Skip to content

Releases: oxsecurity/megalinter

Release list

v10.0.0

v10.0.0 Latest
Marketplace
Latest
Marketplace

Choose a tag to compare

View all tags
@nvuillam nvuillam released this 08 Aug 10:22
v10.0.0
15e5b45

What's Changed

  • Breaking changes

    • Removed 14 deprecated or long-disabled linters, and the API, MAKEFILE and PUPPET descriptors, which had no other linter left. MegaLinter does not provide Makefile and Puppet linting anymore. See the new Removed linters page for the full list and suggested replacements. (#8606)
    • REPOSITORY_GITLEAKS has been removed: migrate to REPOSITORY_BETTERLEAKS, which reads your existing .gitleaks.toml and .gitleaksignore files unchanged. (#8606)
    • Existing .mega-linter.yml files keep working: configuration variables of removed linters are simply ignored (a single notice lists any found in your configuration) and remain valid in the JSON schema. (#8606)
    • API Reporter payload v2 replaces the v1 payload: metric series are renamed (linter_run_* becomes megalinter_linter_run_*, plus new run-level megalinter_run_* series), and the old docs/grafana dashboards are superseded. Re-provision the new dashboards with npx mega-linter-runner --upload-dashboards grafana — see the migration notes. Legacy NOTIF_API_* variables remain supported as aliases. (#8661)
    • Linters now time out after 5 minutes by default (LINTER_TIMEOUT_SECONDS: 300): a linter exceeding it is killed and reported as an error (exit code 124) instead of running (or hanging) unbounded. If some of your linters legitimately run longer, raise the limit globally with LINTER_TIMEOUT_SECONDS, per linter with <LINTER_KEY>_TIMEOUT_SECONDS, or restore the previous unbounded behavior with value 0. (#8665)

  • Core

    • Coding agents integration: MegaLinter can now be driven by Claude Code, Cursor CLI, GitHub Copilot CLI, Codex and many other coding agents — see the new Coding Agents documentation page (#8614)

      • Install the MegaLinter agent skills with npx skills add oxsecurity/megalinter
      • Then ask your agent to set up MegaLinter (megalinter-setup), watch CI or local runs (megalinter-check) or fix lint errors (megalinter-fix)
      • Before the first local run, the skills now make sure the user is aware that MegaLinter is Docker-based and needs a good computer configuration and internet connection (the image download can weigh several GB), and suggest watching CI results instead when that is a problem
      • Local runs launched by the skills now cap PARALLEL_PROCESS_NUMBER to 4 on local computers (CI runs keep one parallel linter process per CPU core), so linting does not saturate the machine
      • Local runs launched by the skills now always activate the JSON reporter (not generated by default) to read results reliably, and fall back to the report folder configuration then the console output instead of waiting for report files that a repository configuration may have disabled

    • Excluded directories are now forwarded to project-mode linters, massively speeding up local runs, fixes #8645

      • Linters that scan the whole workspace by themselves (REPOSITORY_TRIVY, REPOSITORY_CHECKOV, REPOSITORY_GRYPE, REPOSITORY_TRUFFLEHOG, REPOSITORY_SEMGREP and 50+ others) used to crawl everything, including build caches and node_modules: a seconds-long CI lint could take hours on a local checkout
      • MegaLinter now automatically passes the excluded directories (defaults, EXCLUDED_DIRECTORIES, ADDITIONAL_EXCLUDED_DIRECTORIES, and directories detected in FILTER_REGEX_EXCLUDE) to each of these linters, through its native exclusion flags or a generated ignore/config file
      • Every forwarded exclusion is logged in the linter's console section, and the ">300 gitignored files" performance warning now names the heaviest directories it found
      • Opt out globally with FORWARD_EXCLUDED_DIRECTORIES: false, or per linter with <LINTER_KEY>_FORWARD_EXCLUDED_DIRECTORIES: false

    • Default excluded directories now also include common build/cache folders: .wireit, .turbo, .nx, .yarn/cache, .pnpm-store, .parcel-cache, .angular, and the Salesforce CLI .sf / .sfdx state folders (#8646)

    • New per-linter timeout: a linter still running after 5 minutes (LINTER_TIMEOUT_SECONDS: 300 by default) is killed along with all its child processes and reported as an error (exit code 124) with an actionable message, while the other linters keep running. Raise the limit globally with LINTER_TIMEOUT_SECONDS, per linter with <LINTER_KEY>_TIMEOUT_SECONDS, or disable it with value 0 (#8665)

    • New prerun analysis mode (mega-linter-runner --prerun, or MEGALINTER_PRERUN=true environment variable): MegaLinter identifies active linters and collects files, then stops before running any linter and suggests configuration improvements, in the console and in megalinter-reports/prerun-report.json (#8653)

      • Suggested exclusions: top-level directories containing only gitignored files (safe: linting scope is unchanged, and project-mode linters stop scanning them), and well-known generated/vendored folder names (site, dist, vendor...) still containing lintable files (to confirm by the user)
      • A lighter matching flavor is also suggested when available
      • The megalinter-check agent skill uses it on the first local run to tune .mega-linter.yml with the user before the real lint
      • Fixed a performance issue where detecting .gitignored files enumerated every individual file inside large ignored folders (node_modules, build output...) instead of stopping at the folder boundary, which could make the file collection step (including prerun) take several minutes on big repositories

    • Much lighter Docker images: the main image download shrinks by 9%, flavors by 9% to 22%, and standalone megalinter-only-* images are 35% to 65% smaller (#8621)

      • If your PRE_COMMANDS compile native code: the compilation toolchain is no longer shipped in the images, install it back with apk add --no-cache gcc make musl-dev

      • Main and flavor images, compressed download size on ghcr.io, linux/amd64 (before = v9.6.0, so deltas also include the linters removed in this version):

