⬆️ Updates nvuillam/mega-linter action to v9

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
nvuillam/mega-linter	action	major	v4 → v9

---

Release Notes

nvuillam/mega-linter (nvuillam/mega-linter)

v9

Compare Source

• New linters

  • Salesforce Code Analyzer, by @​abdeslamads
    • SALESFORCE_CODE_ANALYZER_APEX
    • SALESFORCE_CODE_ANALYZER_AURA
    • SALESFORCE_CODE_ANALYZER_LWC

• Disabled linters

  • Reactivate checkov

• Deprecated linters

  • Deprecate terrascan as the project is discontinued. Will be completely removed in a future version.
  • SALESFORCE_SFDX_SCANNER_* linters have been deprecated and will be removed in a future version. (they are replaced by SALESFORCE_CODE_ANALYZER_* linters)

• Media

  • Looking for the best CI/CD Pipeline Linting Tool? Try MegaLinter!, by Seasoned Developer
  • (Brazilian) Qualidade e Segurança em Código com MegaLinter: automatizando análises em MAUI com GitHub Actions, by Canal dotNET

• Linters enhancements

  • Install dotenv-linter deterministically, by @​bdovaz in oxsecurity/megalinter#6385

• Fixes

  • #​6544: Add GITHUB_TOKEN in docker build command for custom flavor
  • Hide warning when compiling a regex
  • Fix formatting in descriptor files to reduce changes in generated markdown, by @​echoix in oxsecurity/megalinter#6449

• Reporters

  • Add conversion from Jenkins variables to related Git based reporters variables

• Doc

  • Keep jsonschema html docs updated when using build.py --doc, by @​echoix in oxsecurity/megalinter#6447
  • Commit updated license info generated from build script by @​echoix in oxsecurity/megalinter#6448
  • Recreate docs/descriptors folder, delete old pages by @​echoix in oxsecurity/megalinter#6451

• Flavors

  • Add GITHUB_TOKEN in docker buildx build command for custom flavor, by @​davidfevre-gouv-nc in oxsecurity/megalinter#6545

• CI

  • Optimize performances of standalone linters releases
  • Renovate: Add langchain group for package updates, by @​echoix in oxsecurity/megalinter#6400
  • Refactor file handling in build.py to use pathlib for improved readability, by @​echoix in oxsecurity/megalinter#6450

• mega-linter-runner

  • Handle upgrade of stefanzweifel/git-auto-commit-action to v7

• Linter versions upgrades (53)

  • actionlint from 1.7.7 to 1.7.9
  • ansible-lint from 25.9.1 to 25.11.1
  • bandit from 1.8.6 to 1.9.2
  • bicep_linter from 0.38.33 to 0.39.26
  • black from 25.9.0 to 25.11.0
  • cfn-lint from 1.40.0 to 1.41.0
  • checkov from 3.2.413 to 3.2.495
  • checkstyle from 11.1.0 to 12.1.0
  • clippy from 0.1.90 to 0.1.91
  • clj-kondo from 2025.09.22 to 2025.10.23
  • csharpier from 1.1.2 to 1.2.1
  • cspell from 9.2.1 to 9.3.2
  • dotenv-linter from 3.3.0 to 4.0.0
  • dotnet-format from 9.0.110 to 9.0.111
  • editorconfig-checker from 3.4.0 to 3.6.0
  • git_diff from 2.47.0 to 2.49.1
  • gitleaks from 8.28.0 to 8.30.0
  • golangci-lint from 2.5.0 to 2.6.2
  • grype from 0.100.0 to 0.104.1
  • isort from 6.1.0 to 7.0.0
  • kics from 2.1.14 to 2.1.16
  • ktlint from 1.7.1 to 1.8.0
  • kubescape from 3.0.41 to 3.0.45
  • php-cs-fixer from 3.88.2 to 3.90.0
  • phpcs from 4.0.0 to 4.0.1
  • phpstan from 2.1.30 to 2.1.32
  • pmd from 7.17.0 to 7.18.0
  • powershell from 7.5.3 to 7.5.4
  • pylint from 3.3.9 to 4.0.3
  • pyright from 1.1.406 to 1.1.407
  • raku from 2024.12 to 2025.11
  • revive from 1.12.0 to 1.13.0
  • robocop from 6.7.2 to 6.11.0
  • roslynator from 0.10.2.0 to 0.11.0.0
  • rst-lint from 1.4.0 to 2.0.2
  • rubocop from 1.81.1 to 1.81.7
  • ruff-format from 0.13.3 to 0.14.6
  • ruff from 0.13.3 to 0.14.6
  • scalafix from 0.14.3 to 0.14.4
  • secretlint from 11.2.4 to 11.2.5
  • snakemake from 9.11.9 to 9.13.7
  • sqlfluff from 3.4.2 to 3.5.0
  • stylelint from 16.24.0 to 16.26.0
  • swiftlint from 0.61.0 to 0.62.2
  • syft from 1.33.0 to 1.38.0
  • terraform-fmt from 1.13.3 to 1.14.0
  • terragrunt from 0.88.1 to 0.93.10
  • tflint from 0.59.1 to 0.60.0
  • trivy-sbom from 0.67.0 to 0.67.2
  • trivy from 0.67.0 to 0.67.2
  • trufflehog from 3.90.11 to 3.91.1
  • vale from 3.12.0 to 3.13.0
  • xmllint from 21308 to 21309

