megalinter

What's Changed

• Reporters
  • New ApiReporter (can be used to build Grafana dashboards), by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3540

• Removed deprecated linters, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3854

  • CSS_SCSSLINT: Project discontinued and advising to use stylelint
  • OPENAPI_SPECTRAL: Replaced by API_SPECTRAL (same linter but more formats handled)
  • SQL_SQL_LINT: Project no longer maintained

• Core

  • Hide to linters by default all environment variables that contain TOKEN, USERNAME or PASSWORD, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3881
  • Allow to override CLI_LINT_MODE when defined as project, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3772
  • Allow to use absolute paths for LINTER_RULES_PATH, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3775
  • Allow to update variables from PRE/POST Commands using output_variables property, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3861

• Media

  • MegaLinter: un linter pour les gouverner tous (FR), by Guillaume Arnaud from WeScale
  • MegaLinter, by Stéphane Robert, from 3DS OutScale
  • 30 Seconds to Setup MegaLinter: Your Go-To Tool for Automated Code Quality, by Peng Cao |

• Linters enhancements

  • bandit Call bandit with quiet mode to generate less logs, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3892
  • grype Count number of errors returned by Grype, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3906
  • yamllint Fix yamllint default format to avoid special characters or GitHub sections in text logs, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3898

• Fixes

  • terrascan fixed errors and removed redundant code, by @TommyE123 in https://github.com/oxsecurity/megalinter/pull/3767
  • dotnet-format various performance improvements and ability to specify sln or proj paths, by @TommyE123 in https://github.com/oxsecurity/megalinter/pull/3741
  • swiftlint Remove deprecated argument --path
  • Salesforce linters: Disable SF CLI auto update warning, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3883

• Doc

  • Add images and links to Git, CI/CD & other tools integrations at the beginning of the README, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3885
  • Create README animated GIF presentation of MegaLinter, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3910
  • Format mkdocs search index in place, by @echoix in https://github.com/oxsecurity/megalinter/pull/3890
  • Use consistent spelling of 'flavor', by @InputUsername in https://github.com/oxsecurity/megalinter/pull/3789

• CI

  • Fix docker warnings, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3853
    • FromAsCasing: 'as' and 'FROM' keywords' casing do not match
    • NoEmptyContinuation: Empty continuation line
    • SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data
  • Port Beta workflows to use docker/metadata-action, by @echoix in https://github.com/oxsecurity/megalinter/pull/3860
  • AutoUpdate linters: Always create a PR if the job has been started manually, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3863
  • Add skip_checkout: true to default MegaLinter GitHub Action template
  • Remove path filters in deploy-DEV workflow as it is a required check by @echoix in https://github.com/oxsecurity/megalinter/pull/3894

• mega-linter-runner

  • Add new rules to upgrade to MegaLinter v8, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3896
  • Replace glob-promise by glob library, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3902
    • Minimum NodeJs version is now 20.x

• Linter versions upgrades

  • ansible-lint from 24.6.1 to 24.7.0
  • bicep_linter from 0.28.1 to 0.29.47
  • black from 24.4.2 to 24.8.0
  • cfn-lint from 1.5.0 to 1.10.3
  • checkov from 3.2.174 to 3.2.232
  • clippy from 0.1.79 to 0.1.80
  • clj-kondo from 2024.05.24 to 2024.08.01
  • csharpier from 0.28.2 to 0.29.0
  • cspell from 8.10.4 to 8.14.1
  • dotnet-format from 8.0.106 to 8.0.108
  • flake8 from 7.1.0 to 7.1.1
  • golangci-lint from 1.59.1 to 1.60.1
  • grype from 0.79.2 to 0.79.5
  • jsonlint from 14.0.3 to 16.0.0
  • kics from 2.1.1 to 2.1.2
  • kubeconform from 0.6.6 to 0.6.7
  • lightning-flow-scanner from 2.28.0 to 2.33.0
  • mypy from 1.10.1 to 1.11.1
  • php-cs-fixer from 3.59.3 to 3.62.0
  • phpcs from 3.10.1 to 3.10.2
  • phpstan from 1.11.9 to 1.11.11
  • pmd from 7.3.0 to 7.4.0
  • prettier from 3.3.2 to 3.3.3
  • protolint from 0.50.2 to 0.50.5
  • pylint from 3.2.5 to 3.2.6
  • pyright from 1.1.370 to 1.1.376
  • revive from 1.3.7 to 1.3.9
  • rstcheck from 6.2.1 to 6.2.4
  • rubocop from 1.64.1 to 1.65.1
  • ruff from 0.5.1 to 0.6.1
  • sfdx-scanner-apex from 4.3.2 to 4.4.0
  • sfdx-scanner-aura from 4.3.2 to 4.4.0
  • sfdx-scanner-lwc from 4.3.2 to 4.4.0
  • snakemake from 8.15.2 to 8.18.1
  • stylelint from 16.6.1 to 16.8.2
  • swiftlint from 0.55.1 to 0.56.1
  • syft from 1.8.0 to 1.11.0
  • terraform-fmt from 1.9.0 to 1.9.4
  • terragrunt from 0.59.6 to 0.66.8
  • tflint from 0.52.0 to 0.53.0
  • trivy-sbom from 0.53.0 to 0.54.1
  • trivy from 0.53.0 to 0.54.1
  • trufflehog from 3.79.0 to 3.81.9
  • v8r from 3.1.0 to 4.0.1
  • vale from 3.6.0 to 3.7.0

New Contributors

• @InputUsername made their first contribution in https://github.com/oxsecurity/megalinter/pull/3789

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v7.13.0...v8.0.0

What's Changed

• New linters

  • Add ls-lint, file and folder linter, by @scolladon in https://github.com/oxsecurity/megalinter/pull/3681

• Core

  • Handle renovate version comments in build script, by @echoix in https://github.com/oxsecurity/megalinter/pull/3617 , https://github.com/oxsecurity/megalinter/pull/3627 , https://github.com/oxsecurity/megalinter/pull/3643 , https://github.com/oxsecurity/megalinter/pull/3699 , https://github.com/oxsecurity/megalinter/pull/3700
  • Update base image to python:3.12.4-alpine3.20
  • Use dotnet8-sdk available in the main repository, by @TommyE123 in https://github.com/oxsecurity/megalinter/pull/3696

• Media

  • Introducing MegaLinter: Streamlining Code Quality Checks Across Multiple Languages, by Cloud Tuned
  • Infrastructure as Code GitHub Codespace Template, by Luke Murray
  • Video: How to: Secrets scanning, by Hackitect's playground

• Linters enhancements

  • Add SARIF support (v2) for all PHP linters by @llaville in https://github.com/oxsecurity/megalinter/pull/3745 , https://github.com/oxsecurity/megalinter/pull/3729
  • Add python package Pygments to rst-lint venv, by @bobidle in https://github.com/oxsecurity/megalinter/pull/3631
  • CSharpier added ability to override config filename and path, by @TommyE123 in https://github.com/oxsecurity/megalinter/pull/3664
  • xmllint added support for xsd files, by @TommyE123 in https://github.com/oxsecurity/megalinter/pull/3665

• Fixes

  • Improve support for single argument in get_list_args function, by @TommyE123 in https://github.com/oxsecurity/megalinter/pull/3589
  • ansible-lint Improved activation by checking for .ansible-lint config file, by @TommyE123 in https://github.com/oxsecurity/megalinter/pull/3697
  • DevSkim fixed fatal errors when scanning and ability to override config path, by @TommyE123 in https://github.com/oxsecurity/megalinter/pull/3673
  • GitLeaks add missing schema properties, by @TommyE123 in https://github.com/oxsecurity/megalinter/pull/3675
  • Powershell Error table truncation improvements, by @TommyE123 in https://github.com/oxsecurity/megalinter/pull/3620
  • Powershell added missing schema property POWERSHELL_POWERSHELL_FORMATTER_OUTPUT_ENCODING, by @TommyE123 in https://github.com/oxsecurity/megalinter/pull/3678
  • syft use scan instead of deprecated packages arg, by @TommyE123 in https://github.com/oxsecurity/megalinter/pull/3613
  • tflint added missing schema property TERRAFORM_TFLINT_SECURED_ENV, by @TommyE123 in https://github.com/oxsecurity/megalinter/pull/3679
  • tflint fixed deprecated argument and other improvements to default .tflint.hcl template, by @TommyE123 in https://github.com/oxsecurity/megalinter/pull/3688
  • xmllint added missing schema properties XML_XMLLINT_AUTOFORMAT and XML_XMLLINT_INDENT, by @TommyE123 in https://github.com/oxsecurity/megalinter/pull/3677
  • yamllint fix error/warning count to work with different log output formats, by @TommyE123 in https://github.com/oxsecurity/megalinter/pull/3612

• Doc

  • Update documentation icons by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3625

• Flavors

  • Add gherkin-lint in c_cpp flavor, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3698

• CI

  • Bump actions/checkout from 3 to 4, by @KristjanESPERANTO in https://github.com/oxsecurity/megalinter/pull/2994
  • Reduce dependabot PR frequency to weekly by @echoix in https://github.com/oxsecurity/megalinter/pull/3642

