Skip to content

v10.0.0

Latest
Marketplace
Latest
Marketplace

Choose a tag to compare

View all tags
@nvuillam nvuillam released this 08 Aug 10:22
· 18 commits to main since this release
v10.0.0
15e5b45

What's Changed

  • Breaking changes

    • Removed 14 deprecated or long-disabled linters, and the API, MAKEFILE and PUPPET descriptors, which had no other linter left. MegaLinter does not provide Makefile and Puppet linting anymore. See the new Removed linters page for the full list and suggested replacements. (#8606)
    • REPOSITORY_GITLEAKS has been removed: migrate to REPOSITORY_BETTERLEAKS, which reads your existing .gitleaks.toml and .gitleaksignore files unchanged. (#8606)
    • Existing .mega-linter.yml files keep working: configuration variables of removed linters are simply ignored (a single notice lists any found in your configuration) and remain valid in the JSON schema. (#8606)
    • API Reporter payload v2 replaces the v1 payload: metric series are renamed (linter_run_* becomes megalinter_linter_run_*, plus new run-level megalinter_run_* series), and the old docs/grafana dashboards are superseded. Re-provision the new dashboards with npx mega-linter-runner --upload-dashboards grafana — see the migration notes. Legacy NOTIF_API_* variables remain supported as aliases. (#8661)
    • Linters now time out after 5 minutes by default (LINTER_TIMEOUT_SECONDS: 300): a linter exceeding it is killed and reported as an error (exit code 124) instead of running (or hanging) unbounded. If some of your linters legitimately run longer, raise the limit globally with LINTER_TIMEOUT_SECONDS, per linter with <LINTER_KEY>_TIMEOUT_SECONDS, or restore the previous unbounded behavior with value 0. (#8665)

  • Core

    • Coding agents integration: MegaLinter can now be driven by Claude Code, Cursor CLI, GitHub Copilot CLI, Codex and many other coding agents — see the new Coding Agents documentation page (#8614)

      • Install the MegaLinter agent skills with npx skills add oxsecurity/megalinter
      • Then ask your agent to set up MegaLinter (megalinter-setup), watch CI or local runs (megalinter-check) or fix lint errors (megalinter-fix)
      • Before the first local run, the skills now make sure the user is aware that MegaLinter is Docker-based and needs a good computer configuration and internet connection (the image download can weigh several GB), and suggest watching CI results instead when that is a problem
      • Local runs launched by the skills now cap PARALLEL_PROCESS_NUMBER to 4 on local computers (CI runs keep one parallel linter process per CPU core), so linting does not saturate the machine
      • Local runs launched by the skills now always activate the JSON reporter (not generated by default) to read results reliably, and fall back to the report folder configuration then the console output instead of waiting for report files that a repository configuration may have disabled

    • Excluded directories are now forwarded to project-mode linters, massively speeding up local runs, fixes #8645

      • Linters that scan the whole workspace by themselves (REPOSITORY_TRIVY, REPOSITORY_CHECKOV, REPOSITORY_GRYPE, REPOSITORY_TRUFFLEHOG, REPOSITORY_SEMGREP and 50+ others) used to crawl everything, including build caches and node_modules: a seconds-long CI lint could take hours on a local checkout
      • MegaLinter now automatically passes the excluded directories (defaults, EXCLUDED_DIRECTORIES, ADDITIONAL_EXCLUDED_DIRECTORIES, and directories detected in FILTER_REGEX_EXCLUDE) to each of these linters, through its native exclusion flags or a generated ignore/config file
      • Every forwarded exclusion is logged in the linter's console section, and the ">300 gitignored files" performance warning now names the heaviest directories it found
      • Opt out globally with FORWARD_EXCLUDED_DIRECTORIES: false, or per linter with <LINTER_KEY>_FORWARD_EXCLUDED_DIRECTORIES: false

    • Default excluded directories now also include common build/cache folders: .wireit, .turbo, .nx, .yarn/cache, .pnpm-store, .parcel-cache, .angular, and the Salesforce CLI .sf / .sfdx state folders (#8646)

    • New per-linter timeout: a linter still running after 5 minutes (LINTER_TIMEOUT_SECONDS: 300 by default) is killed along with all its child processes and reported as an error (exit code 124) with an actionable message, while the other linters keep running. Raise the limit globally with LINTER_TIMEOUT_SECONDS, per linter with <LINTER_KEY>_TIMEOUT_SECONDS, or disable it with value 0 (#8665)

    • New prerun analysis mode (mega-linter-runner --prerun, or MEGALINTER_PRERUN=true environment variable): MegaLinter identifies active linters and collects files, then stops before running any linter and suggests configuration improvements, in the console and in megalinter-reports/prerun-report.json (#8653)

      • Suggested exclusions: top-level directories containing only gitignored files (safe: linting scope is unchanged, and project-mode linters stop scanning them), and well-known generated/vendored folder names (site, dist, vendor...) still containing lintable files (to confirm by the user)
      • A lighter matching flavor is also suggested when available
      • The megalinter-check agent skill uses it on the first local run to tune .mega-linter.yml with the user before the real lint
      • Fixed a performance issue where detecting .gitignored files enumerated every individual file inside large ignored folders (node_modules, build output...) instead of stopping at the folder boundary, which could make the file collection step (including prerun) take several minutes on big repositories

    • Much lighter Docker images: the main image download shrinks by 9%, flavors by 9% to 22%, and standalone megalinter-only-* images are 35% to 65% smaller (#8621)

      • If your PRE_COMMANDS compile native code: the compilation toolchain is no longer shipped in the images, install it back with apk add --no-cache gcc make musl-dev

      • Main and flavor images, compressed download size on ghcr.io, linux/amd64 (before = v9.6.0, so deltas also include the linters removed in this version):

        Image Before After Delta
        megalinter (main) 4.55 GB 4.13 GB -9%
        megalinter-c_cpp 1.61 GB 1.35 GB -16%
        megalinter-ci_light 724 MB 657 MB -9%
        megalinter-cupcake 2.52 GB 2.24 GB -11%
        megalinter-documentation 1.47 GB 1.21 GB -18%
        megalinter-dotnet 2.23 GB 1.86 GB -17%
        megalinter-dotnetweb 2.25 GB 1.88 GB -17%
        megalinter-formatters 936 MB 849 MB -9%
        megalinter-go 1.55 GB 1.35 GB -13%
        megalinter-java 1.59 GB 1.32 GB -17%
        megalinter-javascript 1.49 GB 1.23 GB -18%
        megalinter-php 1.51 GB 1.26 GB -17%
        megalinter-python 1.61 GB 1.26 GB -22%
        megalinter-ruby 1.49 GB 1.22 GB -18%
        megalinter-rust 1.99 GB 1.80 GB -10%
        megalinter-salesforce 2.09 GB 1.87 GB -10%
        megalinter-security 1.30 GB 1.17 GB -10%
        megalinter-swift 1.51 GB 1.24 GB -18%
        megalinter-terraform 1.59 GB 1.30 GB -18%

      • Standalone single-linter images, uncompressed size on linux/amd64 (before = previous beta):

        Image Before After Delta
        megalinter-only-groovy_npm_groovy_lint 1.07 GB 695 MB -35%
        megalinter-only-r_lintr 996 MB 405 MB -59%
        megalinter-only-spell_proselint 813 MB 284 MB -65%
        megalinter-only-css_stylelint 780 MB 360 MB -54%
        megalinter-only-spell_cspell 755 MB 357 MB -53%
        megalinter-only-ruby_rubocop 702 MB 301 MB -57%
        megalinter-only-perl_perlcritic 696 MB 293 MB -58%
        megalinter-only-spell_vale 683 MB 286 MB -58%
        megalinter-only-yaml_yamllint 668 MB 271 MB -59%
        megalinter-only-bash_shellcheck 660 MB 263 MB -60%
        megalinter-only-lua_luacheck 652 MB 252 MB -61%
        megalinter-only-xml_xmllint 645 MB 246 MB -62%

    • Faster startup on every run (~5 seconds saved) (#8624)