        Image Before After Delta
        megalinter (main) 4.55 GB 4.13 GB -9%
        megalinter-c_cpp 1.61 GB 1.35 GB -16%
        megalinter-ci_light 724 MB 657 MB -9%
        megalinter-cupcake 2.52 GB 2.24 GB -11%
        megalinter-documentation 1.47 GB 1.21 GB -18%
        megalinter-dotnet 2.23 GB 1.86 GB -17%
        megalinter-dotnetweb 2.25 GB 1.88 GB -17%
        megalinter-formatters 936 MB 849 MB -9%
        megalinter-go 1.55 GB 1.35 GB -13%
        megalinter-java 1.59 GB 1.32 GB -17%
        megalinter-javascript 1.49 GB 1.23 GB -18%
        megalinter-php 1.51 GB 1.26 GB -17%
        megalinter-python 1.61 GB 1.26 GB -22%
        megalinter-ruby 1.49 GB 1.22 GB -18%
        megalinter-rust 1.99 GB 1.80 GB -10%
        megalinter-salesforce 2.09 GB 1.87 GB -10%
        megalinter-security 1.30 GB 1.17 GB -10%
        megalinter-swift 1.51 GB 1.24 GB -18%
        megalinter-terraform 1.59 GB 1.30 GB -18%

      • Standalone single-linter images, uncompressed size on linux/amd64 (before = previous beta):

        Image Before After Delta
        megalinter-only-groovy_npm_groovy_lint 1.07 GB 695 MB -35%
        megalinter-only-r_lintr 996 MB 405 MB -59%
        megalinter-only-spell_proselint 813 MB 284 MB -65%
        megalinter-only-css_stylelint 780 MB 360 MB -54%
        megalinter-only-spell_cspell 755 MB 357 MB -53%
        megalinter-only-ruby_rubocop 702 MB 301 MB -57%
        megalinter-only-perl_perlcritic 696 MB 293 MB -58%
        megalinter-only-spell_vale 683 MB 286 MB -58%
        megalinter-only-yaml_yamllint 668 MB 271 MB -59%
        megalinter-only-bash_shellcheck 660 MB 263 MB -60%
        megalinter-only-lua_luacheck 652 MB 252 MB -61%
        megalinter-only-xml_xmllint 645 MB 246 MB -62%

    • Faster startup on every run (~5 seconds saved) (#8624)

      • Linter versions now come from a manifest built into the Docker image, instead of calling every linter's --version
      • LLM Advisor libraries are only loaded when LLM_ADVISOR_ENABLED is true
      • Set the new VERSION_GET_AT_RUNTIME: true variable if your PRE_COMMANDS install different linter versions and you want the really installed versions reported

    • Faster linting when fixes are applied (APPLY_FIXES): the check-only linters of a language now run in parallel as soon as its fixer linters are done, instead of all linters of the language running one after another (#8624)

    • Faster standalone images and file-list runs: megalinter-only-* images only parse the descriptor of their single linter, and the repository-wide .gitignore enumeration is skipped when an explicit list of files is passed (e.g. `...

Read more

Contributors

bdovaz, ruzickap, and 10 other contributors
Assets 2
Loading

v9.6.0

v9.6.0
Marketplace
Marketplace

Choose a tag to compare

View all tags
@nvuillam nvuillam released this 28 Jun 12:41
v9.6.0
ef3e84b

What's Changed

  • Breaking changes

    • Linters can no longer be run via a sibling Docker image at runtime. The cli_docker_image, cli_docker_image_version and cli_docker_args descriptor properties (and the matching <LINTER>_DOCKER_IMAGE_VERSION variable) have been removed, and MegaLinter no longer mounts /var/run/docker.sock (in mega-linter-runner, the GitHub Action action.yml files, and the Docker daemon previously bundled in flavor images). This closes the host-privilege escalation surface that the mounted Docker socket exposed. The only linter that used this mechanism was SWIFT_SWIFTLINT, now installed natively (see below). (#8216)
    • SWIFT_SWIFTLINT is now installed from the static swiftlint-static binary instead of running the ghcr.io/realm/swiftlint container. It runs natively on the Alpine image with no Docker socket required. SourceKit-dependent rules are disabled in this build and reported to the console when encountered; pure-syntax style rules are unaffected. (#8216)
    • @eslint/eslintrc shim removed from JavaScript/TypeScript/JSX/TSX Docker images (was only needed for legacy FlatCompat); MegaLinter's bundled test fixtures use native flat config. (#7869)
    • ESLint linters now force migration off .eslintrc.*: JAVASCRIPT_ES, TYPESCRIPT_ES, JSX_ESLINT, TSX_ESLINT activate when they find any eslint.config.* or any deprecated .eslintrc.* / package.json#eslintConfig. In the legacy case the linter does not call ESLint at all — it emits a single hard failure with a migration message so the build stays red until the config is migrated to flat config. See the ESLint flat-config migration guide. To opt out, set DISABLE_LINTERS or DISABLE to exclude the affected linter/descriptor. (#7869)
    • JSON_ESLINT_PLUGIN_JSONC removed: upstream bug ota-meshi/eslint-plugin-jsonc#328 blocks ESLint v10 compatibility and will not be fixed. Use JSON_JSONLINT, JSON_PRETTIER, or JSON_V8R for JSON validation instead. (#7869)

  • Core

    • New linter descriptor property common_linter_errors: declare known non-lint failure patterns (config issue, remote service down, missing credentials…) and the guidance message shown to users, directly in YAML — no custom Python class needed. (#7907)
    • Skipped-linters summary now explains why a linter was skipped by an activation rule, including the variable to set to activate it (e.g. MARKDOWN_RUMDL: MARKDOWN_DEFAULT_STYLE=markdownlint (set MARKDOWN_DEFAULT_STYLE=rumdl to activate)), fixing #8017.