• Linter versions upgrades

  • ansible-lint from 24.2.3 to 24.6.1
  • bandit from 1.7.8 to 1.7.9
  • bash-exec from 5.2.21 to 5.2.26
  • bicep_linter from 0.27.1 to 0.28.1
  • cfn-lint from 0.87.4 to 1.5.0
  • checkov from 3.2.122 to 3.2.174
  • clang-format from 17.0.5 to 17.0.6
  • clippy from 0.1.78 to 0.1.79
  • cspell from 8.8.3 to 8.10.4
  • editorconfig-checker from 3.0.1 to 3.0.3
  • flake8 from 7.0.0 to 7.1.0
  • git_diff from 2.43.4 to 2.45.2
  • gitleaks from 8.18.2 to 8.18.4
  • golangci-lint from 1.59.0 to 1.59.1
  • grype from 0.78.0 to 0.79.2
  • helm from 3.14.2 to 3.14.3
  • jscpd from 4.0.4 to 4.0.5
  • kics from 2.0.1 to 2.1.1
  • ktlint from 1.2.1 to 1.3.1
  • lightning-flow-scanner from 2.26.0 to 2.28.0
  • markdown-table-formatter from 1.6.0 to 1.6.1
  • mypy from 1.10.0 to 1.10.1
  • npm-package-json-lint from 7.1.0 to 8.0.0
  • php-cs-fixer from 3.58.1 to 3.59.3
  • phplint from 9.3.1 to 9.4.1
  • phpstan from 1.11.3 to 1.11.7
  • pmd from 7.1.0 to 7.3.0
  • prettier from 3.3.0 to 3.3.2
  • protolint from 0.49.7 to 0.50.2
  • psalm from Psalm.5.24.0@ to Psalm.5.25.0@
  • pylint from 3.2.2 to 3.2.5
  • pyright from 1.1.365 to 1.1.370
  • ruff from 0.4.10 to 0.5.1
  • sfdx-scanner-apex from 3.25.0 to 4.3.2
  • sfdx-scanner-aura from 3.25.0 to 4.3.2
  • sfdx-scanner-lwc from 3.25.0 to 4.3.2
  • snakemake from 8.12.0 to 8.15.2
  • sqlfluff from 3.0.7 to 3.1.0
  • swiftlint from 0.54.0 to 0.55.1
  • syft from 1.5.0 to 1.8.0
  • terraform-fmt from 1.8.4 to 1.9.0
  • terragrunt from 0.58.13 to 0.59.6
  • tflint from 0.51.1 to 0.52.0
  • trivy-sbom from 0.51.4 to 0.53.0
  • trivy from 0.51.4 to 0.53.0
  • trufflehog from 3.77.0 to 3.79.0
  • v8r from 3.0.0 to 3.1.0
  • vale from 3.4.2 to 3.6.0
  • xmllint from 21108 to 21207

New Contributors

• @renovate made their first contribution in https://github.com/oxsecurity/megalinter/pull/3605
• @bobidle made their first contribution in https://github.com/oxsecurity/megalinter/pull/3631
• @KristjanESPERANTO made their first contribution in https://github.com/oxsecurity/megalinter/pull/2994
• @scolladon made their first contribution in https://github.com/oxsecurity/megalinter/pull/3681

MegaLinter is graciously provided by

Please share the release post on LinkedIn

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v7.12.0...v7.13.0

What's Changed

• Core

  • Add new logs (at debug level) on each linter activation/deactivation
  • Clean MegaLinter own CVE exceptions and order the remaining ones with links to related issues
  • Upgrade to Java 21 except for npm-groovy-lint that requires Java 17

• Media

  • Add blog post 5 ways MegaLinter upped our DevSecOps game to the list of English articles by @wesley-dean-flexion in https://github.com/oxsecurity/megalinter/pull/3596

• Linters

  • Add PHP fixer by @llaville in https://github.com/oxsecurity/megalinter/pull/3598
  • API_SPECTRAL was added as replacement for OPENAPI_SPECTRAL (deprecated), supporting AsyncAPI and OpenAPI by default. Uses Spectral's standard config file name .spectral.yaml instead of .openapirc.yml with a default config with rulesets for AsyncAPI and OpenAPI enabled. Fixes #3387
  • Disable SQL_TSQLLINT until security issues are solved. Related to https://github.com/tsqllint/tsqllint/issues/333
  • PHP linters (PHP_PHPCS, PHP_PHPLINT, PHP_PHPSTAN) add support to SARIF report output format with help of https://github.com/llaville/sarif-php-sdk
  • Php psalm improvement by @llaville in https://github.com/oxsecurity/megalinter/pull/3541
  • KOTLIN_KTLINT now supports list_of_files mode, and has better error counting
  • Upgrade KOTLIN_DETEKT and make it work with cli_lint_mode = project

• Fixes

  • Change golangci-lint lint mode to project, by @wandering-tales in https://github.com/oxsecurity/megalinter/pull/3509
  • Disable sql-lint as it is no longer maintained
  • Add new entries findUnusedCode and findUnusedBaselineEntry in default psalm.xml configuration file for PHP_PSALM linter. Related to https://github.com/oxsecurity/megalinter/issues/3538
  • fix(pylint): overgeneral-exceptions fully qualified name by @gardar in https://github.com/oxsecurity/megalinter/pull/3576
  • Update ktlint descriptor to support list_of_files and better error counting by @Yann-J in https://github.com/oxsecurity/megalinter/pull/3575
  • Sync PowerShell version in arm.megalinter-descriptor.yml by @echoix in https://github.com/oxsecurity/megalinter/pull/3586
  • Adjust find commands to clean up files in same step by @echoix in https://github.com/oxsecurity/megalinter/pull/3588
  • Upgrade KOTLIN_DETEKT and make it work with cli_lint_mode = project by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3590

• Doc

  • Handle disabled_reason property in descriptors
  • Sort enums in json schema, by @echoix in https://github.com/oxsecurity/megalinter/pull/3595

• CI

  • Build: take in account disabled linters for workflow auto-update
  • Remove useless package-lock.json that was in python tests folder
  • Fix SARIF_REPORTER that was wrongly sent to true to format & fix test methods
  • Build: Write ARG lines at the top of Dockerfiles if they are used by FROM variables
  • Remove Github Actions Workflow telemetry to improve performances
  • Update Docker image for Gitpod to run on Ubuntu Noble, by @echoix
  • Update makefile bootstrap config (gitpod or local) to use uv for package installation, by @echoix
  • Use uv to install Python deps for CI by @echoix in https://github.com/oxsecurity/megalinter/pull/3561
  • Use a single find command to delete pycache files by @echoix in https://github.com/oxsecurity/megalinter/pull/3562
  • Sort schema enums by @echoix in https://github.com/oxsecurity/megalinter/pull/3595

• Linter versions upgrades

  • actionlint from 1.6.27 to 1.7.1 on 2024-05-28
  • ansible-lint from 24.2.2 to 24.2.3 on 2024-05-20
  • bicep_linter from 0.26.170 to 0.27.1 on 2024-05-07
  • black from 24.4.0 to 24.4.2 on 2024-04-26
  • cfn-lint from 0.86.4 to 0.87.4 on 2024-05-28
  • checkov from 3.2.74 to 3.2.122 on 2024-05-04
  • checkstyle from 10.15.0 to 10.17.0 on 2024-05-27
  • clippy from 0.1.77 to 0.1.78 on 2024-05-04
  • clj-kondo from 2024.03.13 to 2024.05.24 on 2024-05-25
  • csharpier from 0.28.1 to 0.28.2 on 2024-04-26
  • cspell from 8.7.0 to 8.8.3 on 2024-05-24
  • detekt from 1.23.5 to 1.23.6 on 2024-05-28
  • dotnet-format from 8.0.104 to 8.0.106 on 2024-06-01
  • editorconfig-checker from 2.7.2 to 3.0.1 on 2024-04-30
  • git_diff from 2.43.0 to 2.43.4 on 2024-05-18
  • golangci-lint from 1.57.2 to 1.59.0 on 2024-05-27
  • grype from 0.77.0 to 0.78.0 on 2024-05-28
  • jscpd from 3.5.10 to 4.0.4 on 2024-05-28
  • kics from 2.0.0 to 2.0.1 on 2024-05-04
  • kubeconform from 0.6.4 to 0.6.6 on 2024-05-12
  • lightning-flow-scanner from 2.22.0 to 2.24.0 on 2024-05-20
  • luacheck from 1.1.2 to 1.2.0 on 2024-05-25
  • lychee from 0.14.3 to 0.15.1 on 2024-05-13
  • markdown-link-check from 3.12.1 to 3.12.2 on 2024-05-22
  • markdown-table-formatter from 1.5.0 to 1.6.0 on 2024-04-27
  • markdownlint from 0.39.0 to 0.41.0 on 2024-05-26
  • mypy from 1.9.0 to 1.10.0 on 2024-04-26
  • npm-groovy-lint from 14.4.1 to 14.6.0 on 2024-05-12
  • phpcs from 3.9.1 to 3.10.1 on 2024-04-23
  • phplint from 9.1.2 to 9.3.1 on 2024-05-18
  • phpstan from 1.10.67 to 1.11.0 to 1.11.3 on 2024-05-31
  • pmd from 6.55.0 to 7.1.0 on 2024-04-28
  • powershell from 7.4.1 to 7.4.2 on 2024-04-28
  • powershell_formatter from 7.4.1 to 7.4.2 on 2024-04-28
  • prettier from 3.2.5 to 3.3.0 on 2024-06-01
  • proselint from 0.13.0 to 0.14.0 on 2024-05-24
  • protolint from 0.49.6 to 0.49.7 on 2024-05-04
  • psalm from Psalm.5.23.1@ to Psalm.5.24.0@ on 2024-05-04
  • pylint from 3.1.0 to 3.2.2 on 2024-05-20
  • pyright from 1.1.359 to 1.1.365 on 2024-05-31
  • roslynator from 0.8.6.0 to 0.8.9.0 on 2024-06-01
  • rubocop from 1.63.3 to 1.64.1 on 2024-05-31
  • ruff from 0.4.1 to 0.4.7 on 2024-05-31
  • scalafix from 0.12.0 to 0.12.1 on 2024-05-04
  • secretlint from 8.2.3 to 8.2.4 on 2024-04-29
  • sfdx-scanner-apex from 3.23.0 to 3.25.0 on 2024-05-28
  • sfdx-scanner-aura from 3.23.0 to 3.25.0 on 2024-05-28
  • sfdx-scanner-lwc from 3.23.0 to 3.25.0 on 2024-05-28
  • snakefmt from 0.10.1 to 0.10.2 on 2024-05-12
  • snakemake from 8.10.8 to 8.12.0 on 2024-05-27
  • sqlfluff from 3.0.5 to 3.0.7 on 2024-05-24
  • stylelint from 16.4.0 to 16.6.1 on 2024-05-28
  • syft from 1.2.0 to 1.5.0 on 2024-05-28
  • tekton-lint from 1.0.2 to 1.1.0 on 2024-05-25
  • terraform-fmt from 1.8.1 to 1.8.4 on 2024-05-25
  • terragrunt from 0.57.5 to 0.58.10 on 2024-05-27
  • tflint from 0.50.3 to 0.51.1 on 2024-06-02
  • trivy-sbom from 0.50.2 to 0.51.4 on 2024-05-25
  • trivy from 0.50.2 to 0.51.4 on 2024-05-25
  • trufflehog from 3.73.0 to 3.77.0 on 2024-05-28
  • vale from 3.4.0 to 3.4.2 on 2024-05-04
  • xmllint from 21107 to 21108 on 2024-05-18