      • Linter versions now come from a manifest built into the Docker image, instead of calling every linter's --version
      • LLM Advisor libraries are only loaded when LLM_ADVISOR_ENABLED is true
      • Set the new VERSION_GET_AT_RUNTIME: true variable if your PRE_COMMANDS install different linter versions and you want the really installed versions reported

    • Faster linting when fixes are applied (APPLY_FIXES): the check-only linters of a language now run in parallel as soon as its fixer linters are done, instead of all linters of the language running one after another (#8624)

    • Faster standalone images and file-list runs: megalinter-only-* images only parse the descriptor of their single linter, and the repository-wide .gitignore enumeration is skipped when an explicit list of files is passed (e.g. mega-linter-runner [files...] on a large repository) (#8614)

    • Runtime speed-ups combined, measured on the MegaLinter repository itself and on real-world repositories upgraded to this version (average of the last successful CI runs before / first CI runs after the upgrade):

      Measure Before After Delta
      MegaLinter repository: full run (all linters, fixes applied) 4m26s 3m18s -26%
      MegaLinter startup (import megalinter) ~7s ~0.9s -87%
      sfdx-hardis CI MegaLinter job (v9.6.0 → beta, javascript flavor) 6m02s 3m17s -45%
      vscode-sfdx-hardis CI MegaLinter job (late-July → current beta) 3m10s 2m34s -19%

    • Better secrets masking in logs, now powered by the betterleaks ruleset: redaction coverage nearly doubles (218 to 408 patterns), with no more network call at startup (#8606)

    • FILTER_REGEX_INCLUDE and FILTER_REGEX_EXCLUDE (global, per-descriptor and per-linter) can now be defined as a list of regexes combined with a logical OR, so filter regexes can be appended across EXTENDS configs via CONFIG_PROPERTIES_TO_APPEND; single-string values remain fully supported, fixes #8361

    • New ENABLE_DISABLE_LINTERS_PRIORITY variable to let DISABLE_LINTERS override ENABLE_LINTERS when a linter is in both lists (e.g. to trim an inherited ENABLE_LINTERS list via EXTENDS), fixes #8296

    • New MEGALINTER_FLAVOR and MEGALINTER_VERSION properties in .mega-linter.yml, to pin the flavor and version of the MegaLinter Docker image once in the repository and have them reused by mega-linter-runner and the agent skills (#8614)

    • Display a distinct ☑️ status icon (instead of ⚠️) for linters that found errors without blocking the run because the error count stayed under <LINTER>_DISABLE_ERRORS_IF_LESS_THAN, and show the configured maximum in the console and Pull Request summary tables (#8496)

    • A <LINTER>_CLI_LINT_MODE override targeting a lint mode the linter does not support is now rejected with an explicit error instead of failing at lint time, fixes #7120

  • New linters

  • Removed linters

    • API_SPECTRAL: crashing with no upstream fix (#8606)
    • JSON_ESLINT_PLUGIN_JSONC: blocked by eslint-plugin-jsonc#328, use JSON_PRETTIER or JSON_JSONLINT instead (#8606)
    • LUA_SELENE: blocked by selene#662, use LUA_LUACHECK instead (#8606)
    • MAKEFILE_CHECKMAKE: disabled for security issues (#8606)
    • MARKDOWN_REMARK_LINT: blocked by remark-lint#322, use MARKDOWN_MARKDOWNLINT instead (#8606)
    • PUPPET_PUPPET_LINT: blocked by puppet-lint#251 (#8606)
    • REPOSITORY_GITLEAKS: superseded by betterleaks, use REPOSITORY_BETTERLEAKS instead (#8606)
    • REPOSITORY_KICS: disabled after the Checkmarx supply chain compromise, use REPOSITORY_CHECKOV instead (#8606)
    • SALESFORCE_LIGHTNING_FLOW_SCANNER: upstream repository archived, use SALESFORCE_CODE_ANALYZER_FLOW instead (#8606)
    • SALESFORCE_SFDX_SCANNER_APEX, SALESFORCE_SFDX_SCANNER_AURA, SALESFORCE_SFDX_SCANNER_LWC: deprecated by Salesforce and incompatible with Node.js 22+, use the matching SALESFORCE_CODE_ANALYZER_* linters instead (#8606)
    • SQL_TSQLLINT: upstream unmaintained since 2024-09 and shipping unpatched .NET CVEs (#8606)
    • TERRAFORM_TERRASCAN: upstream repository archived by Tenable and shipping unpatched CVEs, use REPOSITORY_CHECKOV instead (#8606)

  • Linters enhancements

    • REPOSITORY_CHECKOV now skips its secrets framework (--skip-framework secrets) when a dedicated secret scanner (betterleaks, kingfisher, secretlint or trufflehog) is active in the same run: the duplicated secrets scan added minutes to every run and could stall for hours on bind-mounted workspaces. Define --framework or --skip-framework in REPOSITORY_CHECKOV_ARGUMENTS (or in your checkov config file) to keep checkov's own secrets scan (#8665)

  • Fixes

    • Stop FutureWarning: Possible nested set warnings appearing in the console at startup: a secret-masking regex used a POSIX character class ([[:alnum:]]) unsupported by Python. Such classes are now translated, which also makes the affected masking rule (Airtable personal access tokens) actually match (#8684)
    • Restore multi-arch megalinter-only-* Docker images: they were mistakenly published for a single architecture, linux/amd64 + linux/arm64 are back (#8247)
    • Fix linters relying on other linters' file lists (e.g. SPELL_CSPELL) linting zero files when run through their standalone megalinter-only-* Docker image (#8614)
    • Fix LINTER_RULES_PATH not being used to resolve config files for linters using active_only_if_file_found (e.g. REPOSITORY_LS_LINT, SPELL_PROSELINT, SPELL_VALE), fixes #8416
    • Honor EXCLUDED_DIRECTORIES and ADDITIONAL_EXCLUDED_DIRECTORIES in changed-files mode (VALIDATE_ALL_CODEBASE: false), the same way they are honored during full-codebase validation (#8360)
    • Make remote configuration loading (MEGALINTER_CONFIG and EXTENDS files fetched over HTTP) resilient to transient network failures with a request timeout and retries (#8349)
    • Bound the gitignored-files detection (git ls-files) with a 120 seconds timeout: on workspaces with pathologically slow file access (e.g. bind-mounted from Windows into a WSL2-backed container engine) this internal git call could hang the whole run before any linter started; it now degrades to an actionable warning and the run continues (#8665)
    • Allow CSS_STYLELINT_COMMAND_REMOVE_ARGUMENTS to remove --config-basedir, and stop raising an error when an argument listed in <LINTER>_COMMAND_REMOVE_ARGUMENTS is not in the command line, fixes #8552
    • Treat zero matching SARIF findings as a valid result without logging the entire report, fixes #8295
    • Remove invalid SARIF fixes with empty artifactChanges arrays before report aggregation, fixes #8474
    • Fix SARIF_TO_HUMAN producing empty linter logs when the SARIF-to-text conversion crashed; raw SARIF is now shown as a fallback (#8294)
    • Keep REPOSITORY_CHECKOV's transient GitHub-configuration scan files (branch_protection_rules.json and similar) out of the linted repository — they are now written inside the report folder, so they no longer appear in other linters' results (#8406)
    • Fix a REPOSITORY_SECRETLINT crash (ENOENT) when it scanned report files being written at the same time by other linters (#8624)
    • COPYPASTE_JSCPD now runs on linux/amd64 only: jscpd v5 provides no ARM64 binary compatible with MegaLinter images, so it always failed with Unsupported platform linux/arm64 on ARM (#8610)