v8

Compare Source

• Core

  • Retrieve SARIF errors and warnings correctly, by @​bdovaz in oxsecurity/megalinter#4837

• Linters enhancements

  • More config file name checks for ansible-lint activation, by @​nvuillam in oxsecurity/megalinter#5590

• Fixes

  • Fix crash when the markdown table summary is empty, by @​nvuillam in oxsecurity/megalinter#5363
  • Downgrade click to make rstcheck work again, by @​nvuillam in oxsecurity/megalinter#5387

• Doc

  • Display hash as plain text in markdown, by @​johndutchover in oxsecurity/megalinter#5420

• Flavors

  • Add Gherkin descriptor in java flavor, by @​nvuillam in oxsecurity/megalinter#5592

• CI

  • Fix rust setup & disable codecov-cli, by @​nvuillam in oxsecurity/megalinter#5579

• Linter versions upgrades (50)

  • ansible-lint from 25.4.0 to 25.5.0
  • bicep_linter from 0.35.1 to 0.36.1
  • cfn-lint from 1.34.2 to 1.36.0
  • checkstyle from 10.23.1 to 10.25.0
  • clippy from 0.1.86 to 0.1.87
  • clj-kondo from 2025.04.07 to 2025.06.05
  • csharpier from 1.0.1 to 1.0.2
  • cspell from 8.19.4 to 9.1.1
  • dartanalyzer from 3.7.3 to 3.8.1
  • devskim from 1.0.56 to 1.0.59
  • dotnet-format from 9.0.105 to 9.0.106
  • editorconfig-checker from 3.2.1 to 3.3.0
  • gitleaks from 8.25.1 to 8.27.2
  • golangci-lint from 2.1.5 to 2.1.6
  • grype from 0.91.2 to 0.94.0
  • htmlhint from 1.1.4 to 1.5.1
  • kics from 2.1.7 to 2.1.10
  • ktlint from 1.5.0 to 1.6.0
  • kubeconform from 0.6.7 to 0.7.0
  • lightning-flow-scanner from 3.8.0 to 3.23.0
  • ls-lint from 2.3.0 to 2.3.1
  • markdownlint from 0.44.0 to 0.45.0
  • mypy from 1.15.0 to 1.16.0
  • npm-groovy-lint from 15.1.0 to 15.2.0
  • phpcs from 3.12.2 to 3.13.1
  • phpstan from 2.1.14 to 2.1.17
  • pmd from 7.13.0 to 7.14.0
  • protolint from 0.54.1 to 0.55.6
  • psalm from Psalm.6.10.2@​ to Psalm.6.12.0@​
  • pylint from 3.3.6 to 3.3.7
  • pyright from 1.1.400 to 1.1.402
  • revive from 1.9.0 to 1.10.0
  • rstcheck from 6.2.4 to 6.2.5
  • rubocop from 1.75.4 to 1.76.1
  • ruff from 0.11.8 to 0.11.13
  • ruff-format from 0.11.8 to 0.11.13
  • scalafix from 0.14.2 to 0.14.3
  • secretlint from 9.3.2 to 10.1.0
  • semgrep from 3.12 to 3.13
  • sfdx-scanner-apex from 4.11.0 to 4.12.0
  • sfdx-scanner-aura from 4.11.0 to 4.12.0
  • sfdx-scanner-lwc from 4.11.0 to 4.12.0
  • snakemake from 8.27.1 to 9.5.1
  • sqlfluff from 3.4.0 to 3.4.1
  • stylelint from 16.19.1 to 16.20.0
  • syft from 1.23.1 to 1.27.1
  • terraform-fmt from 1.11.4 to 1.12.2
  • terragrunt from 0.78.0 to 0.81.6
  • tflint from 0.57.0 to 0.58.0
  • trivy from 0.62.0 to 0.63.0
  • trivy-sbom from 0.62.0 to 0.63.0
  • trufflehog from 3.88.27 to 3.89.1
  • v8r from 4.4.0 to 5.0.0