New Contributors

• @gardar made their first contribution in https://github.com/oxsecurity/megalinter/pull/3576

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v7...v7.12.0

What's Changed

• Fixes

  • Implement fallback in case git diff does not work with merge-base, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3503

• Linter versions upgrades

  • stylelint from 16.3.1 to 16.4.0

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v7.11.0...v7.11.1

What's Changed

• Core

  • Allow to override the number of parallel cores used, with variable PARALLEL_PROCESS_NUMBER, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3428
  • Upgrade base python image from 3.12.2-alpine3.19 to 3.12.3-alpine3.19
  • Upgrade PHP 8.1 to 8.3 by @llaville in https://github.com/oxsecurity/megalinter/pull/3464
  • Add descriptor pre / post commands, by @bdovaz in https://github.com/oxsecurity/megalinter/pull/3468
  • Allow merge lists with EXTENDS, by @bdovaz in https://github.com/oxsecurity/megalinter/pull/3469

• Media

• New linters

  • Add Kotlin detekt linter, by @enciyo in https://github.com/oxsecurity/megalinter/pull/3408

• Reporters

  • Add ruff sarif support, by @Skitionek in https://github.com/oxsecurity/megalinter/pull/3486

• Fixes

  • Fix listing of modified files, by @vkucera in https://github.com/oxsecurity/megalinter/pull/3472. Fixes https://github.com/oxsecurity/megalinter/issues/2125.
  • Fix conflict between prettier and yamllint about spaces, by @apeyrat in https://github.com/oxsecurity/megalinter/pull/3426
  • Ensure trufflehog does not auto-update itself, by @wandering-tales in https://github.com/oxsecurity/megalinter/pull/3430
  • Salesforce linters: use sf + default Flow Scanner rules, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3435
  • Disable JSON_ESLINT_PLUGIN_JSONC until https://github.com/ota-meshi/eslint-plugin-jsonc/issues/328 is fixed
  • Upgrade tar in mega-linter-runner
  • secretlint: remove default .secretlintignore that was never used but .gitignore is used instead. Fixes #3328
  • Add jpeg, xlsx to .gitleaks.toml, by @rasa in https://github.com/oxsecurity/megalinter/pull/3434
  • Fix Json Schema, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3470
  • Remove TEMPLATES/.secretlintignore, by @pjungermann in https://github.com/oxsecurity/megalinter/pull/3476

• Doc

  • Update R2DevOps logo, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3436
  • Update Roslynator repo url and logo, by @TommyE123 in https://github.com/oxsecurity/megalinter/pull/3444
  • Fix clang-format documentation links to point to the correct version. Fixes #3452, by @daltonv in https://github.com/oxsecurity/megalinter/pull/3453
  • Add copy to clipboard button in code block (documentation), by @nikkii86 in https://github.com/oxsecurity/megalinter/pull/3491

• Flavors

  • Add C & C++ linters in Python flavor by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3456

• CI

  • Make SPELL_LYCHEE non blocking for internal CI jobs
  • Remove old unused automerge workflows by @echoix in https://github.com/oxsecurity/megalinter/pull/3432
  • Add consistent python3/python handling at build.sh, by @pjungermann in https://github.com/oxsecurity/megalinter/pull/3475

• Linter versions upgrades

  • ansible-lint from 24.2.0 to 24.2.2
  • bicep_linter from 0.25.53 to 0.26.170
  • black from 24.2.0 to 24.4.0
  • cfn-lint from 0.86.0 to 0.86.4
  • checkov from 3.2.34 to 3.2.74
  • checkstyle from 10.14.0 to 10.15.0
  • clippy from 0.1.76 to 0.1.77
  • clj-kondo from 2024.03.05 to 2024.03.13
  • csharpier from 0.27.3 to 0.28.1
  • cspell from 8.6.0 to 8.7.0
  • devskim from 1.0.32 to 1.0.33
  • dotnet-format from 8.0.102 to 8.0.104
  • eslint-plugin-jsonc from 2.13.0 to 2.15.1
  • golangci-lint from 1.56.2 to 1.57.2
  • grype from 0.74.7 to 0.77.0
  • kics from 1.7.13 to 2.0.0
  • lightning-flow-scanner from 2.18.0 to 2.22.0
  • markdown-link-check from 3.11.2 to 3.12.1
  • npm-groovy-lint from 14.2.3 to 14.4.1
  • phpcs from 3.9.0 to 3.9.1
  • phpstan from 1.10.60 to 1.10.67
  • protolint from 0.48.0 to 0.49.6
  • psalm from Psalm.5.23.0@ to Psalm.5.23.1@
  • pyright from 1.1.353 to 1.1.359
  • roslynator from 0.8.3.0 to 0.8.6.0
  • rstcheck from 6.2.0 to 6.2.1
  • rubocop from 1.62.0 to 1.63.3
  • ruff from 0.3.2 to 0.4.1
  • secretlint from 8.1.2 to 8.2.3
  • sfdx-scanner-apex from 3.21.0 to 3.23.0
  • sfdx-scanner-aura from 3.21.0 to 3.23.0
  • sfdx-scanner-lwc from 3.21.0 to 3.23.0
  • snakefmt from 0.10.0 to 0.10.1
  • snakemake from 8.5.5 to 8.10.8
  • spectral from 6.11.0 to 6.11.1
  • sqlfluff from 2.3.5 to 3.0.5
  • stylelint from 16.2.1 to 16.3.1
  • syft from 1.0.1 to 1.2.0
  • tekton-lint from 1.0.0 to 1.0.2
  • terraform-fmt from 1.7.4 to 1.8.1
  • terragrunt from 0.55.13 to 0.57.5
  • trivy-sbom from 0.49.1 to 0.50.2
  • trivy from 0.49.1 to 0.50.2
  • trufflehog from 3.69.0 to 3.73.0
  • vale from 3.2.2 to 3.4.0

New Contributors

• @apeyrat made their first contribution in https://github.com/oxsecurity/megalinter/pull/3426
• @wandering-tales made their first contribution in https://github.com/oxsecurity/megalinter/pull/3430
• @enciyo made their first contribution in https://github.com/oxsecurity/megalinter/pull/3408
• @Skitionek made their first contribution in https://github.com/oxsecurity/megalinter/pull/3486
• @nikkii86 made their first contribution in https://github.com/oxsecurity/megalinter/pull/3491

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v7.10.0...v7.11.0

What's Changed

• Core

  • Update dotnet linters to .NET 8, by @bdovaz in https://github.com/oxsecurity/megalinter/pull/3182

• Media

  • How to use MegaLinter with Jenkins, by Darin Pope / Cloudbees

• Fixes

  • Trivy: use misconfig instead of the deprecated config scanner, updating the default arguments, by @pjungermann in https://github.com/oxsecurity/megalinter/pull/3376
  • Update calls to sfdx-scanner to output a CSV file for Aura & LWC, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3398
  • Kics: fixed error count in the summary table, by @TommyE123 in https://github.com/oxsecurity/megalinter/pull/3402
  • Fix issue with EXTENDS using private repository by sending GITHUB_TOKEN as HTTP auth header, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3404
  • Fix SPELL_VALE_CONFIG_FILE not working (handle the override of linter CONFIG_FILE if the linter is activated only if some files are found), by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3409

• CI

  • Enable dependabot updates for devcontainer and other Docker directories, by @echoix in https://github.com/oxsecurity/megalinter/pull/3390

• Doc

  • Removed obsolete warning for semgrep as the issue has been fixed, by @Jayllyz in https://github.com/oxsecurity/megalinter/pull/3374
  • docs: fix docs in TrivySbomLinter.py, by @pjungermann in https://github.com/oxsecurity/megalinter/pull/3377

• Linter versions upgrades

  • actionlint from 1.6.26 to 1.6.27
  • bandit from 1.7.7 to 1.7.8
  • bicep_linter from 0.25.3 to 0.25.53
  • black from 24.1.1 to 24.2.0
  • cfn-lint from 0.85.1 to 0.86.0
  • checkov from 3.2.20 to 3.2.21
  • checkstyle from 10.13.0 to 10.14.0
  • clj-kondo from 2023.12.15 to 2024.03.05
  • csharpier from 0.27.2 to 0.27.3
  • cspell from 8.3.2 to 8.6.0
  • devskim from 1.0.28 to 1.0.32
  • dotnet-format from 7.0.115 to 8.0.102
  • eslint from 8.56.0 to 8.57.0
  • golangci-lint from 1.56.1 to 1.56.2
  • grype from 0.74.5 to 0.74.7
  • helm from 3.13.2 to 3.14.2
  • kics from 1.7.12 to 1.7.13
  • ktlint from 1.1.1 to 1.2.1
  • lightning-flow-scanner from 2.16.0 to 2.18.0
  • mypy from 1.8.0 to 1.9.0
  • npm-groovy-lint from 14.2.1 to 14.2.3
  • phpcs from 3.8.1 to 3.9.0
  • phpstan from 1.10.57 to 1.10.60
  • powershell from 7.4.0 to 7.4.1
  • powershell_formatter from 7.4.0 to 7.4.1
  • protolint from 0.47.5 to 0.48.0
  • psalm from Psalm.5.21.1@ to Psalm.5.23.0@
  • pylint from 3.0.3 to 3.1.0
  • pyright from 1.1.350 to 1.1.353
  • rubocop from 1.60.2 to 1.62.0
  • ruff from 0.2.1 to 0.3.2
  • scalafix from 0.11.1 to 0.12.0
  • secretlint from 8.1.1 to 8.1.2
  • shellcheck from 0.9.0 to 0.10.0
  • snakemake from 8.4.8 to 8.5.5
  • syft from 0.104.0 to 1.0.1
  • terraform-fmt from 1.7.3 to 1.7.4
  • terragrunt from 0.55.1 to 0.55.13
  • trufflehog from 3.67.5 to 3.69.0
  • vale from 3.0.5 to 3.2.2
  • xmllint from 21106 to 21107
  • yamllint from 1.34.0 to 1.35.1