  • Reporters

    • Observability: MegaLinter results can now feed Grafana, Datadog, Elastic and New Relic, with ready-to-use, linked dashboards (fleet overview → repository detail → linter detail, with health score and errors evolution by repository, linter and language) — see the new Observability documentation section (#8661)
      • The API Reporter payload v2 adds run-level KPIs (quality gate status, a 0-100 repository health score, blocking/non-blocking error counts, auto-fixed errors, run duration) and per-linter top rules and top files breakdowns (parsed from SARIF output, disable with API_REPORTER_DETAILS: false)
      • New API_REPORTER_PROVIDER variable: comma-separated list of target providers (grafana by default, datadog, elastic, newrelic) with per-provider auth variables (API_REPORTER_DATADOG_*, API_REPORTER_ELASTIC_*, API_REPORTER_NEWRELIC_*)
      • Dashboards are provisioned automatically with npx mega-linter-runner --upload-dashboards <provider> (idempotent create-or-update), also proposed during --install and --upgrade
    • New API_REPORTER_PAYLOAD_FORMAT variable (auto, loki or default) to force the payload format sent by the API Reporter, instead of only deducing it from the endpoint URL (#8661)
    • Observability dashboards reviewed and improved against each provider's official guidance — refresh yours with npx mega-linter-runner --upload-dashboards <provider> (#8667)
      • Correct KPIs: Grafana "latest run" stats no longer double-count when several branches or MegaLinter versions report in the window, and stale series (deleted branches, pre-upgrade versions) no longer linger; the quality gate pass rate is now a true pass rate over the selected period on Grafana, Datadog and New Relic; "errors auto-fixed" and "time saved" now show period totals consistently on all providers
      • Working navigation: Grafana drill-down links now keep the selected branch, and New Relic facet links to the Repository detail and Why this rating? pages now actually work (they were silently ignored)
      • "Why this rating?" explanations now render correctly on Datadog, Elastic and New Relic (they showed literal \n text), and Elastic and New Relic gain the missing "Linters dragging the score down" and "Time saved by auto-fixes" elements
      • Readable with sparse CI data: 1-week default windows on Datadog widgets, 1-day buckets on New Relic charts, run-marker annotations and sparklines on Grafana/Datadog tiles, sorted tables, and semantic colors everywhere (blocking=red, non-blocking=yellow, health A-E bands)
      • New content: A-E rating breakdown and quality-gate failure rate (New Relic), files analyzed and health score by MegaLinter version (Datadog), files analyzed and MegaLinter versions in use (Elastic), org-level filter variable (Grafana)
      • Fix the New Relic provider tagging every metric datapoint with runId, which burned metric cardinality for no query value
    • Refreshed OX Security banner displayed at the bottom of pull request comments and job summaries, using the current OX Security visual identity (#8692)

  • Doc

    • Home page: mention Coding Agents compliance in the welcome phrase, display the supported coding agent icons next to the CI/CD integrations, and add a "Coding Agents compatible" badge (#8625)
    • Home page banner refreshed: highlights v10, compliance with AI coding agents, and up-to-date download (16 million+) and usage (6,000+ public repos) figures (#8692)
    • Quick Start: setting up MegaLinter with a coding agent (npx skills add oxsecurity/megalinter then "setup megalinter") is now the first suggested option (#8625)
    • Coding Agents page: add Gemini CLI, Windsurf, Cline, Roo Code, Kilo Code, Amp, Goose, OpenHands and Qwen Code to the compatible coding agents (#8625)
    • megalinter-setup skill: after install or upgrade, suggest either running MegaLinter locally or creating a pull request and then watching its CI results with megalinter-check (#8625)
    • megalinter-setup skill: upgrade mode now systematically migrates CI Docker image references from Docker Hub to ghcr.io (images are only published on GitHub Container Registry since v9.5.0), with precise rules on what to rewrite and what to leave untouched (#8694)
    • megalinter, megalinter-setup and megalinter-check skills: local runs are flagged as resource-consuming and running in CI is now the recommended option — when both are possible, the skills ask the user to choose (CI first) instead of silently starting a local run (#8658)
    • megalinter-check skill: the first local run now starts with a --prerun analysis, so the user can validate the suggested .mega-linter.yml performance tuning before the real lint (#8653)
    • megalinter-check skill and watcher/runner sub-agents: the console tips MegaLinter prints (performance warnings, flavor suggestions, [Activation] notices, deprecations) are now extracted from the persisted log file and returned to the calling agent in a tips field, instead of being lost when reading only the JSON report (#8665)
    • Custom Flavors: new Licensing section — a custom flavor is still MegaLinter, so your flavor repository and the image it publishes are covered by AGPL-3.0. Add an AGPL-3.0 LICENSE file to your flavor repository and keep the link to the MegaLinter source in its README, fixes #8681
    • Fix outdated links in docs/descriptors/repository_kingfisher.md (#8364)

  • mega-linter-runner

    • New --upload-dashboards <provider> option: provision or refresh the MegaLinter observability dashboards in Grafana, Datadog, Elastic (Kibana) or New Relic, using the provider auth environment variables (documentation) (#8661)
      • Also proposed as a prompt during interactive --install and --upgrade, or with --setup-dashboards <provider> in non-interactive mode
    • Non-interactive installation: --install can now run without prompts (#8614)
      • Use --no-prompt with the new --setup-* options (--setup-ci, --setup-copy-paste, --setup-spelling-mistakes, --setup-default-branch, --setup-validate-all-code-base, --setup-ox) and the existing --flavor, --release and --fix flags
      • Pre-existing configuration/workflow files are backed up as <file>.megalinter-setup.bak before being overwritten, so customizations can be merged back
    • New --linter <LINTER_KEY> option to run a single linter using its standalone megalinter-only-<linter_key> Docker image, with an optional list of files to lint (#8614)
      • Reports are isolated in megalinter-reports/<linter_key>, so several standalone runs can execute in parallel
    • Flavor and version resolution now reads MEGALINTER_FLAVOR and MEGALINTER_VERSION from .mega-linter.yml when --flavor/--release are not passed on the command line, and the install generator writes both properties in the generated configuration (#8614)
    • --fix now respects an APPLY_FIXES value (other than none) defined in .mega-linter.yml instead of overriding it with all (#8614)
    • --upgrade also bumps a pinned MEGALINTER_VERSION property of .mega-linter.yml to the current major version (#8614)
    • --upgrade now migrates v9 references to v10: GitHub Action (oxsecurity/megalinter@v9, flavors) and Docker image (ghcr.io/oxsecurity/megalinter:v9, flavors) references are rewritten to v10, and --install defaults to v10
    • New --prerun option: analysis-only run that outputs configuration suggestions to improve performances (see the prerun mode in Core section). Combine with --json to print the prerun report on stdout (#8653)
    • New --timeout <seconds> option (-t): bound the whole run; on expiration the runner prints the container's last log lines, stops and removes the container (no orphan left behind, even on Windows where killing the CLI process does not stop the container), and exits with code 124 (#8665)
    • Skip docker pull when the requested version is a pinned release tag (vX.Y.Z, immutable) and the image is already available locally, removing a useless registry round-trip (#8614)
    • Print a hint before mounting the workspace when it contains well-known heavy folders (build caches, package stores), pointing at SKIP_CLI_LINT_MODES=project to keep local runs fast (#8646)
    • --custom-flavor-setup: the generated README now has a License section stating the flavor is covered by AGPL-3.0, with a link to the MegaLinter source repository (#8682)
    • --custom-flavor-setup now generates a MegaLinter-clean repository, so a new custom flavor repo starts green instead of failing its own first MegaLinter run, fixes #8680
      • The generated workflows and README now pass actionlint, zizmor, editorconfig-checker and markdownlint
      • Actions used by the generated workflows are hash-pinned, and a .github/zizmor.yml is generated to waive the one deliberate exception: the flavor builder tracks @main so your image is always built by the builder matching the MegaLinter release you target
      • Fixed the generated builder header comment, which advertised the image at ghcr.io/<owner>/<repo>:<tag> instead of ghcr.io/<owner>/<repo>/megalinter-custom-flavor:<tag>
      • Fixed the generated PAT setup instructions, which named the repository the template was originally written against
      • Custom Flavors documentation now covers linting your flavor repository, including the REPOSITORY_CHECKOV_ARGUMENTS: "--skip-check CKV_GHA_7" needed by the builder's workflow_dispatch inputs

