)

Media

Looking for the best CI/CD Pipeline Linting Tool? Try MegaLinter!, by Seasoned Developer

(Brazilian) Qualidade e Segurança em Código com MegaLinter: automatizando análises em MAUI com GitHub Actions, by Canal dotNET

Linters enhancements

Install dotenv-linter deterministically, by @bdovaz in oxsecurity/megalinter#6385

Fixes

#6544: Add GITHUB_TOKEN in docker build command for custom flavor

Hide warning when compiling a regex

Fix formatting in descriptor files to reduce changes in generated markdown, by @echoix in oxsecurity/megalinter#6449

Reporters

Add conversion from Jenkins variables to related Git based reporters variables

Doc

Keep jsonschema html docs updated when using build.py --doc, by @echoix in oxsecurity/megalinter#6447

Commit updated license info generated from build script by @echoix in oxsecurity/megalinter#6448

Recreate docs/descriptors folder, delete old pages by @echoix in oxsecurity/megalinter#6451

Flavors

Add GITHUB_TOKEN in docker buildx build command for custom flavor, by @davidfevre-gouv-nc in oxsecurity/megalinter#6545

CI

Optimize performances of standalone linters releases

Renovate: Add langchain group for package updates, by @echoix in oxsecurity/megalinter#6400

Refactor file handling in build.py to use pathlib for improved readability, by @echoix in oxsecurity/megalinter#6450

mega-linter-runner

Handle upgrade of stefanzweifel/git-auto-commit-action to v7

Linter versions upgrades (53)

actionlint from 1.7.7 to 1.7.9

ansible-lint from 25.9.1 to 25.11.1

bandit from 1.8.6 to 1.9.2

... (truncated)

Commits

f2fe8c1 Release MegaLinter v10.2.0
1a92b0e [automation] Auto-update linters version, help and documentation (#9421)
4cc4e24 [automation] Auto-update linters version, help and documentation (#9414)
dfe4441 chore(deps): update dependency @biomejs/biome to v2.6.3 (#9413)
28218ca Build(deps): Bump docker/login-action from 4.6.0 to 4.7.0 (#9418)
9c753cf Build(deps): Bump stefanzweifel/git-auto-commit-action from 7.2.0 to 7.2.1 (#...
e0b0528 Build(deps): Bump actions/setup-python from 7.0.0 to 7.1.0 (#9420)
d91114b [automation] Auto-update linters version, help and documentation (#9405)
5b15f9b chore(deps): update dependency phpstan/phpstan to v2.3.2 (#9412)
e9a9378 chore(deps): upgrade npm-groovy-lint to v19.0.0 (#9411)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [oxsecurity/megalinter](https://github.com/oxsecurity/megalinter) from 9 to 10. - [Release notes](https://github.com/oxsecurity/megalinter/releases) - [Changelog](https://github.com/oxsecurity/megalinter/blob/main/CHANGELOG.md) - [Commits](oxsecurity/megalinter@v9...v10) --- updated-dependencies: - dependency-name: oxsecurity/megalinter dependency-version: '10' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Copilot

🔵 Needs a closer look

MegaLinter v10 changes important workflow defaults, so its real GitHub Actions behavior still needs confirmation despite no references to removed descriptors.

No open issues 🎉

What changed in this PR

Updates the repository’s MegaLinter JavaScript GitHub Action from v9 to v10 while preserving the existing lint workflow and configuration.

Changes:

Bumps oxsecurity/megalinter/flavors/javascript from @v9 to @v10.
Retains existing workflow permissions, environment variables, and lint configuration.
No references to descriptors removed in MegaLinter v10 were identified.

File	Description
`.github/workflows/linter.yml`	Updates the MegaLinter JavaScript flavor used by the lint workflow to v10.