New Contributors

• @TommyE123 made their first contribution in https://github.com/oxsecurity/megalinter/pull/3402

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v7.9.0...v7.10.0

What's Changed

• Core

  • Upgrade actions/checkout and stefanzweifel/git-auto-commit-action in generator template workflow, by @Jayllyz in #3327
  • Upgrade base python image to python:3.12.2-alpine3.19

• Fixes

  • Format powershell linter output into terminal-wide table, and count errors, by @efrecon in #3318
  • Allow active_only_if_file_found to work in specified subdirectory (_DIRECTORY), fixes #2873, by @TimothyEarley in #3323
  • Activate CI servers reporters only if we find a related default env variable, by @nvuillam in #3321

• Doc

  • Update copyright year to 2024, by @Jayllyz in #3339

• CI

  • Free more disk space before docker build
  • Upgrade peter-evans/create-pull-request from v5 to v6 in GitHub Actions workflows

• Linter versions upgrades

  • ansible-lint from 6.22.2 to 24.2.0
  • bandit from 1.7.6 to 1.7.7
  • bicep_linter from 0.24.24 to 0.25.3
  • black from 23.12.1 to 24.1.1
  • cfn-lint from 0.84.0 to 0.85.1
  • checkov from 3.1.67 to 3.2.20
  • checkstyle from 10.12.7 to 10.13.0
  • clippy from 0.1.75 to 0.1.76
  • csharpier from 0.27.0 to 0.27.2
  • eslint-plugin-jsonc from 2.12.2 to 2.13.0
  • gitleaks from 8.18.1 to 8.18.2
  • golangci-lint from 1.55.2 to 1.56.1
  • grype from 0.63.1 to 0.74.5
  • lychee from 0.14.1 to 0.14.3
  • markdownlint from 0.38.0 to 0.39.0
  • npm-groovy-lint from 14.2.0 to 14.2.1
  • phplint from 9.1.0 to 9.1.2
  • phpstan from 1.10.56 to 1.10.57
  • prettier from 3.2.4 to 3.2.5
  • psalm from Psalm.5.20.0@ to Psalm.5.21.1@
  • puppet-lint from 4.2.3 to 4.2.4
  • pyright from 1.1.347 to 1.1.350
  • revive from 1.3.6 to 1.3.7
  • roslynator from 0.8.2.0 to 0.8.3.0
  • rubocop from 1.60.1 to 1.60.2
  • ruff from 0.1.14 to 0.2.1
  • secretlint from 8.1.0 to 8.1.1
  • sfdx-scanner-apex from 3.20.0 to 3.21.0
  • sfdx-scanner-aura from 3.20.0 to 3.21.0
  • sfdx-scanner-lwc from 3.20.0 to 3.21.0
  • shfmt from 3.7.0 to 3.8.0
  • snakefmt from 0.9.0 to 0.10.0
  • snakemake from 8.2.3 to 8.4.8
  • stylelint from 16.2.0 to 16.2.1
  • syft from 0.101.1 to 0.104.0
  • terraform-fmt from 1.7.0 to 1.7.3
  • terragrunt from 0.54.20 to 0.55.1
  • tflint from 0.50.1 to 0.50.3
  • trivy-sbom from 0.48.3 to 0.49.1
  • trivy from 0.48.3 to 0.49.1
  • trufflehog from 3.63.10 to 3.67.5
  • v8r from 2.1.0 to 3.0.0
  • yamllint from 1.33.0 to 1.34.0

New Contributors

• @Jayllyz made their first contribution in https://github.com/oxsecurity/megalinter/pull/3327
• @TimothyEarley made their first contribution in https://github.com/oxsecurity/megalinter/pull/3323
• @efrecon made their first contribution in https://github.com/oxsecurity/megalinter/pull/3318

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v7.8.0...v7.9.0

What's Changed

• Reporters

  • New reporter MARKDOWN_SUMMARY_REPORTER, allows saving MegaLinter results summary as a markdown file. This file can be further utilised to add comments on the pull request (PR) from Jenkins and other continuous integration (CI) tools by @saishivarcr in https://github.com/oxsecurity/megalinter/pull/3250
  • New reporter BITBUCKET_COMMENT_REPORTER allowing to post MegaLinter results as comments on Bitbucket pull requests by @saishivarcr in https://github.com/oxsecurity/megalinter/pull/3256

• Media

  • (FR) MegaLinter presentation at DevCon 20 / Programmez Magazine, by Nicolas Vuillamy

• Core

  • mega-linter-runner: Remove container by default, except of no-remove-container option is sent by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3203
  • Upgrade base image from python:3.11.6-alpine3.18 to python:3.11.7-alpine3.18, by @echoix in #3212
  • Upgrade to python 3.12.0 by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3006
  • Upgrade actions/upload-artifact@v3 to actions/upload-artifact@v4 in default workflows by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3225
  • mega-linter-runner: Improve check if running as script or module, by @echoix in #3233

• Fixes

  • tekton-lint is now published as @ibm/tekton-lint, by @echoix in #3210
  • PHP PHIVE: Use keys.openpgp.org and fingerprint for phive key verification, by @echoix in #3230
  • Undowngrade sass linters, by @echoix in #3260
  • Upgrade lychee default configuration to handle breaking change between 0.13.0 and 0.14.0
  • Hadolint: support both Containerfile and Dockerfile by @sanmai-NL in https://github.com/oxsecurity/megalinter/pull/3217

• Doc

  • Upgrade url to PHP CodeSniffer, as now the original repo is not maintained anymore by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3201

• CI

  • Use docker/metadata-action for deploy-DEV.yml workflow, by @echoix in #3193

• Linter versions upgrades

  • ansible-lint from 6.22.1 to 6.22.2
  • bash-exec from 5.2.15 to 5.2.21
  • bicep_linter from 0.23.1 to 0.24.24 on 2023-12-14
  • black from 23.11.0 to 23.12.1 on 2023-12-23
  • cfn-lint from 0.83.4 to 0.84.0
  • checkov from 3.1.27 to 3.1.67
  • checkstyle from 10.12.6 to 10.12.7
  • clippy from 0.1.74 to 0.1.75 on 2023-12-28
  • clj-kondo from 2023.10.20 to 2023.12.15 on 2023-12-15
  • csharpier from 0.26.4 to 0.27.0
  • cspell from 8.1.3 to 8.3.2
  • devskim from 1.0.23 to 1.0.28
  • djlint from 1.34.0 to 1.34.1 on 2023-12-22
  • dotnet-format from 7.0.114 to 7.0.115
  • eslint-plugin-jsonc from 2.10.0 to 2.12.2
  • eslint from 8.55.0 to 8.56.0 on 2023-12-16
  • flake8 from 6.1.0 to 7.0.0
  • git_diff from 2.40.1 to 2.43.0
  • helm from 3.11.3 to 3.13.2
  • isort from 5.13.0 to 5.13.2 on 2023-12-13
  • kics from 1.7.11 to 1.7.12 on 2023-12-22
  • ktlint from 1.0.1 to 1.1.1
  • lychee from 0.13.0 to 0.14.1
  • mypy from 1.7.1 to 1.8.0 on 2023-12-22
  • npm-groovy-lint from 13.0.2 to 14.2.0
  • phpcs from 3.8.0 to 3.8.1
  • phplint from 9.0.6 to 9.1.0 on 2023-12-17
  • phpstan from 1.10.48 to 1.10.56
  • prettier from 3.1.0 to 3.2.4
  • protolint from 0.46.3 to 0.47.5
  • psalm from Psalm.5.17.0@ to Psalm.5.20.0@
  • pylint from 3.0.2 to 3.0.3 on 2023-12-13
  • pyright from 1.1.339 to 1.1.347
  • revive from 1.3.4 to 1.3.6
  • roslynator from 0.8.1.0 to 0.8.2.0
  • rubocop from 1.58.0 to 1.60.1
  • ruff from 0.1.7 to 0.1.14 on 2023-12-13
  • secretlint from 8.0.0 to 8.1.0 on 2023-12-28
  • sfdx-scanner-apex from 3.19.0 to 3.20.0
  • sfdx-scanner-aura from 3.19.0 to 3.20.0
  • sfdx-scanner-lwc from 3.19.0 to 3.20.0
  • snakefmt from 0.8.5 to 0.9.0
  • snakemake from 7.32.4 to 8.2.3
  • stylelint from 15.11.0 to 16.2.0
  • syft from 0.98.0 to 0.101.1 on 2023-12-22
  • tekton-lint from 0.6.0 to 1.0.0
  • terraform-fmt from 1.6.5 to 1.7.0
  • terragrunt from 0.54.0 to 0.54.20
  • terrascan from 1.18.3 to 1.18.11
  • tflint from 0.49.0 to 0.50.1
  • trivy-sbom from 0.48.0 to 0.48.3
  • trivy from 0.48.0 to 0.48.3
  • trufflehog from 3.63.2 to 3.63.10
  • vale from 2.30.0 to 3.0.5

New Contributors

• @saishivarcr made their first contribution in https://github.com/oxsecurity/megalinter/pull/3250

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v7.7.0...v7.8.0

What's Changed

• Core

  • Update base java apk package to openjdk 17 by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3160
  • Update dotnet linters to .NET 7 by @bdovaz in https://github.com/oxsecurity/megalinter/pull/2402

• Media

  • Try using MegaLinter (article in japanese) by Takashi Minayaga

• New linters

  • Add clang-format c & cpp formatting linter including "apply fix" support by @daltonv in https://github.com/oxsecurity/megalinter/pull/3089
  • Add Roslynator C# linter by @bdovaz in https://github.com/oxsecurity/megalinter/pull/3155

• Fixes

  • Call jscpd with --gitignore to ignore copy-pastes in files matching .gitignore
  • cpplint: Dynamically add the list of extensions from list of files in --extensions parameter by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3149
  • Fix mkdocs generation + CI control job by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3135
  • Add semgrep ruleset to validation schema by @wesley-dean-flexion in https://github.com/oxsecurity/megalinter/pull/3164
  • Downgrade stylelint to avoid crash with not v16 compliant dependencies
  • Fix count of yaml-lint errors by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3198
  • Remove openssl reinstall, as base image has updated version from alpine 3.18.5 by @echoix in https://github.com/oxsecurity/megalinter/pull/3181