  • Dev

    • ApiReporter refactoring: provider delivery is now implemented by ApiProvider classes (megalinter/api_providers/: Grafana, Datadog, Elastic, New Relic), and dashboards are generated by DashboardBuilder classes (.automation/dashboard_builders/) from a shared metrics contract into docs/dashboards/ — build_dashboards.py --check fails when dashboards and contract drift apart, and the internal sync-dashboards Claude skill maintains them (#8661)
    • Add megalinter/removed_linters.py as the single source of truth for every linter and descriptor removed since v6, used both at runtime and by the build system, and generate the Removed linters documentation page from it (#8606)
    • Add supported_cli_lint_modes descriptor property to declare which CLI lint modes (file, list_of_files, project) each linter supports, and generate success/failure tests for every supported mode (#7150)
      • ACTION_ZIZMOR, BASH_SHFMT and GO_REVIVE now declare their real modes instead of falling back to the file-only default
    • Project-mode excluded-directories forwarding internals: (#8646)
      • New cli_lint_mode_project_exclude_* descriptor properties (native exclusion flag templates, ignore-file arguments, generated workspace ignore files) consumed by generic Linter base-class code: forwarding is pure descriptor data on 41 linters
      • 13 Python subclass workarounds for tools needing config-merge logic (trufflehog, betterleaks, jscpd, yamllint, rubocop, swiftlint, ls-lint, clj-kondo, eslint, gherkin-lint, luacheck, stylua, phpstan/php-cs-fixer/cljstyle)
      • Poison .wireit/ test fixtures make the project-lint-mode success tests fail if forwarding regresses
    • New descriptor property install.apk_build for apk packages needed only while pip/gem packages compile native extensions: they join a virtual apk package removed from the final image layers (#8621)
      • Used by SPELL_PROSELINT (build-base, re2-dev, py3-pybind11-dev needed to build google-re2), which was keeping a full C++ toolchain in every flavor image
    • Details of the Docker image slimming: (#8621)
      • LLM Advisor provider SDKs move to an llm pip extra excluded from standalone megalinter-only-* images (~200 MB per standalone image)
      • The compilation toolchain (gcc, make, musl-dev, libffi-dev) and per-descriptor build toolchains (LUA luarocks, PERL cpm, R packages) are installed as apk virtual packages removed after the install steps (~110-150 MB per image)
      • GROOVY_NPM_GROOVY_LINT reuses the shared OpenJDK 21 instead of shipping its own OpenJDK 17 (~300 MB)
      • Python linter venvs share identical wheels through the uv cache in hardlink mode
      • Extended node_modules pruning, and standalone images drop the ~45 MB __pycache__ layer
      • Removed a stray cpplint Python venv that was mistakenly declared in the CSS_STYLELINT descriptor
    • Keep the Docker Pulls badge in docs/index.md in sync by having docker_stats.py also update the hardcoded badge total in .automation/build.py (#8258)
    • Mark the repository's internal Claude Code skills (.claude/skills/) as internal so npx skills add oxsecurity/megalinter only offers the four MegaLinter agent skills from the skills/ folder (#8627)
    • Vendor the official Grafana, Elastic and Datadog agent skills (Apache-2.0, with licenses and source attribution) into .claude/skills/ (grafana-dashboarding, grafana-promql, kibana-dashboards, datadog-dashboards) to guide observability dashboard maintenance alongside the sync-dashboards skill — New Relic publishes no official agent skill (only an MCP server) (#8667)
    • Fix the /build contribution skill being accidentally gitignored by the build/ packaging pattern, so it is now actually versioned (#8627)

  • CI

    • Speed up PR jobs by handing the built Docker image over to consumer jobs through ghcr.io (megalinter-dev per-commit tags, pruned daily) instead of a workflow artifact + docker load (#8624)

      • For branches of the main repository only: forked PRs keep the artifact-based handoff, since their GITHUB_TOKEN cannot push packages

    • Build only the per-linter Docker images impacted by the changed files of a PR (descriptor edits, per-linter Dockerfiles, single-linter test fixtures); any change to shared code or unrecognized files keeps building the full matrix (#8624)

    • Remove duplicate self-lint and mega-linter-runner test runs on PR branches: the push trigger is now restricted to main-line branches, the pull_request trigger already covers PR commits (~15 duplicated job-minutes saved per PR commit) (#8624)

    • Speed up the test suite by skipping the file CLI lint mode tests for linters that also support list_of_files, since list_of_files exercises the same code path more cheaply (#8624)

    • CI jobs before/after, measured on the deploy-DEV workflow (average of 3 successful runs each, before = early July 2026, after = 2026-08-05):

      CI job / step Before After Delta
      Docker image handoff to a consumer job 4m51s 2m39s -45%
      "Run against all code base" — whole job 11m16s 7m16s -36%
      "Run against all code base" — lint step 5m08s 3m18s -36%
      "Run Test Cases" (pytest suite) — whole job 15m30s 14m00s -10%
      "mega-linter-runner tests" — whole job 14m20s 8m17s -42%
      • The pytest suite gain is partly offset by the many new per-lint-mode and project-mode-exclusion tests added in this version

    • TAP reporter golden-file tests move from the 120+ generated per-linter test classes (where most of them skipped) to a dedicated tap_reporter_test class running on a curated sample of linters (bash, css, protobuf, cloudformation); stale Super-Linter-era expected files (some of them unreachable by the test suite) have been removed (#8624)

    • Make test_api_output resilient to remote server outages: probe several public echo endpoints, run the test with the ones that are up, retry with another server when a post fails, and skip the test when none of them is reachable, as a remote outage is not a MegaLinter issue (#8538)

    • Fix per-linter Docker images being published single-arch: the BETA and RELEASE linter workflows split each linter into independent per-platform jobs that all pushed the same tag, so the last push won and overwrote the other architecture. They now push each platform by digest and a dedicated merge job assembles a proper multi-arch manifest list per linter (#8247)

  • Linter versions upgrades (50)