_{Review effort: Lite (auto)}

github-actions · 2026-11-09T12:37:00Z

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	5	0	0	0.14s
❌ ACTION	zizmor	5	1	0	0.33s
✅ JSON	jsonlint	23	0	0	0.11s
✅ JSON	npm-package-json-lint	yes	no	no	0.31s
✅ JSON	prettier	23	0	0	0.51s
✅ JSON	v8r	23	0	0	9.85s
✅ MARKDOWN	markdownlint	1	0	0	0.36s
✅ REPOSITORY	betterleaks	yes	no	no	0.93s
✅ REPOSITORY	checkov	yes	no	no	15.91s
✅ REPOSITORY	git_diff	yes	no	no	0.01s
✅ REPOSITORY	grype	yes	no	no	70.85s
❌ REPOSITORY	osv-scanner	yes	62	no	1.53s
✅ REPOSITORY	secretlint	yes	no	no	0.82s
✅ REPOSITORY	syft	yes	no	no	1.8s
✅ REPOSITORY	trivy-sbom	yes	no	no	0.42s
✅ REPOSITORY	trufflehog	yes	no	no	2.61s
✅ TYPESCRIPT	eslint	8	0	0	4.62s
❌ TYPESCRIPT	prettier	8	1	0	0.79s
✅ YAML	prettier	19	0	0	0.7s
✅ YAML	v8r	19	0	0	9.01s
✅ YAML	yamllint	19	0	0	0.67s

Detailed Issues

❌ REPOSITORY / osv-scanner - 62 errors

Scanning dir .
Starting filesystem walk for root: /
Scanned package-lock.json file and found 527 packages
End status: 22 dirs visited, 92 inodes visited, 1 Extract calls, 11.651971ms elapsed, 11.652091ms wall time

Total 20 packages affected by 62 known vulnerabilities (3 Critical, 34 High, 23 Medium, 2 Low, 0 Unknown) from 1 ecosystem.
61 vulnerabilities can be fixed.