• CI

  • Add arguments to make use of pytest-xdist, by @echoix in https://github.com/oxsecurity/megalinter/pull/3150

• Linter versions upgrades

  • ansible-lint from 6.22.0 to 6.22.1
  • bandit from 1.7.5 to 1.7.6
  • cfn-lint from 0.83.3 to 0.83.4
  • checkov from 3.0.39 to 3.1.25
  • checkstyle from 10.12.5 to 10.12.6
  • csharpier from 0.26.2 to 0.26.4
  • cspell from 8.0.0 to 8.1.3
  • dotnet-format from 6.0.417 to 7.0.114
  • eslint from 8.54.0 to 8.55.0
  • gitleaks from 8.18.0 to 8.18.1
  • isort from 5.12.0 to 5.13.0
  • lightning-flow-scanner from 2.15.0 to 2.16.0
  • luacheck from 1.1.1 to 1.1.2
  • markdown-table-formatter from 1.4.0 to 1.5.0
  • markdownlint from 0.37.0 to 0.38.0
  • mypy from 1.7.0 to 1.7.1
  • npm-groovy-lint from 12.1.0 to 13.0.2
  • phpcs from 3.7.2 to 3.8.0
  • phplint from 9.0.4 to 9.0.6
  • phpstan from 1.10.42 to 1.10.48
  • psalm from Psalm.5.15.0@ to Psalm.5.17.0@
  • puppet-lint from 4.2.1 to 4.2.3
  • pyright from 1.1.336 to 1.1.339
  • roslynator from 0.8.0.0 to 0.8.1.0
  • rubocop from 1.57.2 to 1.58.0
  • ruff from 0.1.6 to 0.1.7
  • secretlint from 7.1.0 to 8.0.0
  • semgrep from 1.50.0 to 1.52.0
  • sfdx-scanner-apex from 3.18.0 to 3.19.0
  • sfdx-scanner-aura from 3.18.0 to 3.19.0
  • sfdx-scanner-lwc from 3.18.0 to 3.19.0
  • syft from 0.97.1 to 0.98.0
  • terraform-fmt from 1.6.4 to 1.6.5
  • terragrunt from 0.53.4 to 0.54.0
  • trivy from 0.47.0 to 0.48.0
  • trufflehog from 3.63.0 to 3.63.2
  • vale from 2.29.7 to 2.30.0

MegaLinter will be presented at DevCon20, in Paris on 14 december (french)

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v7.6.0...v7.7.0

What's Changed

• Major enhancements

  • New flavor c_cpp: New flavor for pure C/C++ projects, by @daltonv in https://github.com/oxsecurity/megalinter/pull/3067
  • New flavor formatters: Contains only formatter linters, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3071
  • Add Salesforce Lightning Flow Scanner, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3092

• Core

  • Allow to use value any to always activate a linter who as a _DIRECTORY variable. Example: KUBERNETES_DIRECTORY: any, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3058
  • Update base Docker image to python:3.11.6-alpine3.18

• Fixes

  • Fix issue Gitleaks --no-git does not work anymore, #2945, in #3112
  • Fix way to install powershell on Alpine linux image
  • Fix issue with VS Code devcontainer not building #3114
  • Fix Default Workflow to handle latest ActionLint rules, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3130
  • Write checkov SARIF report results_sarif.sarif in REPORT_FOLDER, by @gmeligio in https://github.com/oxsecurity/megalinter/pull/3121
  • Updated lintr config template to use linters_with_defaults() (formerly with_defaults())
  • Fix csharp installation dependencies, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3075
  • Fix powershell installation by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3126

• Doc

  • Update lintr links to their current locations, by @echoix in #3122
  • Update Pylint links to their current locations, by @echoix in #3116
  • Add R2DevOps way to setup MegaLinter on Gitlab, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3129

• CI

  • Upgrade pymdown-extensions and markdown, by @BryanQuigley in #3053
  • Use docker/metadata-action for some internal CI, by @echoix in #3110
  • Call docker buildx prune instead of docker builder prune, by @echoix in #3127
  • Set schedule earlier for auto-update-linters.yml, allow manual runs, by @echoix in https://github.com/oxsecurity/megalinter/pull/3066
  • Add mike to dev/requirements.txt, by @echoix in https://github.com/oxsecurity/megalinter/pull/3070
  • Modernize dependabot.yml in correct directories, by @echoix in https://github.com/oxsecurity/megalinter/pull/3093
  • Fix devcontainer Dockerfile typo (fixes #3114) by @daltonv in https://github.com/oxsecurity/megalinter/pull/3115

• Linter versions upgrades

  • ansible-lint from 6.21.1 to 6.22.0
  • bicep_linter from 0.22.6 to 0.23.1
  • black from 23.10.1 to 23.11.0
  • cfn-lint from 0.83.0 to 0.83.3
  • checkov from 3.0.12 to 3.0.39
  • checkstyle from 10.12.4 to 10.12.5
  • clippy from 0.1.73 to 0.1.74
  • csharpier from 0.25.0 to 0.26.2
  • cspell from 7.3.8 to 8.0.0
  • dotnet-format from 6.0.416 to 6.0.417
  • eslint from 8.52.0 to 8.54.0
  • golangci-lint from 1.55.1 to 1.55.2
  • kics from 1.7.10 to 1.7.11
  • kubeconform from 0.6.3 to 0.6.4
  • mypy from 1.6.1 to 1.7.0
  • npm-groovy-lint from 11.1.1 to 12.1.0
  • npm-package-json-lint from 7.0.0 to 7.1.0
  • phpstan from 1.10.39 to 1.10.42
  • powershell from 7.3.9 to 7.4.0
  • powershell_formatter from 7.3.9 to 7.4.0
  • prettier from 3.0.3 to 3.1.0
  • protolint from 0.46.2 to 0.46.3
  • pyright from 1.1.333 to 1.1.336
  • ruff from 0.1.3 to 0.1.6
  • secretlint from 7.0.7 to 7.1.0
  • semgrep from 1.46.0 to 1.50.0
  • sfdx-scanner-apex from 3.17.0 to 3.18.0
  • sfdx-scanner-aura from 3.17.0 to 3.18.0
  • sfdx-scanner-lwc from 3.17.0 to 3.18.0
  • swiftlint from 0.53.0 to 0.54.0
  • syft from 0.94.0 to 0.97.1
  • terraform-fmt from 1.6.2 to 1.6.4
  • terragrunt from 0.53.0 to 0.53.4
  • tflint from 0.48.0 to 0.49.0
  • trivy-sbom from 0.46.1 to 0.47.0
  • trivy from 0.46.1 to 0.47.0
  • trufflehog from 3.61.0 to 3.63.0
  • vale from 2.29.5 to 2.29.7
  • xmllint from 21104 to 21106
  • yamllint from 1.32.0 to 1.33.0

New Contributors

• @BryanQuigley made their first contribution in https://github.com/oxsecurity/megalinter/pull/3053
• @daltonv made their first contribution in https://github.com/oxsecurity/megalinter/pull/3067
• @VictorRos made their first contribution in https://github.com/oxsecurity/megalinter/pull/3112
• @gmeligio made their first contribution in https://github.com/oxsecurity/megalinter/pull/3121

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v7...v7.6.0

What's Changed

• Core

  • mega-linter-runner: Convert to ES6 and upgrade npm dependencies. Node 18 minimum version is now required. by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2976
  • Allow to define COMPILER_ONLY virtual package as cargo dependency in descriptors to embed rust compiler in the Dockerfile
  • Optimize @generated marker scanning (#2654) by @sanmai-NL in https://github.com/oxsecurity/megalinter/pull/2654

• Media

  • Achieve Code Consistency: MegaLinter Integration in Azure DevOps, by Don Koning on Microsoft Tech Community

• Fixes

  • build.py: Remove exclusivity between pip, gem & cargo packages
  • Salesforce linters: Switch sfdx-cli to @salesforce/cli
  • Fixed issue with actionlint throwing an error on if statements in the generated workflow file
  • Added default .devskim.json to mitigate errors introduced when no config exists (closes #3017) by @andrewvaughan in https://github.com/oxsecurity/megalinter/pull/3024
  • Fix: Removed curly-brackets from if (closes #3025) by @andrewvaughan in https://github.com/oxsecurity/megalinter/pull/3029

• Doc

  • Display list of articles from newest to oldest
  • Fix incorrect environment variable in djlint docs by @adhil0 in https://github.com/oxsecurity/megalinter/pull/2993
  • Improve lychee documentation to add an example of .lycheeignore by @nvuillam in https://github.com/oxsecurity/megalinter/pull/3003

• CI

  • Add the other maintainers globally to the CODEOWNERS file (#3008)
  • Free disk space earlier in the process to avoid failure during docker build
  • Set flavors-stats.json as a generated file in .gitattributes (#3023)
  • Update and fix our ChatOps automations to only run on pull request comments, by @echoix in #3034
  • Use App::cpm to install perlcritic faster, and clean .perl-cpm cache, by @echoix in #3036
  • Add failure message in ChatOps build-command and Slash dispatcher, by @echoix in #3037
  • TEMPLATES/mega-linter.yml: DRY the ifs by @rasa in https://github.com/oxsecurity/megalinter/pull/2957