Pull requests
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8246
  • fix(ci): publish per-linter Docker images as multi-arch manifests by @nvuillam in #8247
  • chore(deps): update dependency pyright to v1.1.411 by @renovate[bot] in #8243
  • chore(deps): lock file maintenance by @renovate[bot] in #8244
  • fix(docs): Synchronize Docker Pulls badge in docs/index.md by @nvuillam in #8258
  • chore(deps): update stefanzweifel/git-auto-commit-action digest to 4a55954 by @renovate[bot] in #8248
  • chore(deps): update alpine/terragrunt docker tag to v1.15.7 by @renovate[bot] in #8249
  • chore(deps): update dependency @eslint-react/eslint-plugin to v5.9.3 by @renovate[bot] in #8250
  • chore(deps): update dependency rumdl to v0.2.25 by @renovate[bot] in #8251
  • chore(deps): update dependency skaji/cpm to v1.1.4 by @renovate[bot] in #8252
  • chore(deps): update dependency eslint-plugin-n to v18.2.0 by @renovate[bot] in #8253
  • chore(deps): update dependency sfdx-hardis to v7.18.0 by @renovate[bot] in #8254
  • chore(deps): update dependency stylelint to v17.14.0 by @renovate[bot] in #8255
  • chore(deps): update mstruebing/editorconfig-checker docker tag to v3.8.0 by @renovate[bot] in #8256
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8257
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8260
  • chore(deps): update dependency regex to v2026.6.28 by @renovate[bot] in #8261
  • chore(renovate): pin js-yaml below v5 (ESM-only breaks runner) by @nvuillam in #8263
  • chore(deps): update dependency djlint to v1.39.5 by @renovate[bot] in #8262
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8266
  • chore(deps): update dependency @eslint-react/eslint-plugin to v5.9.4 by @renovate[bot] in #8264
  • fix(runtime): preserve entrypoint args after user switch by @Wuodan in #8212
  • chore(deps): update tflint plugin terraform-linters/tflint-ruleset-aws to v0.48.0 by @renovate[bot] in #8275
  • chore(deps): update dependency mongodb/kingfisher to v1.105.0 by @renovate[bot] in #8273
  • chore(deps): update dependency pmd/pmd to v7.26.0 by @renovate[bot] in #8274
  • chore(deps): update dependency prettier to v3.8.5 by @renovate[bot] in #8271
  • chore(deps): update dependency checkov to v3.3.6 by @renovate[bot] in #8268
  • chore(deps): update dependency rumdl to v0.2.27 by @renovate[bot] in #8272
  • chore(deps): update dependency eslint-plugin-n to v18.2.1 by @renovate[bot] in #8269
  • chore(deps): update dependency @eslint-react/eslint-plugin to v5.9.5 by @renovate[bot] in #8267
  • chore(deps): update dependency eslint-plugin-jest to v29.15.3 by @renovate[bot] in #8265
  • chore(deps): update dependency fastapi to v0.138.2 by @renovate[bot] in #8270
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8277
  • chore(deps): bump the npm_and_yarn group across 3 directories with 2 updates by @dependabot[bot] in #8278
  • chore(deps): update dependency rumdl to v0.2.27 by @renovate[bot] in #8276
  • chore(deps): update dependency cfn-lint to v1.52.1 by @renovate[bot] in #8280
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8281
  • chore(deps): update dependency djlint to v1.39.7 by @renovate[bot] in #8282
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8283
  • chore(deps): update dependency eslint-plugin-import-x to v4.17.1 by @renovate[bot] in #8284
  • fix: prevent empty linter logs when sarif-fmt crashes (#8294) by @nvuillam in #8298
  • Add ENABLE_DISABLE_LINTERS_PRIORITY to control linter activation precedence by @trevor-vaughan in #8297
  • chore(deps): update trufflesecurity/trufflehog docker tag to v3.95.8 by @renovate[bot] in #8311
  • chore(deps): update dependency fastapi to v0.139.0 by @renovate[bot] in #8318
  • chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.11.26 by @renovate[bot] in #8310
  • chore(deps): update dependency typing-extensions to v4.16.0 by @renovate[bot] in #8320
  • chore(deps): update dependency yq to v4 by @renovate[bot] in #8322
  • chore(deps): update dependency eslint to v10.6.0 by @renovate[bot] in #8317
  • chore(deps): update salesforce packages (minor) by @renovate[bot] in #8321
  • chore(deps): update dependency djlint to v1.40.3 by @renovate[bot] in #8316
  • chore(deps): update dependency aquasecurity/trivy to v0.72.0 by @renovate[bot] in #8315
  • chore(deps): update dependency ansible-lint to v26.6.0 by @renovate[bot] in #8314
  • chore(deps): update typescript-eslint monorepo to v8.62.1 by @renovate[bot] in #8312
  • chore(deps): update dependency rust-lang/rust to v1.96.1 by @renovate[bot] in #8308
  • chore(deps): update dependency rumdl to v0.2.28 by @renovate[bot] in #8307
  • chore(deps): update dependency rubocop to v1.88.1 by @renovate[bot] in #8306
  • chore(deps): update dependency pymdown-extensions to v11.0.1 by @renovate[bot] in #8305
  • chore(deps): update dependency fs-extra to v11.3.6 by @renovate[bot] in #8303
  • chore(deps): update dependency @stoplight/spectral-cli to v6.16.1 by @renovate[bot] in #8302
  • chore(deps): update dependency sfdx-hardis to v7.19.0 by @renovate[bot] in #8293
  • chore(deps): update docker/setup-buildx-action digest to bb05f3f by @renovate[bot] in #8301
  • chore(deps): update docker/metadata-action digest to dc80280 by @renovate[bot] in #8300
  • chore(deps): update dependency pytest-rerunfailures to v16.4 by @renovate[bot] in #8292
  • chore(deps): update ghcr.io/betterleaks/betterleaks docker tag to v1.6.1 by @renovate[bot] in #8291
  • chore(deps): update dependency phpstan/phpstan to v2.2.4 by @renovate[bot] in #8290
  • chore(deps): update dependency langsmith to v0.9.7 by @renovate[bot] in #8289
  • chore(deps): update dependency eslint-plugin-jest to v29.15.4 by @renovate[bot] in #8288
  • chore(deps): update docker/build-push-action digest to 53b7df9 by @renovate[bot] in #8287
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8337
  • chore(deps): update dependency serialize-javascript to v7.0.7 by @renovate[bot] in #8309
  • chore(deps): update dependency prettier to v3.9.4 by @renovate[bot] in #8319
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8338
  • chore(deps): update docker/login-action digest to af1e73f by @renovate[bot] in #8299
  • Cleans security vulnerability ignore lists by @nvuillam in #8339
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8340
  • chore(deps): update dependency @eslint-react/eslint-plugin to v5.10.0 by @renovate[bot] in #8313
  • Add pr-watch-fix-renovate skill (parallel Renovate PR sweep) by @nvuillam in #8341
  • chore(deps): update dependency golangci/golangci-lint to v2.12.2 by @renovate[bot] in #7693
  • chore(deps): update dependency proselint to v0.16.0 by @renovate[bot] in #6552
  • chore(deps): update dependency phpstan/phpstan to v2.2.5 by @renovate[bot] in #8342
  • chore(deps): update dependency uvicorn to v0.50.0 by @renovate[bot] in #8343
  • chore(deps): update dependency npm-groovy-lint to v18 by @renovate[bot] in #8344
  • chore(deps): update secretlint monorepo to v13 by @renovate[bot] in #7761
  • chore(deps): update dependency @eslint-react/eslint-plugin to v5.10.1 by @renovate[bot] in #8347
  • chore: stop Dependabot updating intentional test fixtures by @nvuillam in #8348
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8345
  • Fix flaky config tests: add timeout + retry to remote config fetch by @nvuillam in #8349
  • chore(deps): lock file maintenance by @renovate[bot] in #8353
  • chore(deps): update dependency langchain_mistralai to v1.1.6 by @renovate[bot] in #8352
  • chore(deps): update dependency @eslint-react/eslint-plugin to v5.10.2 by @renovate[bot] in #8354
  • chore(deps): update dependency uvicorn to v0.50.2 by @renovate[bot] in #8355
  • Stabilize osv-scanner test with a small static vulnerable fixture by @nvuillam in #8350
  • docs: Fix links to kingfisher docs by @tylervz in #8364
  • chore(deps): bump uvicorn from 0.50.2 to 0.51.0 in /server by @dependabot[bot] in #8367