v7

Compare Source

• New linters

  • Add ls-lint, file and folder linter, by @​scolladon in oxsecurity/megalinter#3681

• Core

  • Handle renovate version comments in build script, by @​echoix in oxsecurity/megalinter#3617 , oxsecurity/megalinter#3627 , oxsecurity/megalinter#3643 , oxsecurity/megalinter#3699 , oxsecurity/megalinter#3700
  • Update base image to python:3.12.4-alpine3.20
  • Use dotnet8-sdk available in the main repository, by @​TommyE123 in oxsecurity/megalinter#3696

• Media

  • Introducing MegaLinter: Streamlining Code Quality Checks Across Multiple Languages, by Cloud Tuned
  • Infrastructure as Code GitHub Codespace Template, by Luke Murray
  • Video: How to: Secrets scanning, by Hackitect's playground

• Linters enhancements

  • Add SARIF support (v2) for all PHP linters by @​llaville in oxsecurity/megalinter#3745 , oxsecurity/megalinter#3729
  • Add python package Pygments to rst-lint venv, by @​bobidle in oxsecurity/megalinter#3631
  • CSharpier added ability to override config filename and path, by @​TommyE123 in oxsecurity/megalinter#3664
  • xmllint added support for xsd files, by @​TommyE123 in oxsecurity/megalinter#3665

• Fixes

  • Improve support for single argument in get_list_args function, by @​TommyE123 in oxsecurity/megalinter#3589
  • ansible-lint Improved activation by checking for .ansible-lint config file, by @​TommyE123 in oxsecurity/megalinter#3697
  • DevSkim fixed fatal errors when scanning and ability to override config path, by @​TommyE123 in oxsecurity/megalinter#3673
  • GitLeaks add missing schema properties, by @​TommyE123 in oxsecurity/megalinter#3675
  • Powershell Error table truncation improvements, by @​TommyE123 in oxsecurity/megalinter#3620
  • Powershell added missing schema property POWERSHELL_POWERSHELL_FORMATTER_OUTPUT_ENCODING, by @​TommyE123 in oxsecurity/megalinter#3678
  • syft use scan instead of deprecated packages arg, by @​TommyE123 in oxsecurity/megalinter#3613
  • tflint added missing schema property TERRAFORM_TFLINT_SECURED_ENV, by @​TommyE123 in oxsecurity/megalinter#3679
  • tflint fixed deprecated argument and other improvements to default .tflint.hcl template, by @​TommyE123 in oxsecurity/megalinter#3688
  • xmllint added missing schema properties XML_XMLLINT_AUTOFORMAT and XML_XMLLINT_INDENT, by @​TommyE123 in oxsecurity/megalinter#3677
  • yamllint fix error/warning count to work with different log output formats, by @​TommyE123 in oxsecurity/megalinter#3612

• Doc

  • Update documentation icons by @​nvuillam in oxsecurity/megalinter#3625

• Flavors

  • Add gherkin-lint in c_cpp flavor, by @​nvuillam in oxsecurity/megalinter#3698

• CI

  • Bump actions/checkout from 3 to 4, by @​KristjanESPERANTO in oxsecurity/megalinter#2994
  • Reduce dependabot PR frequency to weekly by @​echoix in oxsecurity/megalinter#3642