• Linter versions upgrades

  • ansible-lint from 6.20.0 6.21.1
  • bicep_linter from 0.21.1 to 0.22.6
  • black from 23.9.1 to 23.10.1
  • cfn-lint from 0.80.2 to 0.83.0
  • checkov from 2.4.48 to 3.0.12
  • checkstyle from 10.12.3 to 10.12.4
  • clippy from 0.1.72 to 0.1.73
  • clj-kondo from 2023.09.07 to 2023.10.20
  • cspell from 7.3.6 to 7.3.8
  • devskim from 1.0.22 to 1.0.23
  • dotnet-format from 6.0.414 to 6.0.416
  • editorconfig-checker from 2.7.1 to 2.7.2
  • eslint-plugin-jsonc from 2.9.0 to 2.10.0
  • eslint from 8.49.0 to 8.52.0
  • golangci-lint from 1.54.2 to 1.55.1
  • kics from 1.7.8 to 1.7.10
  • ktlint from 1.0.0 to 1.0.1
  • mypy from 1.5.1 to 1.6.1
  • perlcritic from 1.150 to 1.152
  • phpstan from 1.10.35 to 1.10.39
  • powershell from 7.3.7 to 7.3.9
  • powershell_formatter from 7.3.7 to 7.3.9
  • protolint from 0.46.0 to 0.46.2
  • puppet-lint from 4.2.0 to 4.2.1
  • pylint from 2.17.5 to 3.0.2
  • pyright from 1.1.327 to 1.1.333
  • rubocop from 1.56.3 to 1.57.2
  • ruff from 0.1.2 to 0.1.3
  • ruff from 0.0.290 to 0.1.2
  • semgrep from 1.41.0 to 1.46.0
  • sfdx-scanner-apex from 3.16.0 to 3.17.0
  • sfdx-scanner-aura from 3.16.0 to 3.17.0
  • sfdx-scanner-lwc from 3.16.0 to 3.17.0
  • snakefmt from 0.8.4 to 0.8.5
  • sqlfluff from 2.3.2 to 2.3.5
  • stylelint from 15.10.3 to 15.11.0
  • swiftlint from 0.52.4 to 0.53.0
  • syft from 0.91.0 to 0.94.0
  • terraform-fmt from 1.5.7 to 1.6.2
  • terragrunt from 0.51.4 to 0.53.0
  • trivy-sbom from 0.45.1 to 0.46.1
  • trivy from 0.45.1 to 0.46.1
  • trufflehog from 3.56.1 to 3.61.0
  • v8r from 2.0.0 to 2.1.0
  • vale from 2.29.0 to 2.29.5

New Contributors

• @adhil0 made their first contribution in https://github.com/oxsecurity/megalinter/pull/2993
• @sanmai-NL made their first contribution in https://github.com/oxsecurity/megalinter/pull/2654

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v7.4.0...v7.5.0

What's Changed

• Core

  • Upgrade base image to to alpine 3.18 by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2903
  • Upgrade python to 3.11.5 by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2930

• Media

  • Maximize your code consistency with Megalinter by Tor Ivar Asbølmo on codewithme.cloud
  • MegaLinter in Azure DevOps by James Cook

• Fixes

  • Fix IGNORE_GITIGNORED_FILES not working anymore , by @iisisrael in https://github.com/oxsecurity/megalinter/pull/2967
  • Fix v7 issue when using MEGALINTER_FILES_TO_LINT (thanks @pfiaux !) by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2917
  • Fix Ignore symlink files when VALIDATE_ALL_CODEBASE is false by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2964
  • Fix rstcheck options & install by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2899
  • Undowngrade Kubescape by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2901

• Doc

  • Secretlint logo - reduce size to 150 and remove background by @itayox in https://github.com/oxsecurity/megalinter/pull/2880
  • Replace https://megalinter.io/flavors with https://megalinter.io/latest/flavors to avoid lychee 404 error by @ashokm in https://github.com/oxsecurity/megalinter/pull/2910
  • docs: config-cli-lint-mode.md: Grammar tweaks by @rasa in https://github.com/oxsecurity/megalinter/pull/2953

• CI

  • Reformatted config files to not fail common linters (closes #2890) by @andrewvaughan in https://github.com/oxsecurity/megalinter/pull/2891
  • Workflow job name changed from build to megalinter to prevent conflicts with other workflows
  • Add support for master branch in TEMPLATES/mega-linter.yml by @rasa in https://github.com/oxsecurity/megalinter/pull/2888
  • Upgrade editorconfig-checker & setup-node by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2898

• Deprecations

  • Deprecate SCSS LINT as not maintained anymore (https://github.com/sds/scss-lint#notice-consider-other-tools-before-adopting-scss-lint) by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2902

• Linter versions upgrades

  • actionlint from 1.6.25 to 1.6.26
  • ansible-lint from 6.17.2 to 6.20.0
  • bicep_linter from 0.20.4 to 0.21.1
  • black from 23.7.0 to 23.9.1
  • cfn-lint from 0.79.6 to 0.80.2
  • checkov from 2.3.360 to 2.4.10
  • checkstyle from 10.12.2 to 10.12.3
  • chktex from 1.7.6 to 1.7.8
  • clippy from 0.1.71 to 0.1.72
  • clj-kondo from 2023.07.13 to 2023.09.07
  • cspell from 6.31.3 to 7.3.6
  • devskim from 1.0.18 to 1.0.22
  • djlint from 1.32.1 to 1.34.0
  • dotnet-format from 6.0.413 to 6.0.414
  • editorconfig-checker from 2.7.0 to 2.7.1
  • eslint from 8.46.0 to 8.49.0
  • git_diff from 2.38.5 to 2.40.1
  • gitleaks from 8.17.0 to 8.18.0
  • golangci-lint from 1.54.0 to 1.54.2
  • helm from 3.10.2 to 3.11.3
  • jscpd from 3.5.9 to 3.5.10
  • kics from 1.7.5 to 1.7.8
  • ktlint from 0.50.0 to 1.0.0
  • kubescape from 2.3.6 to 2.9.0
  • markdownlint from 0.35.0 to 0.36.0
  • mypy from 1.4.1 to 1.5.1
  • phpstan from 1.10.28 to 1.10.35
  • powershell from 7.3.6 to 7.3.7
  • powershell_formatter from 7.3.6 to 7.3.7
  • prettier from 3.0.1 to 3.0.3
  • protolint from 0.45.0 to 0.46.0
  • psalm from Psalm.5.14.1@ to Psalm.5.15.0@
  • puppet-lint from 4.0.1 to 4.2.0
  • pyright from 1.1.321 to 1.1.327
  • revive from 1.3.2 to 1.3.4
  • rstcheck from 6.1.2 to 6.2.0
  • rstfmt from 0.0.13 to 0.0.14
  • rubocop from 1.56.0 to 1.56.3
  • ruff from 0.0.284 to 0.0.290
  • scalafix from 0.11.0 to 0.11.1
  • semgrep from 1.34.1 to 1.41.0
  • sfdx-scanner-apex from 3.15.0 to 3.16.0
  • sfdx-scanner-aura from 3.15.0 to 3.16.0
  • sfdx-scanner-lwc from 3.15.0 to 3.16.0
  • snakemake from 7.32.3 to 7.32.4
  • spectral from 6.10.1 to 6.11.0
  • sqlfluff from 2.2.1 to 2.3.2
  • stylelint from 15.10.2 to 15.10.3
  • syft from 0.86.1 to 0.91.0
  • terraform-fmt from 1.5.4 to 1.5.7
  • terragrunt from 0.48.6 to 0.51.3
  • terrascan from 1.18.2 to 1.18.3
  • tflint from 0.47.0 to 0.48.0
  • trivy-sbom from 0.44.0 to 0.45.1
  • trivy from 0.44.0 to 0.45.1
  • trufflehog from 3.47.0 to 3.56.1
  • vale from 2.28.1 to 2.29.0
  • xmllint from 21004 to 21104

New Contributors

• @itayox made their first contribution in https://github.com/oxsecurity/megalinter/pull/2880

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v7.3.0...v7.4.0

What's Changed

• Features

  • Allow to define linter + _COMMAND_REMOVE_ARGUMENTS to remove a command line argument internally added by MegaLinter, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2874

• Media

  • Article: Azure Devops & MegaLinter Auto PR, by @EtienneDeneuve

• Fixes

  • Replace https://megalinter.io/config-file by https://megalinter.io/latest/config-file to avoid lychee 404 detection, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2871
  • Improve docs for posting comments to PRs in GitHub Enterprise
  • Configured Grype to automatically ignore CVE-2018-20225 which is disputed, by @andrewvaughan in https://github.com/oxsecurity/megalinter/pull/2864
  • docs: improve wording for GHE API endpoint, by @mihaigalos in https://github.com/oxsecurity/megalinter/pull/2876
  • Update Azure Installation doc to handle auto-commit, by @EtienneDeneuve in https://github.com/oxsecurity/megalinter/pull/2848

• CodeTotal

  • Redis reporter: Return URL of linter icons when available, in property iconPngUrl
  • Allow to run CodeTotal with a single command npx mega-linter-runner@latest --codetotal , that opens CodeTotal in Web Browser once started, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2877

• Linter versions upgrades

  • bicep_linter from 0.19.5 to 0.20.4
  • cfn-lint from 0.79.2 to 0.79.6
  • checkov from 2.3.343 to 2.3.360
  • checkstyle from 10.12.1 to 10.12.2
  • cspell from 6.31.2 to 6.31.3
  • devskim from 1.0.1 to 1.0.18
  • dotnet-format from 6.0.412 to 6.0.413
  • eslint from 8.45.0 to 8.46.0
  • flake8 from 6.0.0 to 6.1.0
  • golangci-lint from 1.53.3 to 1.54.0
  • kics from 1.7.4 to 1.7.5
  • phpstan from 1.10.26 to 1.10.28
  • prettier from 3.0.0 to 3.0.1
  • psalm from Psalm.5.13.1@ to Psalm.5.14.1@
  • puppet-lint from 4.0.0 to 4.0.1
  • pyright from 1.1.318 to 1.1.321
  • rubocop from 1.55.0 to 1.56.0
  • ruff from 0.0.280 to 0.0.284
  • secretlint from 7.0.3 to 7.0.7
  • semgrep from 1.33.2 to 1.34.1
  • sfdx-scanner-apex from 3.14.0 to 3.15.0
  • sfdx-scanner-aura from 3.14.0 to 3.15.0
  • sfdx-scanner-lwc from 3.14.0 to 3.15.0
  • snakemake from 7.31.0 to 7.32.3
  • spectral from 6.10.0 to 6.10.1
  • sqlfluff from 2.1.4 to 2.2.1
  • syft from 0.85.0 to 0.86.1
  • terraform-fmt from 1.5.3 to 1.5.4
  • terragrunt from 0.48.4 to 0.48.6
  • terrascan from 1.18.1 to 1.18.2
  • trivy-sbom from 0.43.1 to 0.44.0
  • trivy from 0.43.1 to 0.44.0
  • trufflehog from 3.45.1 to 3.47.0

New Contributors

• @andrewvaughan made their first contribution in https://github.com/oxsecurity/megalinter/pull/2864
• @mihaigalos made their first contribution in https://github.com/oxsecurity/megalinter/pull/2876

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v7...v7.3.0

What's Changed

• Fixes

  • Fix TAP reporter (3 real dots instead if 3 dots character), by @nvuillam & @maxilampert in https://github.com/oxsecurity/megalinter/pull/2837
  • Call trufflehog with --only-verified to avoid false positives in .git/config, by @nvuillam , @quotidian-ennui , @iggy & @dochang in https://github.com/oxsecurity/megalinter/pull/2838
    • If you added REPOSITORY_TRUFFLEHOG_ARGUMENTS: "--only-verified" as workaround, just remove it to upgrade to 7.2.1

• Linter versions upgrades

  • cfn-lint from 0.78.2 to 0.79.2
  • checkov from 2.3.340 to 2.3.343
  • pylint from 2.17.4 to 2.17.5
  • rubocop from 1.54.2 to 1.55.0
  • snakemake from 7.30.2 to 7.31.0
  • spectral from 6.8.0 to 6.10.0
  • sqlfluff from 2.1.3 to 2.1.4
  • trufflehog from 3.44.0 to 3.45.1

MegaLinter is graciously provided by

Discover CodeTotal , a new way to use MegaLinter, at BlackHat USA on August 10 !