  • New linters

    • Add betterleaks linter for repository secrets scanning — successor to gitleaks with higher recall (98.6% vs 70.4%), lower false-positive rates, and 4–5× faster scanning via BPE-based detection and CEL filter expressions (#8186)

  • Disabled linters

    • SALESFORCE_SFDX_SCANNER_APEX, SALESFORCE_SFDX_SCANNER_AURA and SALESFORCE_SFDX_SCANNER_LWC — disabled because sfdx-scanner 4.12.0 crashes on Node.js 22+ (TypeError: Cannot read properties of undefined (reading 'prototype'), caused by the removal of SlowBuffer.prototype), which is shipped with Alpine 3.24. These linters were already deprecated; use the SALESFORCE_CODE_ANALYZER_APEX / SALESFORCE_CODE_ANALYZER_AURA / SALESFORCE_CODE_ANALYZER_LWC variants instead (#8080).

  • Deprecated linters

    • REPOSITORY_GITLEAKS — deprecated in favour of REPOSITORY_BETTERLEAKS (same author, fully compatible config, significantly better detection). Will be removed in the next major release. Disable it by adding REPOSITORY_GITLEAKS to DISABLE_LINTERS in your .mega-linter.yml. (#8186)

  • Removed linters

    • JSON_ESLINT_PLUGIN_JSONC — permanently broken by upstream bug (see Breaking changes) (#7869)

  • Linters enhancements

    • REPOSITORY_CHECKOV: in pull-request mode, scan only the files modified in the PR instead of the whole repository (#7119)

  • Fixes

    • REPOSITORY_BETTERLEAKS: default scan now runs in filesystem (dir) mode instead of auto-switching to git-history (git) mode when a git repository is detected. betterleaks does not read the global git safe.directory config, so git mode failed with fatal: detected dubious ownership in repository in CI environments (e.g. GitHub Actions /github/workspace). Git-history mode is still used for the opt-in REPOSITORY_BETTERLEAKS_PR_COMMITS_SCAN feature. (#8186)
    • REPOSITORY_BETTERLEAKS: added --verbose so detected findings (file, line and rule) are reported instead of only the leaks found: N summary, matching gitleaks behavior. Secret values stay redacted via --redact. (#8186)
    • REPOSITORY_OSV_SCANNER: exit code 128 ("No package sources found") is now treated as a clean pass instead of a failure — osv-scanner returns this code when the repo contains no lockfiles/manifests/SBOMs, which is not a vulnerability finding (#7917).
    • Fix intermittent ansible-lint load-failure[not-found] error on github_conf/branch_protection_rules.json caused by a race condition with checkov running in parallel. Checkov's transient GitHub-conf directory is now written to a hidden path (.megalinter_github_conf) that project-mode linters skip, eliminating the conflict (#8092).
    • Complete the Alpine 3.24 upgrade across the whole image and fix how alpine version is detected. Docker images now build on the python:3.14-alpine3.24 base image (#8080).
    • Avoid DeprecationWarning / future breakage on Python 3.14 by no longer passing count and flags as positional arguments to re.sub (#8211).
    • Exclude REPORT_OUTPUT_FOLDER from linting when configured as an absolute path inside the workspace (e.g. /tmp/lint/megalinter-reports), fixing #7845.
    • Fix command injection in Roslynator linter (DOTNET_ROSLYNATOR) where a crafted .csproj filename could break out of dotnet restore arguments and execute arbitrary shell commands. The command is now invoked via argv list instead of a shell string. Reported by Francesco Sabiu. (#7857)
    • Fix IndexError when building the single-linter Docker image for a linter whose activation depends on a file (e.g. SPELL_VALE requires .vale.ini): python -m megalinter.run --linterversion now bypasses activation filtering since the per-linter image is built for that linter unconditionally.
    • Fix make bootstrap appearing to hang because exported Make color variables re-evaluated tput during recursive make invocations. (#8090)
    • Allow MegaLinter containers to run in an opt-in non-root mode matching the host UID:GID on POSIX systems, avoiding root-owned generated files on the host (#1975).
    • Restore missing examples in the Dart descriptor that were dropped from the generated documentation (#7913).

  • Reporters

    • Update Bitbucket pipeline generator template to trigger builds on pull requests from any branch, by @yermulnik in #7421

  • Doc

    • Add pnpm installation and usage documentation for JavaScript and TypeScript linters (#8177)
    • Update Docker pull counters in README badges and flavors-stats.json with latest ghcr.io stats
    • Bump peter-evans/create-pull-request to v8 in the documented workflow examples (#8089)

  • mega-linter-runner

    • Add --user-map / --no-user-map to control whether the MegaLinter container runs in non-root mode. On POSIX systems --user-map uses the current host UID:GID; on other hosts it falls back to 1000:1000. (#8120)
    • Add --no-prompt flag to mega-linter-runner --upgrade for non-interactive upgrades (#8093)
    • Mark mega-linter-runner/index.js as executable in git (#8091)

  • Dev

    • Add specialized Claude Code sub-agents (pr-monitor, security-analyst, version-bumper) and assign cost-effective models to mechanical tasks, to speed up and reduce the token cost of contributor workflows (#7906).
    • Add the /fix-issue Claude Code skill for end-to-end GitHub issue fixes (gather context, implement on a branch, open a PR, watch CI) (#7848).
    • Stop generating per-linter Dockerfiles for linters marked disabled: true in their descriptor. The matching images were already excluded from the build matrix (linters_matrix.json) and never published, so the on-disk linters/<linter>/Dockerfile was dead code. Deleted the 8 corresponding stale Dockerfile directories.
    • Make the build's config-schema write atomic with a retry (write to a temp file then os.replace), so a transient file lock from an editor's JSON language server or antivirus no longer crashes the build with OSError: [Errno 22] on Windows.
    • Move the .devcontainer setup from the Dockerfile to a JSON configuration file (#7865).
    • Update the Python version in the devcontainer image (#7853).