+-------------------------------------+------+-----------+--------------------------------+---------+---------------+-------------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE                        | VERSION | FIXED VERSION | SOURCE            |
+-------------------------------------+------+-----------+--------------------------------+---------+---------------+-------------------+
| https://osv.dev/GHSA-4x5r-pxfx-6jf8 | 3.2  | npm       | @babel/core (dev)              | 7.29.0  | 7.29.6        | package-lock.json |
| https://osv.dev/GHSA-p498-v437-472g | 5.7  | npm       | @humanfs/node (dev)            | 0.16.7  | 0.16.8        | package-lock.json |
| https://osv.dev/GHSA-w5vr-8v7q-w6rv | 6.6  | npm       | baseline-browser-mapping (dev) | 2.10.9  | 2.11.0        | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.16        | package-lock.json |
| https://osv.dev/GHSA-6j4f-fj2g-mc7p | 7.5  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.19        | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.13        | package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.17        | package-lock.json |
| https://osv.dev/GHSA-q2hr-2g5m-vwhr | 5.3  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.21        | package-lock.json |
| https://osv.dev/GHSA-qhr7-859c-m2p7 | 7.5  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.20        | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.18        | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion (dev)          | 2.0.2   | 2.1.2         | package-lock.json |
| https://osv.dev/GHSA-6j4f-fj2g-mc7p | 7.5  | npm       | brace-expansion (dev)          | 2.0.2   | 2.1.5         | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion (dev)          | 2.0.2   | 2.0.3         | package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion (dev)          | 2.0.2   | 2.1.3         | package-lock.json |
| https://osv.dev/GHSA-q2hr-2g5m-vwhr | 5.3  | npm       | brace-expansion (dev)          | 2.0.2   | 2.1.7         | package-lock.json |
| https://osv.dev/GHSA-qhr7-859c-m2p7 | 7.5  | npm       | brace-expansion (dev)          | 2.0.2   | 2.1.6         | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion (dev)          | 2.0.2   | 2.1.4         | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.7         | package-lock.json |
| https://osv.dev/GHSA-6j4f-fj2g-mc7p | 7.5  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.10        | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.5         | package-lock.json |
| https://osv.dev/GHSA-jxxr-4gwj-5jf2 | 6.5  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.6         | package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.8         | package-lock.json |
| https://osv.dev/GHSA-q2hr-2g5m-vwhr | 5.3  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.12        | package-lock.json |
| https://osv.dev/GHSA-qhr7-859c-m2p7 | 7.5  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.11        | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion (dev)          | 5.0.4   | 5.0.9         | package-lock.json |
| https://osv.dev/GHSA-73wf-gq98-2v4g | 7.5  | npm       | browserslist (dev)             | 4.28.1  | 4.28.7        | package-lock.json |
| https://osv.dev/GHSA-c83g-rgw3-j3cx | 7.5  | npm       | browserslist (dev)             | 4.28.1  | 4.28.7        | package-lock.json |
| https://osv.dev/GHSA-gcqx-w48m-w2h4 | 5.3  | npm       | deepmerge (dev)                | 4.3.1   | --            | package-lock.json |
| https://osv.dev/GHSA-3g3m-2fjr-6pw4 | 6.3  | npm       | glob (dev)                     | 10.5.0  | 14.0.2        | package-lock.json |
| https://osv.dev/GHSA-2qvq-rjwj-gvw9 | 4.7  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-2w6w-674q-4c4q | 9.8  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-3mfm-83xf-c92r | 8.1  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-442j-39wm-28r2 | 3.7  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-7rx3-28cr-v5wh | 4.8  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-8r5x-fm3f-whwj | 9.8  | npm       | handlebars (dev)               | 4.7.8   | 4.7.10        | package-lock.json |
| https://osv.dev/GHSA-9cx6-37pm-9jff | 7.5  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-p8wg-vrv2-v86f | 9.2  | npm       | handlebars (dev)               | 4.7.8   | 4.7.10        | package-lock.json |
| https://osv.dev/GHSA-xhpv-hc6g-r9c6 | 8.1  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-xjpj-3mr7-gcpf | 8.2  | npm       | handlebars (dev)               | 4.7.8   | 4.7.9         | package-lock.json |
| https://osv.dev/GHSA-xw65-4hp5-5hc7 | 4.7  | npm       | handlebars (dev)               | 4.7.8   | 4.7.10        | package-lock.json |
| https://osv.dev/GHSA-2883-xcg3-v3hh | 7.5  | npm       | js-yaml (dev)                  | 3.14.2  | 3.15.2        | package-lock.json |
| https://osv.dev/GHSA-52cp-r559-cp3m | 7.5  | npm       | js-yaml (dev)                  | 3.14.2  | 3.15.0        | package-lock.json |
| https://osv.dev/GHSA-5p4m-2wfm-xmqj | 7.5  | npm       | js-yaml (dev)                  | 3.14.2  | 3.15.1        | package-lock.json |
| https://osv.dev/GHSA-h67p-54hq-rp68 | 5.3  | npm       | js-yaml (dev)                  | 3.14.2  | 3.15.0        | package-lock.json |
| https://osv.dev/GHSA-2883-xcg3-v3hh | 7.5  | npm       | js-yaml (dev)                  | 4.1.1   | 4.3.2         | package-lock.json |
| https://osv.dev/GHSA-52cp-r559-cp3m | 7.5  | npm       | js-yaml (dev)                  | 4.1.1   | 4.3.0         | package-lock.json |
| https://osv.dev/GHSA-5p4m-2wfm-xmqj | 7.5  | npm       | js-yaml (dev)                  | 4.1.1   | 4.3.1         | package-lock.json |
| https://osv.dev/GHSA-h67p-54hq-rp68 | 5.3  | npm       | js-yaml (dev)                  | 4.1.1   | 4.2.0         | package-lock.json |
| https://osv.dev/GHSA-f23m-r3pf-42rh | 6.5  | npm       | lodash (dev)                   | 4.17.23 | 4.18.1        | package-lock.json |
| https://osv.dev/GHSA-r5fr-rjxr-66jc | 8.1  | npm       | lodash (dev)                   | 4.17.23 | 4.18.0        | package-lock.json |
| https://osv.dev/GHSA-g3hv-75wg-m249 | 6.9  | npm       | minimatch (dev)                | 10.2.4  | 11.0.1        | package-lock.json |
| https://osv.dev/GHSA-23c5-xmqv-rm74 | 7.5  | npm       | minimatch (dev)                | 9.0.3   | 9.0.7         | package-lock.json |
| https://osv.dev/GHSA-3ppc-4f35-3m26 | 8.7  | npm       | minimatch (dev)                | 9.0.3   | 9.0.6         | package-lock.json |
| https://osv.dev/GHSA-7r86-cg39-jmmj | 7.5  | npm       | minimatch (dev)                | 9.0.3   | 9.0.7         | package-lock.json |
| https://osv.dev/GHSA-g3hv-75wg-m249 | 6.9  | npm       | minimatch (dev)                | 9.0.3   | 11.0.1        | package-lock.json |
| https://osv.dev/GHSA-g3hv-75wg-m249 | 6.9  | npm       | minimatch (dev)                | 9.0.9   | 11.0.1        | package-lock.json |
| https://osv.dev/GHSA-3v7f-55p6-f55p | 5.3  | npm       | picomatch (dev)                | 2.3.1   | 2.3.2         | package-lock.json |
| https://osv.dev/GHSA-c2c7-rcm5-vvqj | 7.5  | npm       | picomatch (dev)                | 2.3.1   | 2.3.2         | package-lock.json |
| https://osv.dev/GHSA-3v7f-55p6-f55p | 5.3  | npm       | picomatch (dev)                | 4.0.3   | 4.0.4         | package-lock.json |
| https://osv.dev/GHSA-c2c7-rcm5-vvqj | 7.5  | npm       | picomatch (dev)                | 4.0.3   | 4.0.4         | package-lock.json |
| https://osv.dev/GHSA-w5hq-g745-h8pq | 7.5  | npm       | uuid (dev)                     | 8.3.2   | 11.1.1        | package-lock.json |
| https://osv.dev/GHSA-48c2-rrv3-qjmp | 4.3  | npm       | yaml                           | 2.8.2   | 2.8.3         | package-lock.json |
+-------------------------------------+------+-----------+--------------------------------+---------+---------------+-------------------+