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v7.2.0...v7.2.1

Discover CodeTotal , a new way to use MegaLinter, at BlackHat USA on August 10 !

What's Changed

• New linters

  • Add Lychee - links and email addresses checker, by @DariuszPorowski in #2673
  • Add grype security linter
  • Add trufflehog security linter

• New flavor dotnetweb: dotnet flavor linters + Javascript & Typescript linters

• Media

  • 8 Tools to Scan Node.js Applications for Security Vulnerability, by Chandan Kumar{target=_blank} on GeekFlare.com
  • Shift Left Just Become Easier (Black Hat Arsenal Session)

• Core

  • MegaLinter Server for CodeTotal
  • Improvements to Gitpod workspace and addition of Makefile for automation, by @ThomasSanson in https://github.com/oxsecurity/megalinter/pull/2737

• Fixes

  • Handle reporter crashes without making all ML crash
  • Devskim: Remove default --ignore-globs argument
  • mypy: Use /tmp as cache folder by default with ENV MYPY_CACHE_DIR=/tmp in Dockerfile
  • Fix hadolint to use its default configuration file properly, by @KihyeokK in https://github.com/oxsecurity/megalinter/pull/2763
  • Remove linters not in flavor before calling reporters
  • Undowngrade devskim, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2748
  • Add ts-standard linter for ts standard, by @janderssonse in https://github.com/oxsecurity/megalinter/pull/2746
  • Remove additional --update for apk in Dockerfile by @PeterDaveHello in https://github.com/oxsecurity/megalinter/pull/2619
  • Fix V8R config arg usage (#2756), by @bdovaz in https://github.com/oxsecurity/megalinter/pull/2819

• Reporters

  • New Redis reporter (beta)

• CI

  • Clean docker build cache to avoid no space left on device during Build Dev job

• Linter versions upgrades

  • actionlint from 1.6.24 to 1.6.25
  • ansible-lint from 6.16.2 to 6.17.2
  • bicep_linter from 0.17.1 to 0.19.5
  • black from 23.3.0 to 23.7.0
  • cfn-lint from 0.77.10 to 0.78.2
  • checkov from 2.3.285 to 2.3.340
  • checkstyle from 10.12.0 to 10.12.1
  • clippy from 0.1.70 to 0.1.71
  • clj-kondo from 2023.05.26 to 2023.07.13
  • csharpier from 0.24.2 to 0.25.0
  • cspell from 6.31.1 to 6.31.2
  • devskim from 0.7.104 to 1.0.11
  • djlint from 1.30.2 to 1.32.1
  • dotnet-format from 6.0.408 to 6.0.412
  • eslint-plugin-jsonc from 2.8.0 to 2.9.0
  • eslint from 8.42.0 to 8.45.0
  • gitleaks from 8.16.4 to 8.17.0
  • golangci-lint from 1.53.2 to 1.53.3
  • grype from 0.63.1 to 0.63.1
  • kics from 1.7.1 to 1.7.4
  • ktlint from 0.49.1 to 0.50.0
  • kubeconform from 0.6.2 to 2.3.6
  • markdownlint from 0.34.0 to 0.35.0
  • mypy from 1.3.0 to 1.4.1
  • npm-package-json-lint from 6.4.0 to 7.0.0
  • phpstan from 1.10.18 to 1.10.26
  • powershell from 7.3.4 to 7.3.6
  • powershell_formatter from 7.3.4 to 7.3.6
  • prettier from 2.8.8 to 3.0.0
  • protolint from 0.44.0 to 0.45.0
  • psalm from Psalm.5.12.0@ to Psalm.5.13.1@
  • pyright from 1.1.313 to 1.1.318
  • rubocop from 1.52.0 to 1.54.2
  • ruff from 0.0.272 to 0.0.280
  • secretlint from 6.2.3 to 7.0.3
  • semgrep from 1.26.0 to 1.33.2
  • sfdx-scanner-apex from 3.13.0 to 3.14.0
  • sfdx-scanner-aura from 3.13.0 to 3.14.0
  • sfdx-scanner-lwc from 3.13.0 to 3.14.0
  • shfmt from 3.6.0 to 3.7.0
  • snakemake from 7.26.0 to 7.30.2
  • sqlfluff from 2.1.1 to 2.1.3
  • stylelint from 15.10.0 to 15.10.0
  • swiftlint from 0.52.2 to 0.52.4
  • syft from 0.83.0 to 0.85.0
  • terraform-fmt from 1.4.6 to 1.5.3
  • terragrunt from 0.46.3 to 0.48.4
  • tflint from 0.46.1 to 0.47.0
  • trivy from 0.42.1 to 0.43.1
  • vale from 2.27.0 to 2.28.1

New Contributors

• @KihyeokK made their first contribution in https://github.com/oxsecurity/megalinter/pull/2763
• @PeterDaveHello made their first contribution in https://github.com/oxsecurity/megalinter/pull/2619

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v7.1.0...v7.2.0

What's Changed

• Core

  • Upgrade base image to python:3.11.4-alpine3.17, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2738

• Linter enhancements & fixes

  • cljstyle: Remove default value for configuration file name, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2717
  • golangci-lint : Add autofix capability using --fix argument, by @seaneagan in https://github.com/oxsecurity/megalinter/pull/2700

• Linter versions upgrades

  • cfn-lint from 0.77.5 to 0.77.7
  • checkov from 2.3.267 to 2.3.285
  • clippy from 0.1.69 to 0.1.70
  • clj-kondo from 2023.05.18 to 2023.05.26
  • djlint from 1.30.0 to 1.30.2
  • eslint from 8.41.0 to 8.42.0
  • gitleaks from 8.16.3 to 8.16.4
  • golangci-lint from 1.52.2 to 1.53.2
  • kubeconform from 0.6.1 to 0.6.2
  • kubescape from 2.3.4 to 2.3.5
  • luacheck from 1.1.0 to 1.1.1
  • markdownlint from 0.33.0 to 0.34.0
  • phpstan from 1.10.15 to 1.10.18
  • pyright from 1.1.311 to 1.1.313
  • rubocop from 1.51.0 to 1.52.0
  • ruff from 0.0.270 to 0.0.272
  • scalafix from 0.10.4 to 0.11.0
  • semgrep from 1.24.0 to 1.26.0
  • sfdx-scanner-apex from 3.12.0 to 3.13.0
  • sfdx-scanner-aura from 3.12.0 to 3.13.0
  • sfdx-scanner-lwc from 3.12.0 to 3.13.0
  • stylelint from 15.6.2 to 15.7.0
  • syft from 0.82.0 to 0.83.0
  • terragrunt from 0.45.17 to 0.46.3
  • trivy from 0.41.0 to 0.42.1

New Contributors

• @seaneagan made their first contribution in https://github.com/oxsecurity/megalinter/pull/2700

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v7.0.4...v7.1.0

What's Changed

• Core

  • Allow to define linterkey_UNSECURED_ENV_VARIABLES for specific linters to make them visible when necessary (ex: GITHUB_TOKEN for TERRAFORM_TFLINT) by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2703

• Documentation

  • Add note to terraform_tflint about TERRAFORM_TFLINT_UNSECURED_ENV_VARIABLES by @ruzickap in https://github.com/oxsecurity/megalinter/pull/2706

• Linter versions upgrades

  • checkov from 2.3.261 to 2.3.267
  • djlint from 1.29.0 to 1.30.0
  • pyright from 1.1.310 to 1.1.311
  • semgrep from 1.23.0 to 1.24.0
  • standard from 17.0.0 to 17.1.0
  • terragrunt from 0.45.16 to 0.45.17

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v7.0.3...v7.0.4

What's Changed

• Linter enhancements & fixes

  • New variable TERRAFORM_TFLINT_SECURED_ENV with default value true. Set to false to allow tflint --init to access your env vars.

• Core

  • Secure PRE_COMMANDS and POST_COMMANDS by default
  • Can be disabled with secured_env: false in the command definition
  • Manage v6 retrocompatibility with FILTER_REGEX_INCLUDE and FILTER_REGEX_EXCLUDE expression

• Linter versions upgrades

  • checkov from 2.3.259 to 2.3.261
  • checkstyle from 10.11.0 to 10.12.0
  • kubescape from 2.3.3 to 2.3.4

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v7.0.2...v7.0.3

What's Changed

To upgrade to MegaLinter v7, run npx mega-linter-runner@latest --upgrade , comment here if you have any issue :)

• MAJOR Updates

  • SECURED_ENV_VARIABLES & core scoped configuration by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2601
    • New configuration variables SECURED_ENV_VARIABLES and SECURED_ENV_VARIABLES_DEFAULT to hide your environment sensitive variables to the linters called by MegaLinter
    • Read documentation to enhance security using MegaLinter
  • Use relative file paths to call linters by @nvuillam in https://github.com/oxsecurity/megalinter/pull/1877
    • This can be a breaking change for customizations, post an issue if you see a problem !