  • chore(deps): update dependency djlint to v1.40.4 by @renovate[bot] in #8376
  • chore(deps): update dependency @eslint-react/eslint-plugin to v5.10.4 by @renovate[bot] in #8374
  • chore(deps): update actions/stale digest to 1e223db by @renovate[bot] in #8373
  • chore(deps): update dependency eslint-plugin-jsonc to v3.3.0 by @renovate[bot] in #8395
  • chore(deps): update dependency ruff to v0.15.21 by @renovate[bot] in #8383
  • chore(deps): update dependency virtualenv to v21.6.1 by @renovate[bot] in #8402
  • chore(deps): update dependency semgrep to v1.169.0 by @renovate[bot] in #8401
  • chore(deps): update dependency rubocop-rails to v2.36.0 - autoclosed by @renovate[bot] in #8399
  • chore(deps): update dependency regex to v2026.7.10 by @renovate[bot] in #8398
  • chore(deps): update dependency mongodb/kingfisher to v1.106.0 by @renovate[bot] in #8397
  • chore(deps): update dependency langsmith to v0.10.2 by @renovate[bot] in #8396
  • chore(deps): update dependency cfn-lint to v1.53.0 by @renovate[bot] in #8394
  • chore(deps): update dependency azure/bicep to v0.45.6 by @renovate[bot] in #8393
  • chore(deps): update dependency rubocop to v1.88.2 by @renovate[bot] in #8382
  • chore(deps): update dependency yq to v4.1.2 by @renovate[bot] in #8386
  • chore(deps): update dependency jscpd to v5.0.12 by @renovate[bot] in #8379
  • chore(deps): update dependency friendsofphp/php-cs-fixer to v3.95.13 by @renovate[bot] in #8377
  • chore(deps): update dependency sfdx-hardis to v7.19.2 by @renovate[bot] in #8375
  • chore(deps): update alpine/terragrunt docker tag to v1.15.8 by @renovate[bot] in #8378
  • chore(deps): update langchain (patch) by @renovate[bot] in #8389
  • chore(deps): update dependency @eslint-react/eslint-plugin to v5.13.2 by @renovate[bot] in #8391
  • chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.11.28 by @renovate[bot] in #8387
  • chore(deps): update golang docker tag to v1.26.5 by @renovate[bot] in #8388
  • chore(deps): update dependency lightning-flow-scanner to v6.19.4 by @renovate[bot] in #8381
  • chore(deps): lock file maintenance by @renovate[bot] in #8405
  • Write Checkov GitHub-config scan dir under the report folder by @nvuillam in #8406
  • Add supported_cli_lint_modes by @bdovaz in #7150
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8363
  • chore(deps): update typescript-eslint monorepo to v8.63.0 by @renovate[bot] in #8403
  • chore(deps): update dependency rumdl to v0.2.31 by @renovate[bot] in #8384
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8413
  • Fix docs markdown formatting by @bdovaz in #8421
  • chore(deps): update dependency prettier to v3.9.5 by @renovate[bot] in #8414
  • chore(deps): update dependency gitpython to v3.1.51 by @renovate[bot] in #8412
  • Add project to supported_cli_lint_modes in the PowerShell linter by @bdovaz in #8418
  • chore(deps): update dependency djlint to v1.40.6 by @renovate[bot] in #8411
  • chore(deps): update dependency rumdl to v0.2.32 by @renovate[bot] in #8422
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8423
  • chore(deps): update dependency @eslint/eslintrc to v3.3.6 by @renovate[bot] in #8424
  • chore(deps): update dependency @salesforce/cli to v2.142.7 by @renovate[bot] in #8392
  • chore(deps): update trufflesecurity/trufflehog docker tag to v3.95.9 by @renovate[bot] in #8390
  • Fix: LINTER_RULES_PATH config resolution for active_only_if_file_found by @nvuillam in #8425
  • chore(deps): update dependency @eslint-react/eslint-plugin to v5.14.1 by @renovate[bot] in #8427
  • chore(deps): update dependency azure/bicep to v0.45.15 by @renovate[bot] in #8426
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8428
  • chore(deps): update dependency eslint-plugin-n to v18.2.2 by @renovate[bot] in #8431
  • chore(deps): update dependency eslint to v10.7.0 by @renovate[bot] in #8429
  • feat(salesforce): add SALESFORCE_CODE_ANALYZER_FLOW linter (Flow Scanner engine) by @nvuillam in #8408
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8430
  • chore(deps): update actions/setup-node action to v6.5.0 by @renovate[bot] in #8432
  • chore(deps): update actions/setup-node action to v7 by @renovate[bot] in #8433
  • chore(deps): update dependency @eslint-react/eslint-plugin to v5.14.5 by @renovate[bot] in #8434
  • chore(deps): update dependency rumdl to v0.2.33 - autoclosed by @renovate[bot] in #8436
  • chore(deps): update dependency rumdl to v0.2.34 by @renovate[bot] in #8438
  • chore(deps): update dependency djlint to v1.40.7 by @renovate[bot] in #8439
  • chore(deps): update dependency rust-lang/rust to v1.97.0 by @renovate[bot] in #8400
  • Remove deprecated option from .pylintrc by @annaerdi in #8420
  • chore(deps): bump langsmith from 0.10.2 to 0.10.6 in /.config/python/dev by @dependabot[bot] in #8440
  • chore(deps): bump mkdocs-material from 9.7.6 to 9.7.7 in /.config/python/dev by @dependabot[bot] in #8441
  • chore(deps): bump fastapi from 0.139.0 to 0.139.2 in /server by @dependabot[bot] in #8442
  • chore(deps): bump mem-fs from 4.1.4 to 4.1.5 in /mega-linter-runner by @dependabot[bot] in #8445
  • chore(deps): bump gitpython from 3.1.51 to 3.1.52 in /.config/python/dev by @dependabot[bot] in #8446
  • chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.11.29 by @renovate[bot] in #8415
  • chore(deps): update dependency @salesforce/cli to v2.143.6 by @renovate[bot] in #8452
  • chore(deps): update dependency sfdx-hardis to v7.20.0 by @renovate[bot] in #8455
  • chore(deps): bump fastapi from 0.139.0 to 0.139.2 in /.config/python/dev by @dependabot[bot] in #8443
  • chore(deps): bump gitpython from 3.1.51 to 3.1.52 in /server by @dependabot[bot] in #8444
  • Honor ADDITIONAL_EXCLUDED_DIRECTORIES in changed-files mode by @trevor-vaughan in #8362
  • chore(deps): update dependency mongodb/kingfisher to v1.108.0 by @renovate[bot] in #8453
  • chore(deps): update dependency semgrep to v1.170.0 by @renovate[bot] in #8454
  • chore(deps): update dependency @eslint-react/eslint-plugin to v5.14.10 by @renovate[bot] in #8447
  • chore(deps): update dependency checkov to v3.3.8 by @renovate[bot] in #8448
  • chore(deps): update dependency rumdl to v0.2.36 by @renovate[bot] in #8451
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8437
  • chore(deps): update dependency codespell to v2.4.3 by @renovate[bot] in #8449
  • chore(deps): update dependency friendsofphp/php-cs-fixer to v3.95.15 by @renovate[bot] in #8450
  • chore(deps): update dependency markdownlint-cli to v0.49.1 by @renovate[bot] in #8457
  • chore(deps): update dependency regex to v2026.7.19 by @renovate[bot] in #8459
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8458
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8464
  • Allow FILTER_REGEX_INCLUDE and FILTER_REGEX_EXCLUDE to be arrays by @nvuillam in #8469
  • chore(deps): update dependency rust-lang/rust to v1.97.1 by @renovate[bot] in #8461
  • chore(deps): update dependency @eslint-react/eslint-plugin to v5.16.1 by @renovate[bot] in #8462
  • chore(deps): update dependency anchore/grype to v0.116.0 by @renovate[bot] in #8463
  • chore(deps): update dependency @salesforce/plugin-packaging to v2.30.2 by @renovate[bot] in #8465
  • chore(deps): update dependency djlint to v1.40.10 by @renovate[bot] in #8456
  • chore(deps): update dependency anchore/syft to v1.48.0 by @renovate[bot] in #8466
  • chore(deps): update typescript-eslint monorepo to v8.64.0 by @renovate[bot] in #8468
  • chore(deps): update dependency ruff to v0.15.22 by @renovate[bot] in #8460
  • chore(deps): update ghcr.io/terraform-linters/tflint docker tag to v0.64.0 by @renovate[bot] in #8467
  • chore(deps): update dependency rumdl to v0.2.37 by @renovate[bot] in #8470
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8471
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8472
  • Fix invalid empty SARIF fixes by @Sanjays2402 in #8475