  • CI

    • Build the real { linter, platform, runner } job list directly in get-linters-matrix for the DEV and BETA linter workflows, instead of a linter×runner cross-product filtered at runtime by job_enabled. Removes the Prepare step and the no-op jobs while preserving selection logic (#8133, #8134).
    • Track image-runtime shell scripts (setup-runtime-user, megalinter_exec) in the image-build path filters by renaming them to .sh, so changes to them correctly trigger image rebuilds; generated images now use root-independent command wrappers instead of shell aliases (#8213).
    • Suppress the new ref-version-mismatch audit introduced by zizmor 1.25.0 for the project's pinned uses: action references. The SHA pins are correct (the supply-chain property); only the inline # vX comments lag behind exact subversions, and renovate maintains the hashes.
    • Simplify the workflow trigger condition to prevent duplicate runs for pushes from forks.
    • Fix the deploy-dev workfl...
Read more

Contributors

bdovaz, yermulnik, and 5 other contributors
Loading

v9.5.0

v9.5.0
Marketplace
Marketplace

Choose a tag to compare

View all tags
@nvuillam nvuillam released this 16 May 13:17
v9.5.0
0e3ce9b

What's Changed

Take 2 mn to read MegaLinter v9.5.0 announcements

  • Breaking changes

    • Docker images published only to GitHub Container Registry (ghcr.io) until OIDC-based publishing to Docker Hub is implemented. The Docker Hub registry (docker.io/oxsecurity/megalinter) is frozen at v9.4.0: pulls of oxsecurity/megalinter:v9 (or :beta, or any flavor tag) will keep returning v9.4.0. To get v9.5.0 and later from CI tools other than GitHub Actions (GitLab CI, Azure Pipelines, Bitbucket, Jenkins, Drone, raw docker run, …), switch your image references:

      • oxsecurity/megalinter:v9 → ghcr.io/oxsecurity/megalinter:v9
      • oxsecurity/megalinter:beta → ghcr.io/oxsecurity/megalinter:beta
      • oxsecurity/megalinter-<flavor>:v9 → ghcr.io/oxsecurity/megalinter-<flavor>:v9

      GitHub Action users (uses: oxsecurity/megalinter@v9) and mega-linter-runner users are not affected, as both already pull from ghcr.io.

    • ESLint-based linters upgraded to v10+. Legacy .eslintrc.* configs are no longer supported: you must migrate to flat-config (eslint.config.js) to keep using JAVASCRIPT_ES, TYPESCRIPT_ES, JSX_ESLINT, TSX_ESLINT, and JSON_ESLINT_PLUGIN_JSONC.

    • Airbnb and Standard ESLint configs replaced (they never shipped ESLint 9+ support):

      • extends: ["airbnb"] → extends: ["airbnb-extended"]
      • extends: ["standard"] → extends: ["neostandard"]

  • Core

    • User notifications system: linters can surface structured "Notices" to end users in the PR comment / report footer (used for ESLint migration, deprecated options, etc.), replaces the ad-hoc migration warnings
    • Security: more default hidden environment variables, so a compromised linter cannot leak your secrets
    • Upgrade .NET runtime to 10.0 (csharpier, dotnet-format, roslynator, devskim, tsqllint, vbdotnet-format)
    • Upgrade GO runtime to 1.26.3

  • New linters

    • osv-scanner: trivy-like vulnerability scanner by Google
    • zizmor: GitHub Actions static analysis

  • Disabled linters

    • KICS (until upstream security issue is fixed)
    • Spectral (crashing)

  • Re-enabled linters

  • Deprecated linters

  • Removed linters

  • Media

  • Linters enhancements

    • ESLint: legacy .eslintrc.* configs are now detected and a migration notice is emitted in the report so users know they need to switch to flat-config
    • shellcheck: honour the BASH_SHELLCHECK_CONFIG_FILE variable / .shellcheckrc config file
    • raku (Rakudo): now ships on ARM64 too
    • scala: linter installation is now deterministic (same binary across rebuilds)
    • v8r (JSON/YAML schema validation): output now shows only validation errors (no more "no schema found" or success noise)
    • lychee: removed the deprecated exclude_mail option (no longer supported by lychee upstream)
    • Faster image pulls: several linters (Lua/StyLua arm64, clj-kondo, kubescape, ls-lint, dotenv-linter) now use pre-built Alpine binaries instead of compiling from source

  • Fixes

    • Console output: linters now show their log sections (not only on errors), the results table and reporter logs are printed after linters complete, and parallel-run logs are no longer interleaved
    • YAML_V8R_CONFIG_FILE / JSON_V8R_CONFIG_FILE are now correctly applied (the v8r --catalogs option is wired through)
    • lychee: fix the configured headers / Accept settings being ignored
    • Custom flavor builder: works correctly for repositories whose name contains uppercase characters
    • Docs: corrected the documented default value for the pre-commands cwd option

  • Reporters

    • Comment reporters (GitHub, GitLab, Azure DevOps, Bitbucket) now work when running MegaLinter from Jenkins CI
    • GitlabCommentReporter activates as soon as GITLAB_ACCESS_TOKEN_MEGALINTER is set (no longer requires CI_JOB_TOKEN)
    • BitbucketCommentReporter: per-linter sections rendered as ### headings (Bitbucket Cloud markdown was displaying the previous <details> HTML tags as literal text)
    • Display a default user notification on PR/console reports inviting users to read the MegaLinter 9.5.0 release announcement. Can be disabled by setting SECURITY_SUGGESTIONS: false.

  • Flavors

    • Multi-arch images: In custom flavors, linters can now build for linux/arm64 in addition to linux/amd64 whenever possible (Apple Silicon, AWS Graviton, Ampere…)

  • Doc

    • Add documentation for the megalinter-ado Azure DevOps extension and the megalinter-mcp-server MCP server
    • Explicitly discourage the use of Personal Access Tokens (PAT) in workflows for security reasons

  • mega-linter-runner

    • New --list-vars [pattern] flag (with --json) lists every MegaLinter env variable that can be passed via -e, with type, default, allowed values and examples (handy for AI coding agents)
    • -e ENABLE_LINTERS=YAML_PRETTIER,YAML_YAMLLINT no longer silently drops values after the first comma (#7500). The --env=KEY=VALUE long form is also accepted.

  • Dev

    • Add CLAUDE.md and a set of /add-linter, /update-linter-version, /review-descriptor, /fix-linter-test, /add-reporter, /add-flavor, /build, /diagnose-config, /fix-security-issue skills to help work on MegaLinter with coding agents (Claude Code, GitHub Copilot, Codex, gemini-cli…)
    • Migrate copilot-instructions into Claude Code Agents & Skills
    • New descriptor capabilities for custom linter integrations: cli_lint_extra_args_after per lint mode (list_of_files / project / file), a {file} template variable usable in command-line args, and a customizable files separator

  • CI

    • Run ARM linter jobs only when the commit message contains "ARM" (avoids 200 jobs per PR)
    • Do not push a fix commit if only markdown or JSON files were updated
    • Run osv-scanner on MegaLinter's own sources
    • Optimize the linter-job matrix for dependabot and renovate PRs
    • Exclude test dependencies from dependabot
    • Faster Docker image builds: optimized Dockerfile layer order, buildx layer cache (type=gha, zstd-compressed) on all deploy workflows, DEV pipeline split into parallel jobs sharing the image via cache, and cargo-based tools (sarif-fmt, zizmor, shellcheck-sarif, stylua) built in parallel multi-stage builders so the Rust toolchain no longer ships in the final image (except for clippy)
    • Hardened MegaLinter's own GitHub Actions workflows against script injection via untrusted PR contexts (zizmor findings)

  • Linter versions upgrades (62)

Read more

Contributors

bdovaz, renovate, and 6 other contributors
Loading

v9.4.0

v9.4.0
Marketplace
Marketplace

Choose a tag to compare

View all tags
@nvuillam nvuillam released this 28 Feb 10:07
v9.4.0
8fbdead

What's Changed

  • Core

    • Improve files browsing performances (2 PRs)
    • Optimize parallel linter processing and improve grouping logic
    • Improve performance of listing .gitignored files by sending excluded directories to git ls-files
    • If there are more than 500 .gitignored files, advise to add more excluded directories using variable ADDITIONAL_EXCLUDED_DIRECTORIES, to improve performances
    • Reduce redundant config lookups, environment copies, and dict rebuilds across config, linter, and utils modules
    • Cache subprocess environment per linter run and excluded directories per request
    • Optimize parallel linter result update from O(n²) to O(n)
    • Add support in the build of Docker images for linux/arm64 in compatible linters

  • New linters

  • Disabled linters

  • Linters enhancements

    • Use the official checkmake image by @bdovaz
    • Spectral: Add sarif support to spectral by @bdovaz
    • Spectral: Change cli_lint_mode to list_of_files to improve performances

  • Fixes

    • Add support for SSH remote origins when building custom flavors (fixes: #6511)
    • Fix issue with plugins ignored when FLAVOR_SUGGESTIONS=false
    • Fix wrong tagging apply_fixes=True when linter has no fix options configured
    • Python mypy: Remove .ipynb from file extensions (mypy doesn't support notebooks directly) - fixes #6904
    • Fix operator precedence bug in pre_post_factory pre/post command logic
    • Fix file handle leak in GitleaksLinter
    • Fix variable name bug in utils.get_git_context_info
    • Minor fixes in logger, SqlFluffLinter, PowershellLinter, TrivyLinter

  • Reporters

    • Add a link inviting to star MegaLinter
    • Display in the console reporter the working directory from which the commands are executed by @bdovaz
    • Update WebHook reporter so it can send more events for a better integration with UI
    • When truncating long comments in markdown reports, keep the end of the text instead of the beginning (which usually contains less useful information)
    • In case GitHub Api returns 500, do not make the whole MegaLinter fail, display a warning instead
    • Azure Reporter: Use Azure DevOps Services REST API instead of unmaintained python wrapper lib

  • Flavors

    • Custom flavor builder:
      • Add support for SSH remotes
      • Allow selection of platforms to build the custom flavor on (ex: linux/amd64, linux/arm64) and build compatible linters on these platforms
      • Build & release custom flavor builder image for linux/arm64

  • Doc

    • JSON Schema: Add default values for file extensions and file names variables + improve descriptions
    • Update default secured env variables documentation
    • Fix banner img in json_prettier and yaml_prettier docs
    • Explain better how to run tests locally
    • Vale: Mention community style packages in linter description

  • CI

    • Free more space on GitHub Actions runners to avoid build failures
    • Ignore .isorted files in secretlint to avoid scanning transient files created by other linters
    • Avoid duplicate jobs "Mirror docker image"
    • Allow to skip linters build using skip linters in latest commit text
    • Allow to disable build & push of standalone linters docker images using variable BETA_LINTERS_ENABLED=false
    • Improve performances of formatting markdown tables during build
    • Improve test classes performances and fix race conditions
    • Fix plugin test to work with forks and feature branches
    • Update .devcontainer image to trixie