• New linters

  • Add linter cljstyle, Clojure formatter, by @practicalli-john in https://github.com/oxsecurity/megalinter/pull/2115
  • Add kubescape, kubernetes linter, by @muandane in https://github.com/oxsecurity/megalinter/pull/2531
  • Add Vale, a powerful enforcer of writing style, by @wesley-dean-flexion in https://github.com/oxsecurity/megalinter/pull/2406

• Removed linters

  • KUBERNETES_KUBEVAL: Not maintained anymore (kubeconform recommended by the authors)
  • REPOSITORY_GOODCHECK: Not open-source anymore
  • SPELL_MISSPELL: Not maintained anymore (last commit in 2018)
  • TERRAFORM_CHECKOV: Replaced by REPOSITORY_CHECKOV
  • TERRAFORM_KICS: Replaced by REPOSITORY_KICS

• Medias

  • Article: Use the Workflows JSON schema in your IDE, by Google Cloud
  • Video: Ortelius Architecture Meeting, with a review of MegaLinter, by Steve Taylor from Ortelius
  • Web site: my-devops-lab.com

• Linter enhancements & fixes

  • cspell
    • Fix corrective .cspell.json file generated from cspell output by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2562
  • eslint
    • Ensure ESLint actually runs in project mode (#1572) by @Kurt-von-Laven in https://github.com/oxsecurity/megalinter/pull/2455
  • jscpd
    • Prevent jscpd to create output folder if the repo is not writable by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2556
  • Gitleaks
    • Add support to scan PR commits only on PRs when VALIDATE_ALL_CODEBASE is set to false, by @DariuszPorowski #2504
  • KICS
    • Move KICS to REPOSITORY descriptor, so it can analyze all types of files, not terraform only, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2689
    • KICS can now output SARIF
    • The new version can have performance issues: customize of disable REPOSITORY_KICS if necessary
  • KubeConform
    • Simplify kubeconform install & get version by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2629
  • PHPLint
    • Upgrade PHPLint to v9 by @bdovaz in https://github.com/oxsecurity/megalinter/pull/2638
  • sqlfluff
    • Remove old options from SQLFluff config file by @tunetheweb in https://github.com/oxsecurity/megalinter/pull/2560
  • v8r
    • Allow use of configuration files with v8r by @bdovaz in https://github.com/oxsecurity/megalinter/pull/1982

• Core

  • Upgrade base Docker image to python:3.11.3-alpine3.17 by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2537
  • Allow simultaneous regex filtering at descriptor and linter levels by @nvuillam & @seaneagan in https://github.com/oxsecurity/megalinter/pull/2669
  • Allow MEGALINTER_CONFIG to contain a full path to a MegaLinter config file by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2649
  • Fix issue preventing plugins to work with flavors by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2532
  • Fix crash in case of unreachable symlinks by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2538
  • mega-linter-runner: Use --platform also for docker run by @nvuillam , @Kurt-Von-Laven & @cam-barts in https://github.com/oxsecurity/megalinter/pull/2690
  • Replace deprecated distutils.copy_tree by shutil.copytree

• Reporters

  • SARIF_REPORTER
    • Add option to skip def_ws prefix in sarif reports by @janderssonse in https://github.com/oxsecurity/megalinter/pull/2383
    • update schema to pass official SARIF validator by @DariuszPorowski in https://github.com/oxsecurity/megalinter/pull/2645
  • CONFIG_REPORTER
    • Add support for idea plugins auto-install by @waterfoul in https://github.com/oxsecurity/megalinter/pull/2553
  • CONSOLE_REPORTER
    • Updated cases in console/log output to use ⚠ Warning Sign (U+26A0) instead of ◬ White Up-Pointing Triangle with Dot (U+25EC), by @Doommius
  • GITLAB_COMMENT_REPORTER
    • Enhancement & fixes for GitlabCommentReporter by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2564
      • New var GITLAB_COMMENT_REPORTER_OVERWRITE_COMMENT to allow to disable the overwrite of existing MegaLinter comment in case of new run
      • In case of overwrite activated (by default), fetch all Merge Request comments, not the first 20.
      • Display a different message in log when a Merge Request comment is created or updated.
  • AZURE_COMMENT_REPORTER
    • Downgrade Azure DevOps pipy package to avoid crash by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2576

• Documentation

  • Improve documentation pages split by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2688
    • Now Installation and Configuration menus have their own child menus
  • Doc about how to use fine grained PAT by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2662
  • Fixed incorrect link in Azure to Gitlab reporters pages. by @Doommius in https://github.com/oxsecurity/megalinter/pull/2613
  • Added bitbucket job template + Fix icon in console logs by @Doommius in https://github.com/oxsecurity/megalinter/pull/2617
  • Exclude licenses pages from online search results by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2665
  • Improve HTML tables display by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2670
  • Remove ASCII characters from linters helps displayed in MegaLinter documentation

• Internal CI

  • Upgrade GitHub Actions to change automated comments and increase timeout by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2536
  • Use Github Permissions instead of PAT by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2652
  • Update GitHub Actions workflows environments by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2657
  • Automate External Plugins table generation using .automation/plugins.yml file by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2667
  • Fix MegaLinter build issue by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2539
  • Fix for trivy-action (new naming for input) by @DariuszPorowski in https://github.com/oxsecurity/megalinter/pull/2541
  • Fix /build slash command to checkout the correct PR branch by @echoix in https://github.com/oxsecurity/megalinter/pull/2542
  • Fix local run of python test cases by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2565
  • Fix mkdocs documentation generation by downgrading mkdocs-glightbox to 0.3.2 by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2582
  • Do not push to docker from dev PRs by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2639
  • Update stale workflow: remove trigger on comments and explicit permissions by @echoix in https://github.com/oxsecurity/megalinter/pull/2641
  • Decouple updating docker pull stats from building docs by @echoix in https://github.com/oxsecurity/megalinter/pull/2677
  • Review MegaLinter's own cspell word list for outdated exclusions by @echoix in https://github.com/oxsecurity/megalinter/pull/2676
  • Run stale workflow only on schedule, by @echoix in https://github.com/oxsecurity/megalinter/pull/2641
  • Add explicit permissions to stale workflow, by @echoix in https://github.com/oxsecurity/megalinter/pull/2641

• Linter versions upgrades

  • actionlint from 1.6.23 to 1.6.24
  • ansible-lint from 6.14.4 to 6.16.2
  • bicep_linter from 0.15.31 to 0.17.1
  • cfn-lint from 0.76.1 to 0.77.5
  • checkov from 2.3.149 to 2.3.259
  • checkstyle from 10.9.3 to 10.11.0
  • clippy from 0.1.68 to 0.1.69
  • clj-kondo from 2023.03.17 to 2023.05.18
  • csharpier from 0.23.0 to 0.24.2
  • djlint from 1.19.16 to 1.29.0
  • dotnet-format from 6.0.407 to 6.0.408
  • eslint-plugin-jsonc from 2.7.0 to 2.8.0
  • eslint from 8.37.0 to 8.41.0
  • git_diff from 2.38.4 to 2.38.5
  • gitleaks from 8.16.1 to 8.16.3
  • jscpd from 3.5.4 to 3.5.9
  • jsonlint from 14.0.2 to 14.0.3
  • kics from 1.6.13 to 1.7.1
  • ktlint from 0.48.2 to 0.49.1
  • kubeconform from 0.5.0 to 0.6.1
  • kubescape from 2.3.1 to 2.3.3
  • markdown-link-check from 3.10.3 to 3.11.2
  • mypy from 1.1.1 to 1.3.0
  • phplint from 5.5 to 9.0.4
  • phpstan from 1.10.10 to 1.10.15
  • pmd from 6.48.0 to 6.55.0
  • powershell from 7.3.3 to 7.3.4
  • powershell_formatter from 7.3.3 to 7.3.4
  • prettier from 2.8.7 to 2.8.8
  • protolint from 0.43.1 to 0.44.0
  • psalm from Psalm.5.9.0@ to Psalm.5.12.0@
  • puppet-lint from 3.3.0 to 4.0.0
  • pylint from 2.17.2 to 2.17.4
  • pyright from 1.1.301 to 1.1.310
  • revive from 1.3.1 to 1.3.2
  • rubocop from 1.49.0 to 1.51.0
  • ruff from 0.0.260 to 0.0.270
  • semgrep from 1.16.0 to 1.23.0
  • sfdx-scanner-apex from 3.11.0 to 3.12.0
  • sfdx-scanner-aura from 3.11.0 to 3.12.0
  • sfdx-scanner-lwc from 3.11.0 to 3.12.0
  • snakefmt from 0.8.3 to 0.8.4
  • snakemake from 7.25.0 to 7.26.0
  • spectral from 6.6.0 to 6.8.0
  • sqlfluff from 2.0.2 to 2.1.1
  • stylelint from 15.4.0 to 15.6.2
  • swiftlint from 0.51.0 to 0.52.2
  • syft from 0.76.0 to 0.82.0
  • terraform-fmt from 1.4.4 to 1.4.6
  • terragrunt from 0.45.0 to 0.45.11
  • terrascan from 1.18.0 to 1.18.1
  • tflint from 0.45.0 to 0.46.1
  • trivy from 0.39.0 to 0.41.0
  • v8r from 1.0.0 to 2.0.0
  • vale from 2.24.0 to 2.27.0
  • xmllint from 21003 to 21004
  • yamllint from 1.30.0 to 1.32.0

New Contributors

• @waterfoul made their first contribution in https://github.com/oxsecurity/megalinter/pull/2553
• @Doommius made their first contribution in https://github.com/oxsecurity/megalinter/pull/2613
• @muandane made their first contribution in https://github.com/oxsecurity/megalinter/pull/2531

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v6.22.2...v7.0.2

What's Changed

• Fixes

  • Fix failure of AzureCommentReporter when there is no pull request found in ENV vars, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2515
  • Fix HTML comment appearing in Azure Pull Request mail notifications, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2521

• Linter versions upgrades

  • ansible-lint from 6.14.3 to 6.14.4
  • checkov from 2.3.145 to 2.3.149
  • pylint from 2.17.1 to 2.17.2
  • rubocop from 1.48.1 to 1.49.0

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v6.22.1...v6.22.2