  • chore(deps): update dependency djlint to v1.41.0 by @renovate[bot] in #8473
  • chore(deps): update dependency @eslint-react/eslint-plugin to v5.17.0 by @renovate[bot] in #8476
  • chore(deps): update actions/setup-python action to v7 by @renovate[bot] in #8477
  • fix: accept zero SARIF result counts by @Sanjays2402 in #8481
  • chore(deps): update dependency @eslint-react/eslint-plugin to v5.17.1 by @renovate[bot] in #8478
  • chore(deps): update dependency gitpython to v3.1.53 - autoclosed by @renovate[bot] in #8479
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8480
  • chore(deps): update actions/checkout digest to 3d3c42e by @renovate[bot] in #8482
  • chore(deps): update dependency cfn-lint to v1.53.1 - autoclosed by @renovate[bot] in #8483
  • chore(deps): update dependency powershell/powershell to v7.6.4 by @renovate[bot] in #8485
  • chore(deps): update dependency aiohttp to v3.14.2 by @renovate[bot] in #8484
  • chore(deps): update dependency langsmith to v0.10.9 by @renovate[bot] in #8435
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8486
  • Distinct status icon and max errors column for DISABLE_ERRORS_IF_LESS_THAN by @nvuillam in #8496
  • chore(deps): update dependency rumdl to v0.2.43 by @renovate[bot] in #8487
  • chore(deps): update dependency cfn-lint to v1.53.2 by @renovate[bot] in #8502
  • chore(deps): update dependency prettier to v3.9.6 by @renovate[bot] in #8506
  • chore(deps): update dependency semgrep to v1.170.1 by @renovate[bot] in #8507
  • chore(deps): update dependency @eslint-react/eslint-plugin to v5.17.3 by @renovate[bot] in #8498
  • chore(deps): update docker/login-action digest to abd2ef4 by @renovate[bot] in #8497
  • chore(deps): update dependency anchore/syft to v1.49.0 by @renovate[bot] in #8489
  • chore(deps): update ghcr.io/betterleaks/betterleaks docker tag to v1.7.0 by @renovate[bot] in #8518
  • chore(deps): update trufflesecurity/trufflehog docker tag to v3.96.0 by @renovate[bot] in #8519
  • chore(deps): update typescript-eslint monorepo to v8.65.0 by @renovate[bot] in #8520
  • chore(deps): update dependency fastapi to v0.140.0 by @renovate[bot] in #8514
  • chore(deps): update dependency mongodb/kingfisher to v1.109.0 by @renovate[bot] in #8515
  • chore(deps): update secretlint monorepo to v13.0.4 by @renovate[bot] in #8511
  • chore(deps): update redis docker tag to v8.8.1 by @renovate[bot] in #8510
  • chore(deps): update jdkato/vale docker tag to v3.15.2 by @renovate[bot] in #8509
  • chore(deps): update dependency stylelint to v17.14.1 by @renovate[bot] in #8508
  • chore(deps): update dependency langsmith to v0.10.10 by @renovate[bot] in #8505
  • chore(deps): update dependency eslint-plugin-jest to v29.15.5 by @renovate[bot] in #8503
  • chore(deps): update dependency @stoplight/spectral-cli to v6.16.2 by @renovate[bot] in #8500
  • chore(deps): update dependency @salesforce/plugin-packaging to v2.30.4 by @renovate[bot] in #8499
  • fix(deps): update langchain (minor) by @renovate[bot] in #8494
  • chore(deps): update dependency virtualenv to v21.7.0 by @renovate[bot] in #8493
  • chore(deps): update dependency djlint to v1.42.3 by @renovate[bot] in #8490
  • chore(deps): update dependency friendsofphp/php-cs-fixer to v3.95.17 by @renovate[bot] in #8504
  • chore(deps): bump fs-extra from 11.3.6 to 11.4.0 in /mega-linter-runner by @dependabot[bot] in #8532
  • chore(deps-dev): bump eslint from 10.7.0 to 10.8.0 in /mega-linter-runner by @dependabot[bot] in #8528
  • chore(deps): update dependency aiohttp to v3.14.3 by @renovate[bot] in #8501
  • chore(deps): update dependency gitpython to v3.1.56 by @renovate[bot] in #8521
  • chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.11.32 by @renovate[bot] in #8491
  • chore(deps): update dependency @eslint-react/eslint-plugin to v5.18.0 by @renovate[bot] in #8536
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8522
  • chore(deps): update dependency ruff to v0.16.0 by @renovate[bot] in #8516
  • chore(deps): update dependency semgrep to v1.171.0 by @renovate[bot] in #8517
  • chore(deps): update dependency @salesforce/cli to v2.144.6 by @renovate[bot] in #8512
  • fix(tests): skip test_api_output on remote-side API endpoint failures by @nvuillam in #8538
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8537
  • chore(deps): update dependency gitpython to v3.1.57 by @renovate[bot] in #8539
  • chore(deps): update dependency phpstan/phpstan to v2.2.6 by @renovate[bot] in #8540
  • chore(deps): lock file maintenance by @renovate[bot] in #8541
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8542
  • chore(deps): update dependency eslint-plugin-jest to v29.16.0 by @renovate[bot] in #8543
  • chore(deps): update ghcr.io/betterleaks/betterleaks docker tag to v1.7.1 by @renovate[bot] in #8545
  • chore(deps): update dependency fastapi to v0.140.7 by @renovate[bot] in #8544
  • chore(deps): update dependency langchain_google_genai to v4.3.2 by @renovate[bot] in #8548
  • chore(deps): update dependency djlint to v1.43.0 by @renovate[bot] in #8546
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8547
  • chore(deps): update docker/login-action digest to 371161b by @renovate[bot] in #8549
  • chore(deps): update dependency cfn-lint to v1.53.3 by @renovate[bot] in #8551
  • chore(deps): update dependency eslint to v10.8.0 by @renovate[bot] in #8550
  • chore(deps): update dependency sfdx-hardis to v7.23.0 by @renovate[bot] in #8492
  • fix(deps): update dependency chalk to v6 by @renovate[bot] in #8602
  • chore(deps): update mstruebing/editorconfig-checker docker tag to v3.9.0 by @renovate[bot] in #8599
  • chore(deps): update dependency redis - autoclosed by @renovate[bot] in #8589
  • chore(deps): update dependency fastapi to v0.141.1 by @renovate[bot] in #8584
  • chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.12.1 by @renovate[bot] in #8596
  • chore(deps): update dependency snakemake to v9.24.0 by @renovate[bot] in #8593
  • chore(deps): update actions/stale action to v11 by @renovate[bot] in #8601
  • chore(deps): update salesforce packages (minor) by @renovate[bot] in #8600
  • chore(deps): update jdkato/vale docker tag to v3.17.0 by @renovate[bot] in #8598
  • fix: allow CSS_STYLELINT_COMMAND_REMOVE_ARGUMENTS to remove --config-basedir by @nvuillam in #8595
  • chore(deps): update dependency semgrep to v1.172.0 by @renovate[bot] in #8592
  • chore(deps): update dependency rstcheck to v6.3.0 by @renovate[bot] in #8591
  • chore(deps): update dependency robotframework-robocop to v8.5.0 by @renovate[bot] in #8590
  • chore(deps): update dependency python-gitlab to v8.5.0 by @renovate[bot] in #8588
  • chore(deps): update dependency pip to v26.2 by @renovate[bot] in #8587
  • chore(deps): update dependency mongodb/kingfisher to v1.110.0 by @renovate[bot] in #8586
  • chore(deps): update dependency markdown-link-check to v3.15.0 by @renovate[bot] in #8585
  • chore(deps): update dependency azure/bicep to v0.46.1 by @renovate[bot] in #8583
  • chore(deps): update dependency anchore/syft to v1.50.0 by @renovate[bot] in #8582
  • chore(deps): update langchain to v1.5.3 by @renovate[bot] in #8581
  • chore(deps): update ghcr.io/betterleaks/betterleaks docker tag to v1.7.3 by @renovate[bot] in #8580
  • fix(custom-flavors): pin actions/upload-artifact to full-length SHA by @ruzickap in #8556
  • chore(deps): update dependency eslint-plugin-vue to v10.10.0 by @renovate[bot] in #8513
  • fix: add SELinux support for volume mounts by @MRDGH2821 in #8359
  • chore(deps): bump uvicorn from 0.51.0 to 0.52.0 in /server by @dependabot[bot] in #8559
  • chore(deps): update dependency djlint to v1.43.2 by @renovate[bot] in #8569
  • chore(deps): update dependency jscpd to v5.0.14 by @renovate[bot] in #8572
  • chore(deps): update dependency langsmith to v0.10.15 by @renovate[bot] in #8573
  • chore(deps): update dependency markdown to v3.10.3 by @renovate[bot] in #8574