  • mega-linter-runner

    • If variables are defined in a local .env file, send their values to docker/podman run command (can be useful for secret variables)
    • Never send .env file to the docker run for security reasons, instead create an empty one if needed
    • Use npm trusted publishers (OIDC) to publish mega-linter-runner

  • Linter versions upgrades (59)

Pull Requests
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6890
  • ci: ignore urls with parameters by @bdovaz in #6892
  • chore: fix invalid urls by @bdovaz in #6893
  • chore(deps): lock file maintenance by @renovate[bot] in #6895
  • chore(deps): update dependency @salesforce/plugin-code-analyzer to v5.8.0 by @renovate[bot] in #6894
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6896
  • chore(deps): update dependency rumdl to v0.0.209 by @renovate[bot] in #6897
  • chore(deps): update dependency rumdl to v0.0.210 by @renovate[bot] in #6901
  • chore(deps): update dependency cfn-lint to v1.43.2 by @renovate[bot] in #6900
  • [...
Read more

Contributors

djukxe, bdovaz, and 7 other contributors
Loading

v9.3.0

v9.3.0
Marketplace
Marketplace

Choose a tag to compare

View all tags
@nvuillam nvuillam released this 04 Jan 09:46
v9.3.0
42bb470

What's Changed

Pull Requests
  • Frees disk space on GitHub Actions runners by @nvuillam in #6662
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6663
  • chore(deps): update dependency eslint-plugin-vue to v10.6.2 by @renovate[bot] in #6660
  • chore(deps): update dependency overtrue/phplint to v9.6.3 by @renovate[bot] in #6664
  • feat(linter): add codespell linter by @ideaship in #6256
  • chore(deps): lock file maintenance by @renovate[bot] in #6667
  • Disable codespell on MegaLinter by @nvuillam in #6668
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6670
  • Bump fastapi from 0.121.3 to 0.123.0 in /server by @dependabot[bot] in #6674
  • Bump fastapi from 0.121.3 to 0.123.0 in /.config/python/dev by @dependabot[bot] in #6671
  • Bump pymdown-extensions from 10.17.1 to 10.17.2 in /.config/python/dev by @dependabot[bot] in #6673
  • Bump beautifulsoup4 from 4.14.2 to 4.14.3 in /.config/python/dev by @dependabot[bot] in #6672
  • Bump the npm_and_yarn group across 1 directory with 3 updates by @dependabot[bot] in #6676
  • chore(deps): update dependency mega-linter-runner to v9.2.0 by @renovate[bot] in #6680
  • chore(deps): update checkmarx/kics docker tag to v2.1.17 by @renovate[bot] in #6677
  • chore(deps): update dependency fastapi to v0.123.5 by @renovate[bot] in #6678
  • chore(deps): update dependency ruff to v0.14.7 by @renovate[bot] in #6679
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6681
  • chore(deps): update dependency pylint to v4.0.4 by @renovate[bot] in #6682
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6684
  • chore(deps): update dependency sfdx-hardis to v6.12.10 by @renovate[bot] in #6683
  • chore(deps): update dependency stylelint to v16.26.1 by @renovate[bot] in #6685
  • chore(deps): update trufflesecurity/trufflehog docker tag to v3.91.2 by @renovate[bot] in #6687
  • chore(deps): update dependency fastapi to v0.123.7 by @renovate[bot] in #6686
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6688
  • chore(deps): update dependency pmd/pmd to v7.19.0 by @renovate[bot] in #6694
  • chore(deps): update actions/setup-node action to v6.1.0 by @renovate[bot] in #6689
  • chore(deps): update dependency ansible-lint to v25.12.0 by @renovate[bot] in #6690
  • chore(deps): update dependency golangci/golangci-lint to v2.7.1 by @renovate[bot] in #6692
  • chore(deps): update dependency mypy to v1.19.0 by @renovate[bot] in #6693
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6691
  • chore(deps): update dependency ruff to v0.14.8 by @renovate[bot] in #6697
  • chore(deps): update dependency friendsofphp/php-cs-fixer to v3.91.2 by @renovate[bot] in #6700
  • chore(deps): update dependency urllib3 to v2.6.0 [security] by @r...
Read more

Contributors

bdovaz, renovate, and 4 other contributors
Loading

v9.2.0

v9.2.0
Marketplace
Marketplace

Choose a tag to compare

View all tags
@nvuillam nvuillam released this 29 Nov 16:07
v9.2.0
55a59b2

What's Changed

Pull Requests
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6307
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6310
  • chore(config): migrate renovate config by @renovate[bot] in #6309
  • chore(deps): update dependency sfdx-hardis to v6.7.1 by @renovate[bot] in #6303
  • chore(deps): update dependency ansible-lint to v25.9.2 by @renovate[bot] in #6312
  • chore(deps): update dependency aquasecurity/trivy to v0.67.2 by @renovate[bot] in #6313
  • chore(deps): update dependency snakemake to v9.13.2 by @renovate[bot] in #6304
  • chore(deps): update dependency cfn-lint to v1.40.1 by @renovate[bot] in #6314
  • chore(deps): update dependency fastapi to v0.118.3 by @renovate[bot] in #6315
  • chore(deps): update dependency langchain_anthropic to v0.3.22 by @renovate[bot] in #6316
  • chore(deps): update dependency python-gitlab to v6.4.0 by @renovate[bot] in #6243
  • chore(deps): update dependency puppet-lint to v5.1.0 by @renovate[bot] in #6239
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6311
  • chore(deps): update tflint plugin terraform-linters/tflint-ruleset-google to v0.36.0 by @renovate[bot] in #6246
  • chore(deps): update dependency eslint-plugin-vue to v10.5.0 by @renovate[bot] in #6207
  • chore(deps): update dependency langchain_community to v0.3.31 by @renovate[bot] in #6317
  • chore(deps): update dependency langchain_core to v0.3.79 by @renovate[bot] in #6318
  • chore(deps): update rhysd/actionlint docker tag to v1.7.8 by @renovate[bot] in #6319
  • chore(deps): update dependency ruff to v0.14.0 by @renovate[bot] in #6320
  • chore(deps): update dependency pylint to v4 by @renovate[bot] in #6321
  • chore(deps): update dependency npm to v11.6.2 by @renovate[bot] in htt...
Read more

Contributors

bdovaz, renovate, and 6 other contributors
Loading

v9.1.0

v9.1.0
Marketplace
Marketplace

Choose a tag to compare

View all tags
@nvuillam nvuillam released this 07 Oct 18:58
v9.1.0
62c799d

What's Changed

  • New linters

  • Linters enhancements

    • Python Linting: Added more file type supports for various linters. Full description here

  • Doc

    • Add OLLAMA_BASE_URL is MegaLinter config Json schema

  • Flavors

    • Custom flavors: Add workflow to automate detection of new MegaLinter versions and generation of new Custom Flavor

  • CI

    • Fix v9 release issue + mark hardcoded versions to upgrade at each new major release.

  • Linter versions upgrades (22)

Pull Requests
  • chore(deps): update alpine/terragrunt docker tag to v1.13.3 by @renovate[bot] in #6201
  • chore(deps): update dependency @salesforce/cli to v2.106.6 by @renovate[bot] in #6199
  • chore(deps): update dependency fastapi to v0.117.1 by @renovate[bot] in #6195
  • chore(deps): update dependency @salesforce/plugin-packaging to v2.20.4 by @renovate[bot] in #6198
  • chore(deps): update dependency sfdx-hardis to v6.5.2 by @renovate[bot] in #6202
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6203
  • chore(deps): update dependency golangci/golangci-lint to v2.5.0 by @renovate[bot] in #6204
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6205
  • Adding supported filetypes to black, bandit, mypy, pylint, isort, and pyright Python linters by @CraigCallender in #6214
  • chore(deps): update dependency sfdx-hardis to v6.5.3 by @renovate[bot] in #6213
  • chore(deps): update dependency mega-linter-runner to v9.0.1 by @renovate[bot] in #6200
  • chore(deps): lock file maintenance by @renovate[bot] in #6206
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6216
  • chore(deps): update dependency eslint to v9.36.0 - autoclosed by @renovate[bot] in #6211
  • Bump hadolint/hadolint from v2.13.1-alpine to v2.14.0-alpine in /server by @dependabot[bot] in #6210
  • chore(deps): update hadolint/hadolint docker tag to v2.14.0 by @renovate[bot] in #6208
  • chore(deps): update dependency puppet-lint to v5 by @renovate[bot] in #6221
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6219
  • chore(deps): update dependency uvicorn to v0.37.0 by @renovate[bot] in #6220
  • chore(deps): update checkmarx/kics docker tag to v2.1.14 by @renovate[bot] in #6215
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6222
  • chore(deps): update dependency @salesforce/cli to v2.107.6 by @renovate[bot] in #6226
  • chore(deps): update dependency snakemake to v9.11.6 by @renovate[bot] in #6217
  • chore(deps): update typescript-eslint monorepo to v8.44.1 (patch) by @renovate[bot] in #6212
  • chore(deps): update dependency phpstan/phpstan to v2.1.29 by @renovate[bot] in #6228
  • chore(deps): update dependency friendsofphp/php-cs-fixer to v3.88.2 by @renovate[bot] in #6227
  • Add Robocop linter by @bdovaz in #6232
  • chore(deps): update dependency npm to v11.6.1 by @renovate[bot] in #6224
  • chore(deps): update dependency ruff to v0.13.2 by @renovate[bot] in #6237
  • chore(deps): update dependency @salesforce/plugin-packaging to v2.20.5 by @renovate[bot] in #6225
  • chore(deps): update dependency langchain_community to v0.3.30 by @renovate[bot] in #6233
  • chore(deps): update dependency sfdx-hardis to v6.5.4 by @renovate[bot] in #6238
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6236
  • chore(deps): update dependency pyyaml to v6.0.3 by @renovate[bot] in #6234
  • chore(deps): update dependency rubocop to v1.81.1 by @renovate[bot] in #6240
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6241
  • fix(deps): update dependency yeoman-environment to v5 by @renovate[bot] in #6248
  • chore(deps): update dependency rubocop-rails to v2.33.4 - autoclosed by @renovate[bot] in #6235
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6247
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6250
  • chore(deps): update dependency robotframework-robocop to v6.7.1 by @renovate[bot] in #6249
  • Bump beautifulsoup4 from 4.13.5 to 4.14.2 in /.config/python/dev by @dependabot[bot] in #6260
  • Bump fastapi from 0.117.1 to 0.118.0 in /server by @dependabot[bot] in #6259
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6253
  • chore(deps): update dependency fastapi to v0.118.0 by @renovate[bot] in #6252
  • chore(deps): update dependency checkov to v3.2.473 by @renovate[bot] in #6251
  • chore(deps): update dependency langchain_anthropic to v0.3.21 by @renovate[bot] in #6261
  • chore(deps): update dependency astral-sh/uv to v0.8.22 by @renovate[bot] in #6264
  • chore(deps): update dependency ansible-lint to v25.9.1 by @renovate[bot] in #6263
  • chore(deps): update dependency mkdocs-material to v9.6.21 by @renovate[bot] in #6266
  • chore(deps): update dependency langchain_core to v0.3.77 by @renovate[bot] in #6265
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6267
  • chore(deps): update dependency phpstan/phpstan to v2.1.30 by @renovate[bot] in #6268
  • chore(deps): update dependency pyright to v1.1.406 - autoclosed by @renovate[bot] in #6269
  • chore(deps): update dependency robotframework-robocop to v6.7.2 by @renovate[bot] in #6271
  • chore(deps): update dependency ruff to v0.13.3 by @renovate[bot] in #6272
  • chore(deps): update dependency mocha to v11.7.3 by @renovate[b...
Read more

Contributors

bdovaz, renovate, and 3 other contributors
Loading

v9.0.1

v9.0.1
Marketplace
Marketplace

Choose a tag to compare

View all tags
@nvuillam nvuillam released this 21 Sep 00:53
v9.0.1
0dcbedd

What's Changed

  • Fix v9 release issue
Pull Requests
  • chore(deps): update dependency mega-linter-runner to v9 by @renovate[bot] in #6191
  • chore(deps): update dependency sfdx-hardis to v6.5.1 by @renovate[bot] in #6188
  • chore(deps): update tflint plugin terraform-linters/tflint-ruleset-aws to v0.43.0 by @renovate[bot] in #6190
  • Update README with v9 announcement by @nvuillam in #6193
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #6194
  • chore(deps): update dependency uvicorn to v0.36.0 by @renovate[bot] in #6189
  • Fix v9 release issue by @nvuillam in #6197

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v9.0.0..v9.0.1

Contributors

renovate and nvuillam
Loading

v9.0.0

v9.0.0
Marketplace
Marketplace

Choose a tag to compare

View all tags
@nvuillam nvuillam released this 20 Sep 09:46
v9.0.0
ff177bf

What's Changed

  • Core

    • Create your own Megalinter Custom Flavors to dramatically improve your performances
      • See documentation for usage
      • Use npx mega-linter-runner@beta --custom-flavor-setup to initialize repo
      • Suggest new flavors in reporters with a mega-linter-runner including the list of linters
    • New LLM Advisor: call external LLMs to get hints to solve linter errors, available in:
      • Console Reporter
      • Text Reporter
      • Git platforms PR/MR comments Reporter
    • Use ghcr.io docker images by default because of rate limits on docker.io
    • Use uv to create the venv folder for pip-installed linters
    • Add copilot instructions for GitHub Copilot
    • Update base image to python:3.13-alpine3.21 (also embeds go 1.24)

  • Disabled linters

  • Removed linters

    • markdown-link-check has been removed because lychee can be used instead, and has much better performances

  • Linters enhancements

    • PHP-CS-Fixer is able to run on PHP 8.4 without error (change default configuration) by @llaville
    • cspell: Filter output lines that do not contain found issues
    • hadolint: Extend DOCKERFILE_HADOLINT_FILE_NAMES_REGEX to include the purpose.Dockerfile convention eg service.Dockerfile.
    • sqlfluff: Handle fixing of issues

  • Fixes

    • When linter is docker based, force --platform=linux/amd64 so it works when running locally on Mac
    • Added checking of *.pyi and *.ipynb files to the ruff and ruff-format linters

  • Reporters

    • New default display for Pull Request comments, with expandable sections containing the first 1000 lines of the output log. Former display remains available by defining REPORTERS_MARKDOWN_SUMMARY_TYPE=table
    • Markdown summary reporter:
      • Write a file for Github integration if GITHUB_STEP_SUMMARY is set
      • Truncate less linter output lines
    • Text reporter: Change the output file names to put the linter name first, then the status
    • Enhance display of markdown summary

  • Doc

    • Update documentation in all megalinter descriptor files to improve accuracy and consistency
    • Fix incorrect information in linters documentation and descriptors
    • Remove dead links
    • Add linter description (linter_text) in all linter descriptor, to generate a more exhaustive documentation.
    • Update contributing guide to explain how to manage python dependencies in the codebase

  • Flavors

    • Do not suggest flavors that have more linters than the current one

  • CI

    • Update default MegaLinter CI/CD workflows to disable LLM_ADVISOR in case of bot pull requests

  • mega-linter-runner

    • Add all CI/CD providers in the --install command
    • Use ghcr.io docker images by default
    • New parameter --container-engine allowing to use podman as runner
    • mega-linter-runner --upgrade: Handle upgrade of github actions to their latest version
    • mega-linter-runner --upgrade: Upgrades MegaLinter actions and images to v9

  • Linter versions upgrades (68)

Pull Requests
  • [automation] Auto-update linters version, help and documentation by @nvuillam in #5599
  • chore(deps): update dependency sfdx-hardis to v5.41.0 by @renovate[bot] in #5601
  • chore(deps): update dependency eslint-plugin-jest to v28.14.0 by @renovate[bot] in #5600
  • chore(deps): lock file maintenance by @renovate[bot] in #5602
  • chore(deps): update dependency mypy to v1.16.1 by @renovate[bot] in #5604
  • chore(deps): update trufflesecurity/trufflehog docker tag to v3.89.2 by @renovate[bot] in #5605
  • chore(deps): update dependency mega-linter-runner to v8.8.0 by @renovate[bot] in #5598
  • Updates linter documentation with more details by @nvuillam in #5603
  • chore(deps): update dependency lightning-flow-scanner to v3.23.1 by @renovate[bot]...
Read more

Contributors

llaville, dannystaple, and 8 other contributors
Loading

v8.8.0

v8.8.0
Marketplace
Marketplace

Choose a tag to compare

View all tags
@nvuillam nvuillam released this 15 Jun 16:20
v8.8.0
e08c2b0

What's Changed

New Contributors

MegaLinter is graciously provided by OX Security

Full Changelog: v8.7.0...v8.8.0

Contributors

bdovaz, johndutchover, and nvuillam
Loading