Strengthen supply-chain security: remove replaceable dependencies and add 7-day update cooldowns - #8710
Merged
Conversation
… add 7-day update cooldowns - Renovate: global minimumReleaseAge of 7 days (security updates bypass it) - Dependabot: cooldown of 7 days on every version-update block (security updates are not delayed) - Python: remove commentjson, terminaltables, multiprocessing_logging, termcolor, regex and importlib-metadata, replaced by stdlib equivalents (JSONC parser, ascii table renderer, logging QueueHandler/QueueListener, ANSI codes, balanced-brace JSON scanner) - mega-linter-runner: remove chalk, fs-extra, which, uuid, find-package-json, simple-git, mem-fs and assert, replaced by Node.js built-ins (util.styleText, fs/fs.promises, PATH scan); engines raised to Node.js >= 22 - Fix mega-linter-runner --version fallback that always displayed 'error' (ESM __dirname ReferenceError)
nvuillam
requested review from
Kurt-von-Laven,
bdovaz and
echoix
as code owners
August 9, 2026 22:48
Contributor
✅
|
… harden JSON block extraction - The custom flavor generator imported simple-git (removed as a direct dependency): replace its two usages (first remote fetch URL, git user.name) with git CLI calls via child_process. Local tests only passed because the stale package was still present in node_modules - extract_json_blocks now also returns balanced JSON blocks nested under a never-closed brace, matching the resilience of the recursive regex it replaced when linter output contains unmatched braces before the JSON
nvuillam
force-pushed
the
dependency-hardening
branch
from
August 9, 2026 23:06
94873de to
94c492a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Reduce MegaLinter's supply-chain attack surface:
Update bots (7-day cooldown, security bypasses)
minimumReleaseAge: 7 days, replacing the npm-onlysecurity:minimumReleaseAgeNpmpreset (3 days).vulnerabilityAlerts.minimumReleaseAge: nullis made explicit so security PRs are never delayedcooldown: default-days: 7on every version-update block. Dependabot security updates are not subject to cooldown by designPython: 6 dependencies removed (all replaced by stdlib)
commentjsonlark-parserutils.parse_jsonc(also tolerates trailing commas)terminaltablesutils_reporter.build_ascii_table(~30 lines, same output format)multiprocessing_logginglogging.handlersQueueHandler/QueueListeneraround the linters pooltermcolorforce_colorwas already used)regex(?R)patternutils.extract_json_blocks(also string-aware, which the regex was not)importlib-metadatapython_version < '3.9'while the project requires >= 3.12uv.lockdrops 5 packages (including transitivelark-parser);.config/python/dev/requirements.txtupdated accordingly. Deadterminaltablesdisplay code in.automation/build.py(already disabled) removed as well.mega-linter-runner: 8 npm dependencies removed
chalklib/colors.jsshim onnode:util.styleTextfs-extranode:fs/fs.promises(cpSync,rmSync,mkdir recursive, …)whichlib/which.jsPATH scan (~20 lines)find-package-jsonpackage.jsonuuidsimple-gitmem-fsyeoman-environmentfor theyeoman-generatorpeerassert(dev)enginesraised to Node.js >= 22 (Node 20 is EOL since April 2026;util.styleTextneeds >= 20.12 anyway). Repo CI already runs Node 24.Also fixes a latent bug: the
--versionfallback referenced__dirnamein ESM code, so it always displayedmega-linter-runner version errorwhennpm_package_versionwas unset.Kept on purpose
jsonpickle,pytablewriter,gitpython,pygithub,python-gitlab(maintained, non-trivial to replace);pyjwt/urllib3floor pins (security floors)glob(no stablefs.globbefore Node 24),optionator(help generation),prompts,open,js-yaml, yeomanValidation
terminaltablesoutput)mega-linter-runner: 131 mocha tests passing locally (Docker-dependent suites excluded);--versionand--helpverified vianode lib/index.jsblack/flake8clean on changed Python files;uv.lockdiff is deletions-only with lockfile revision preserved