  • chore(deps): update dependency @salesforce/plugin-packaging to v2.30.6 by @renovate[bot] in #8554
  • chore(deps): update docker/login-action digest to dbcb813 by @renovate[bot] in #8557
  • chore(deps): update dependency anchore/grype to v0.116.1 by @renovate[bot] in #8558
  • chore(deps): update dependency ruff to v0.16.1 by @renovate[bot] in #8576
  • chore(deps): update dependency phpstan/phpstan to v2.2.7 by @renovate[bot] in #8575
  • chore(deps): update dependency rumdl to v0.2.48 by @renovate[bot] in #8577
  • chore(deps): update dependency virtualenv to v21.7.1 by @renovate[bot] in #8578
  • chore(deps): update dependency friendsofphp/php-cs-fixer to v3.95.18 by @renovate[bot] in #8571
  • chore(deps): update dependency uvicorn to v0.52.1 by @renovate[bot] in #8604
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8553
  • chore(deps): update hadolint/hadolint docker tag to v2.15.1 by @renovate[bot] in #8597
  • Remove deprecated and disabled linters for v10 by @nvuillam in #8606
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8605
  • chore(deps): update dependency @eslint-react/eslint-plugin to v5.18.1 by @renovate[bot] in #8607
  • fix(ci): skip linters manifest merge job when the matrix job is skipped by @nvuillam in #8608
  • chore(deps): update dependency rumdl to v0.2.49 by @renovate[bot] in #8609
  • fix(copypaste): declare jscpd as linux/amd64 only by @nvuillam in #8610
  • fix(ci): gate BETA linter publication on tests, and simplify RELEASE linters to a single multi-arch job by @nvuillam in #8611
  • chore(deps): bump js-yaml from 4.3.0 to 5.2.2 in /mega-linter-runner by @dependabot[bot] in #8529
  • chore(deps): lock file maintenance by @renovate[bot] in #8613
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8612
  • Coding agent skills: drive MegaLinter from Claude Code, Cursor, Copilot CLI, Codex & more by @nvuillam in #8614
  • chore(deps): update dependency aquasecurity/trivy to v0.73.0 by @renovate[bot] in #8615
  • chore(deps): update actions/cache action to v5 by @renovate[bot] in #8617
  • Lighter Docker images: LLM SDKs as pip extra, evicted build toolchain, no pycache layer by @nvuillam in #8621
  • chore(deps): update actions/cache action to v6 by @renovate[bot] in #8618
  • chore(deps): update ubuntu docker tag to v26 by @renovate[bot] in #8620
  • CI and runtime performance optimizations by @nvuillam in #8624
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8619
  • Docs: coding agents promotion + readable orchestration diagram by @nvuillam in #8625
  • Docs: render coding agent icons small (40px) on the website by @nvuillam in #8626
  • Hide internal .claude skills from npx skills add discovery by @nvuillam in #8627
  • Docs: install agent skills non-interactively (npx skills add --all -y) by @nvuillam in #8628
  • chore(deps): update dependency rubocop to v1.89.0 by @renovate[bot] in #8629
  • chore(deps): update dependency rumdl to v0.2.50 by @renovate[bot] in #8630
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8631
  • Docs: document per-agent skills install (-a claude-code) by @nvuillam in #8634
  • Ignore new trivy HIGH findings: fast-uri (sf CLI) and aiohttp (checkov) by @nvuillam in #8637
  • fix(ci): restore NODE_AUTH_TOKEN fallback for mega-linter-runner publish by @nvuillam in #8643
  • chore(deps): update dependency phpstan/phpstan to v2.2.8 by @renovate[bot] in #8636
  • Forward excluded directories to project-mode linters via native CLI exclusion flags by @nvuillam in #8646
  • Changelog: rewrite beta entry for end-user readability by @nvuillam in #8650
  • chore(deps): lock file maintenance by @renovate[bot] in #8642
  • chore(deps): update dependency pip to v26.2.1 by @renovate[bot] in #8639
  • chore(deps): update dependency checkov to v3.3.9 by @renovate[bot] in #8638
  • chore(deps): update dependency gitpython to v3.1.58 by @renovate[bot] in #8632
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8647
  • Add prerun analysis mode (mega-linter-runner --prerun) by @nvuillam in #8653
  • chore(deps): update dependency rumdl to v0.2.52 by @renovate[bot] in #8652
  • chore(deps): update dependency langsmith to v0.10.16 by @renovate[bot] in #8651
  • chore(deps): update dependency squizlabs/php_codesniffer to v4.0.4 by @renovate[bot] in #8655
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8654
  • Agent skills: warn about local run requirements before the first local run by @nvuillam in #8658
  • fix: collapse fully-ignored directories when detecting gitignored files by @nvuillam in #8660
  • chore(deps): update jdkato/vale docker tag to v3.17.1 by @renovate[bot] in #8656
  • chore(deps): update python docker tag to v3.14.7 by @renovate[bot] in #8657
  • Observability v2: repository health score, multi-provider dashboards (Grafana, Datadog, Elastic, New Relic) with automatic provisioning by @nvuillam in #8661
  • Agent skills: harden local runs (parallelism cap, guaranteed JSON report, no-wait report fallbacks) by @nvuillam in #8664
  • Never hang again: default 5 min linter timeout, bounded gitignore detection, runner --timeout, checkov secrets dedup by @nvuillam in #8665
  • Observability dashboards: review and improve all providers, with official vendor agent skills by @nvuillam in #8667
  • chore(deps): update dependency sqlfluff to v4.3.0 by @renovate[bot] in #8676
  • chore(deps): update dependency @salesforce/cli to v2.146.3 by @renovate[bot] in #8674
  • chore(deps): update langchain (patch) by @renovate[bot] in #8673
  • chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.12.3 by @renovate[bot] in #8672
  • chore(deps): update dependency langsmith to v0.10.17 by @renovate[bot] in #8670
  • chore(deps): update dependency @eslint-react/eslint-plugin to v5.18.2 by @renovate[bot] in #8669
  • chore(deps): update dependency ruff to v0.16.2 by @renovate[bot] in #8671
  • chore(deps): update dependency robotframework-robocop to v8.6.0 by @renovate[bot] in #8663
  • chore(deps): update dependency cfn-lint to v1.54.0 by @renovate[bot] in #8662
  • chore(deps): update dependency mongodb/kingfisher to v1.111.0 by @renovate[bot] in #8675
  • chore(deps): update typescript-eslint monorepo to v8.66.0 by @renovate[bot] in #8677
  • chore(deps): update dependency djlint to v1.44.1 by @renovate[bot] in #8640
  • chore(deps): update dependency snakemake to v9.25.1 by @renovate[bot] in #8635
  • chore(deps): update dependency @salesforce/plugin-packaging to v3 by @renovate[bot] in #8641
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8659
  • docs: state that custom flavors are AGPL-3.0 by @laywill in #8682
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8685
  • docs(changelog): real-world before/after KPIs in beta runtime speed-ups table by @nvuillam in #8687
  • Fix FutureWarning 'Possible nested set' in secret-masking regexes by @nvuillam in #8684
  • docs: highlight impactful contributors in the Special thanks section by @nvuillam in #8688
  • chore(deps): update dependency virtualenv to v21.7.2 by @renovate[bot] in #8683
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8690
  • Make custom flavor generator output pass MegaLinter by @laywill in #8686
  • chore(deps): update mstruebing/editorconfig-checker docker tag to v3.10.0 by @renovate[bot] in #8689
  • chore(deps): update dependency mongodb/kingfisher to v1.112.0 by @renovate[bot] in #8691
  • Refresh OX Security PR comment banner and home page banner by @nvuillam in #8692
  • [automation] Auto-update linters version, help and documentation by @github-actions[bot] in #8695
  • megalinter-setup skill: enforce ghcr.io image references in upgrade mode by @nvuillam in #8694

New Contributors

MegaLinter is provided by OX Security

⭐ If MegaLinter is useful to you, please give it a star on GitHub , it helps the project a lot!

Full Changelog: v9...v10.0.0

Contributors

bdovaz, ruzickap, and 10 other contributors
Assets 2
Loading