• Linter versions upgrades

  • ansible-lint from 24.2.3 to 24.6.1
  • bandit from 1.7.8 to 1.7.9
  • bash-exec from 5.2.21 to 5.2.26
  • bicep_linter from 0.27.1 to 0.28.1
  • cfn-lint from 0.87.4 to 1.5.0
  • checkov from 3.2.122 to 3.2.174
  • clang-format from 17.0.5 to 17.0.6
  • clippy from 0.1.78 to 0.1.79
  • cspell from 8.8.3 to 8.10.4
  • editorconfig-checker from 3.0.1 to 3.0.3
  • flake8 from 7.0.0 to 7.1.0
  • git_diff from 2.43.4 to 2.45.2
  • gitleaks from 8.18.2 to 8.18.4
  • golangci-lint from 1.59.0 to 1.59.1
  • grype from 0.78.0 to 0.79.2
  • helm from 3.14.2 to 3.14.3
  • jscpd from 4.0.4 to 4.0.5
  • kics from 2.0.1 to 2.1.1
  • ktlint from 1.2.1 to 1.3.1
  • lightning-flow-scanner from 2.26.0 to 2.28.0
  • markdown-table-formatter from 1.6.0 to 1.6.1
  • mypy from 1.10.0 to 1.10.1
  • npm-package-json-lint from 7.1.0 to 8.0.0
  • php-cs-fixer from 3.58.1 to 3.59.3
  • phplint from 9.3.1 to 9.4.1
  • phpstan from 1.11.3 to 1.11.7
  • pmd from 7.1.0 to 7.3.0
  • prettier from 3.3.0 to 3.3.2
  • protolint from 0.49.7 to 0.50.2
  • psalm from Psalm.5.24.0@​ to Psalm.5.25.0@​
  • pylint from 3.2.2 to 3.2.5
  • pyright from 1.1.365 to 1.1.370
  • ruff from 0.4.10 to 0.5.1
  • sfdx-scanner-apex from 3.25.0 to 4.3.2
  • sfdx-scanner-aura from 3.25.0 to 4.3.2
  • sfdx-scanner-lwc from 3.25.0 to 4.3.2
  • snakemake from 8.12.0 to 8.15.2
  • sqlfluff from 3.0.7 to 3.1.0
  • swiftlint from 0.54.0 to 0.55.1
  • syft from 1.5.0 to 1.8.0
  • terraform-fmt from 1.8.4 to 1.9.0
  • terragrunt from 0.58.13 to 0.59.6
  • tflint from 0.51.1 to 0.52.0
  • trivy-sbom from 0.51.4 to 0.53.0
  • trivy from 0.51.4 to 0.53.0
  • trufflehog from 3.77.0 to 3.79.0
  • v8r from 3.0.0 to 3.1.0
  • vale from 3.4.2 to 3.6.0
  • xmllint from 21108 to 21207

v6

Compare Source

• Core

  • Fix failure of AzureCommentReporter when there is no pull request found in ENV vars
  • Fix HTML comment appearing in Azure Pull Request mail notifications

• Linter versions upgrades

  • ansible-lint from 6.14.3 to 6.14.4
  • checkov from 2.3.145 to 2.3.149
  • pylint from 2.17.1 to 2.17.2
  • rubocop from 1.48.1 to 1.49.0

v5

Compare Source

• Message to propose users to upgrade to v6

---

Configuration

📅 Schedule: Branch creation - "after 10pm every weekday,before 5am every weekday,every weekend" in timezone Europe/Moscow, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Thanks for opening an issue! Make sure you've followed CONTRIBUTING.md.

[github-actions]

Hello from PR Helper

Remember to comment with one of the following states:

#pr-ready to enable all auto processing and merging.

#pr-onhold to prevent merging as you have other commits or discussions to make.

If you do not set the #pr-ready comment then the auto-merge capabilities will not be active.

[github-actions]

Thanks for the PR!

This section of the codebase is owner by https://github.com/AlexRogalskiy/ - if they write a comment saying "LGTM" then it will be merged.