❌ TYPESCRIPT / prettier - 1 error

Checking formatting...
[warn] src/types.ts
[warn] Code style issues found in the above file. Run Prettier with --write to fix.

❌ ACTION / zizmor - 1 error

INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'ref-confusion' audit failed on file://.github/workflows/check-dist.yml

Caused by:
    0: error in 'ref-confusion' audit
    1: couldn't list branches for actions/checkout
    2: request error while accessing GitHub API
    3: HTTP status client error (401 Unauthorized) for url (https://github.com/actions/checkout.git/git-upload-pack)


[ACTION_ZIZMOR_ERROR_GITHUB_API_UNREACHABLE] Zizmor could not access a repository referenced by a `uses:` clause via the GitHub API (missing token, insufficient scope, or cross-repo private access).
To allow zizmor to authenticate with GITHUB_TOKEN (or a PAT with `Contents: read-only`), whitelist the variable in your .mega-linter.yml:
ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
  - GITHUB_TOKEN
If the referenced workflow is in a private repo outside the current one, provide a PAT with cross-repo access instead of the default GITHUB_TOKEN, or run zizmor in offline mode.

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_KICS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

Documentation: Custom Flavors
Command: npx mega-linter-runner@10.2.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,ACTION_ZIZMOR,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,TYPESCRIPT_ES,TYPESCRIPT_PRETTIER,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

Show us your support by starring ⭐ the repository

dependabot Bot requested a review from ncalteen as a code owner November 9, 2026 12:33

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 9, 2026

Copilot AI auto review requested due to automatic review settings November 9, 2026 12:33

Copilot started reviewing November 9, 2026 12:34

View session

Copilot AI reviewed Nov 9, 2026

View reviewed changes

Navigation Menu

Repository navigation

Bump oxsecurity/megalinter from 9 to 10 - #107

Bump oxsecurity/megalinter from 9 to 10#107
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/oxsecurity/megalinter-10

dependabot Bot commented on behalf of github Nov 9, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Nov 9, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Image	Before	After	Delta
`megalinter` (main)	4.55 GB	4.13 GB	-9%
`megalinter-c_cpp`	1.61 GB	1.35 GB	-16%
`megalinter-ci_light`	724 MB	657 MB	-9%
`megalinter-cupcake`	2.52 GB	2.24 GB	-11%
`megalinter-documentation`	1.47 GB	1.21 GB	-18%
`megalinter-dotnet`	2.23 GB	1.86 GB	-17%
`megalinter-dotnetweb`	2.25 GB	1.88 GB	-17%
`megalinter-formatters`	936 MB	849 MB	-9%
`megalinter-go`	1.55 GB	1.35 GB	-13%
`megalinter-java`	1.59 GB	1.32 GB	-17%
`megalinter-javascript`	1.49 GB	1.23 GB	-18%
`megalinter-php`	1.51 GB	1.26 GB	-17%
`megalinter-python`	1.61 GB	1.26 GB	-22%
`megalinter-ruby`	1.49 GB	1.22 GB	-18%
`megalinter-rust`	1.99 GB	1.80 GB	-10%

Conversation

dependabot Bot commented on behalf of github Nov 9, 2026

v10.0.0

What's Changed

[v9.2.0] - 2025-11-29

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

github-actions Bot commented Nov 9, 2026

❌MegaLinter analysis: Error

Detailed Issues

Notices

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant