megalinter

What's Changed

• Core

  • Changed vars in AzureCommentReporter to reflects official Azure DevOps naming convention + fallback to keep backward compatibility, see #2509, by @DariuszPorowski in https://github.com/oxsecurity/megalinter/pull/2510
  • Update AzureCommentReporter to have only one MegaLinter thread instead of a new one for each run of MegaLinter, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2512
  • Fix build issue by retrying curl if failed by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2507

• Documentation

  • Updated usage scenario for Azure DevOps, see #2509, by @DariuszPorowski in https://github.com/oxsecurity/megalinter/pull/2510

• Linter versions upgrades

  • checkov from 2.3.141 to 2.3.145
  • phpstan from 1.10.9 to 1.10.10
  • rstfmt from 0.0.12 to 0.0.13

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v6.22.0...v6.22.1

What's Changed

• New linters

  • Add ruff, by @lars-reimann in https://github.com/oxsecurity/megalinter/pull/2458

• Linter enhancements & fixes

  • Pin markdown-link-check to 3.10.3 until tcort/markdown-link-check#246 is fixed, by @Kurt-von-Laven (#2498).

• Core

  • Fix MegaLinter doc version & url displayed in logs, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2485

  • Use megalinter-bot to create apply fixes commits, by @lars-reimann, @nvuillam and @megalinter-bot :)

    • If you are an existing user of MegaLinter, you must update your github actions workflows to add the following parameters to stefanzweifel/git-auto-commit-action@v4 :

    commit_user_name: megalinter-bot
    commit_user_email: [email protected]
    

    • You can also use any github username and email you like :)

• Documentation

  • Close parentheses in ci_light flavour doc by @moverperfect in https://github.com/oxsecurity/megalinter/pull/2494

• Linter versions upgrades

  • black from 23.1.0 to 23.3.0
  • cfn-lint from 0.75.1 to 0.76.1
  • checkov from 2.3.120 to 2.3.141
  • eslint from 8.36.0 to 8.37.0
  • kics from 1.6.12 to 1.6.13
  • markdown-link-check from 3.11.0 to 3.10.3
  • phpstan from 1.10.8 to 1.10.9
  • psalm from Psalm.5.8.0@ to Psalm.5.9.0@
  • pyright from 1.1.300 to 1.1.301
  • ruff from 0.0.255 to 0.0.260
  • semgrep from 1.15.0 to 1.16.0
  • sfdx-scanner-apex from 3.10.0 to 3.11.0
  • sfdx-scanner-aura from 3.10.0 to 3.11.0
  • sfdx-scanner-lwc from 3.10.0 to 3.11.0
  • stylelint from 15.3.0 to 15.4.0
  • swiftlint from 0.50.3 to 0.51.0
  • syft from 0.75.0 to 0.76.0
  • terraform-fmt from 1.4.2 to 1.4.4
  • trivy from 0.38.3 to 0.39.0

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v6.21.0...v6.22.0

What's Changed

• New linters
  • Add helm lint, by @ThomasSanson in https://github.com/oxsecurity/megalinter/pull/2386

• Medias
  • Video: Code quality - Ep01 - MegaLinter, one linter to rule them all, by @devpro
  • Video: DevSecOps Webinar using MegaLinter, by 5.15 Technologies
  • Video: (FR) Coding Tech - L'importance de la CI/CD dans le développement de logiciels, by @GridexX from R2DevOps
  • Article: (FR) MegaLinter, votre meilleur ami pour un code de qualité, by @ThomasSanson

• Linter enhancements & fixes

  • phpcs: Add regex in descriptor to be able to extract the number of found errors, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2453
  • Replace babel-eslint with @babel/eslint-parser, by @bdovaz in https://github.com/oxsecurity/megalinter/pull/2445
  • Use docker image to install phpstan, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2469
  • Avoid cspell error on readonly workspaces, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2474
  • Allow bandit to use pyproject.toml, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2475
  • Bring back stylelint-config-sass-guidelines package, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2477
  • Display only errors in markdown-link-check logs for better readability, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2479

• Core

  • Run CI linter jobs only on Pull requests to avoid doubling jobs

• Documentation

  • mega-linter-runner: doc fix for env list of values, see #2448, by @DariuszPorowski in https://github.com/oxsecurity/megalinter/pull/2449

• Linter versions upgrades

  • ansible-lint from 6.14.1 to 6.14.3
  • bandit from 1.7.4 to 1.7.5
  • cfn-lint from 0.74.1 to 0.75.1
  • checkov from 2.3.70 to 2.3.120
  • checkstyle from 10.8.0 to 10.9.3
  • clippy from 0.1.67 to 0.1.68
  • clj-kondo from 2023.02.17 to 2023.03.17
  • cspell from 6.28.0 to 6.31.1
  • dotnet-format from 6.0.406 to 6.0.407
  • eslint-plugin-jsonc from 2.6.0 to 2.7.0
  • eslint from 8.35.0 to 8.36.0
  • gitleaks from 8.16.0 to 8.16.1
  • jscpd from 3.5.3 to 3.5.4
  • jsonlint from 14.0.1 to 14.0.2
  • kics from 1.6.11 to 1.6.12
  • markdown-link-check from 3.10.3 to 3.11.0
  • phpstan from 1.10.5 to 1.10.8
  • prettier from 2.8.4 to 2.8.7
  • psalm from Psalm.5.7.7@ to Psalm.5.8.0@
  • pylint from 2.16.4 to 2.17.1
  • pyright from 1.1.296 to 1.1.300
  • revive from 1.2.5 to 1.3.1
  • rstcheck from 6.1.1 to 6.1.2
  • rubocop from 1.48.0 to 1.48.1
  • semgrep from 1.14.0 to 1.15.0
  • snakefmt from 0.8.1 to 0.8.3
  • snakemake from 7.24.0 to 7.25.0
  • sqlfluff from 1.4.5 to 2.0.2
  • stylelint from 15.2.0 to 15.3.0
  • syft from 0.74.0 to 0.75.0
  • terraform-fmt from 1.3.9 to 1.4.2
  • terragrunt from 0.44.4 to 0.45.0
  • trivy from 0.38.1 to 0.38.3
  • v8r from 0.14.0 to 1.0.0
  • yamllint from 1.29.0 to 1.30.0

New Contributors

• @ThomasSanson made their first contribution in https://github.com/oxsecurity/megalinter/pull/2386
• @DariuszPorowski made their first contribution in https://github.com/oxsecurity/megalinter/pull/2449

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v6.20.1...v6.21.0

What's Changed

• Fixes

  • Fix issue with running on Mac m1 no longer working, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2430
  • Fix Container images errors when pulling, by @echoix in https://github.com/oxsecurity/megalinter/pull/2435
  • Fix Pre npm install not resolving, by @echoix in https://github.com/oxsecurity/megalinter/pull/2435
  • Add build date in Beta docker images, by @nvuillam
  • Correct misleading error message in GitlabCommentReporter.py, see #2420
  • Fix GitlabCommentReporter wrong variables names, check #2423

• Core

  • Improve config test, by @bdovaz in https://github.com/oxsecurity/megalinter/pull/2426

• Doc

  • Add article Level up your Unity Packages with CI/CD, by @RunningMattress in https://github.com/oxsecurity/megalinter/pull/2436
  • Correct minor docs error by @moverperfect in https://github.com/oxsecurity/megalinter/pull/2440

• Linter versions upgrades

  • ansible-lint from 6.14.0 to 6.14.1
  • bicep_linter from 0.14.85 to 0.15.31
  • cfn-lint from 0.74.0 to 0.74.1
  • checkov from 2.3.59 to 2.3.70
  • csharpier from 0.22.1 to 0.23.0
  • jsonlint from 13.0.1 to 14.0.1
  • mypy from 1.0.1 to 1.1.1
  • phpstan from 1.10.3 to 1.10.5 on 2023-03-07
  • protolint from 0.43.0 to 0.43.1
  • puppet-lint from 3.2.0 to 3.3.0
  • pylint from 2.16.3 to 2.16.4
  • rubocop from 1.47.0 to 1.48.0
  • stylelint from 14.16.1 to 15.2.0

New Contributors

• @LBeaulaton made their first contribution in https://github.com/oxsecurity/megalinter/pull/2424
• @moverperfect made their first contribution in https://github.com/oxsecurity/megalinter/pull/2440

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v6.20.0...v6.20.1

Release notes

• Core

  • Upgrade base docker image from python:3.10.4-alpine3.16 to python:3.11.1-alpine3.17 in #2312
  • Upgrade base docker image from python:3.11.1-alpine3.17 to python:3.12.1-alpine3.17, by @bdovaz in #2354
  • Update editorconfig-checker to 2.7.0, by @rasa in #2349
  • Build: remove folder contents before generating Dockerfile files for each linter in generate_linter_dockerfiles(), by @bdovaz in #2294
  • Build: remove folder contents before generating test classes for each linter in generate_linter_test_classes(), by @bdovaz in #2294
  • Build: automatically update the linter list used in the matrix of several of the workflows, by @bdovaz in #2294
  • Test: create a testing architecture for format/autofix linters, by @bdovaz in #2294
  • Test: create or adapt input files for format/autofix tests, by @bdovaz in #2294
  • Test: created specific test folders for linters that need them because they cannot share them, by @bdovaz in #2294
  • Added rubocop-rake RubyGem for linting Rake files with RuboCop, by @timgentry in #2366

• Fixes

  • Correctly generate class names and test class files for each linter when the linter descriptor defines the attribute "name", by @bdovaz in #2294
  • Removed the default powershell templates TEMPLATES/.powershell-formatter.psd1 and TEMPLATES/.powershell-psscriptanalyzer.psd1. Having these templates caused all rules to be ignored as the settings are not incremental but absolute, by @bdovaz in #2294
  • Added cli_lint_fix_arg_name parameter to dotnet format descriptor as without it, autofix does not work, by @bdovaz in #2294
  • Created BicepLinter class to add DOTNET_SYSTEM_GLOBALIZATION_INVARIANT environment variable to avoid problems with ICU packages, by @bdovaz in #2294
  • Modified npm-groovy-lint descriptor to add --failon parameter to only fail with error and not info which is the default value, by @bdovaz in #2294
  • Added cli_lint_fix_arg_name parameter to powershell formatter descriptor as without it, autofix does not work, by @bdovaz in #2294
  • Created ProtolintLinter class to fix the problem that returns exit code 1 when it encounters a problem to correct even though it corrects it correctly, by @bdovaz in #2294
  • Concatenate --output parameter correctly to xmllint linter, by @bdovaz in #2294
  • Modified the .pre-commit-hooks.yaml for megalinter-full so the containername argument is correctly split between two lines, by @drbothen #2411
  • Avoid jscpd default config to detect copy pastes in image files in #2407.
  • Move utilstest to megalinter folder to avoid import issues in #2417.
  • Replace deprecated spectral package, by @bdovaz in by @bdovaz in https://github.com/oxsecurity/megalinter/pull/2340
  • Generate correct urls for packages with fixed versions, by @bdovaz in https://github.com/oxsecurity/megalinter/pull/2339

• Documentation

  • Change swiftlint example that did not correctly reflect the --fix parameter, by @bdovaz in #2294
  • Change in TSX eslint descriptor the urls as they were not correct, by @bdovaz in #2294
  • Change in TYPESCRIPT eslint descriptor the urls as they were not correct, by @bdovaz in #2294
  • Use mkdocs-glightbox to allow to click on images and display them in full screen in #2414

• CI

  • Use docker/build-push-action to build docker images and akhilerm/tag-push-action to release by retagging and pushing beta images instead of rebuilding them in #2342
  • Authenticate to GitHub API during docker build to avoid reaching limits, by @bdovaz in #2299
  • Remove apk go package install in images where possible to decrease image sizes, by @echoix in https://github.com/oxsecurity/megalinter/pull/2318
  • Create a slash PR bot to run ./build.sh command manually on PRs, by @echoix in #2353 and #2381
  • Limit parallel execution of large job matrix in the workflows with max-parallel in order to keep runners available for other jobs, by @echoix in #2397

• Linter versions upgrades

  • ansible-lint from 6.12.1 to 6.14.0
  • bash-exec from 5.1.16 to 5.2.15
  • bicep_linter from 0.14.46 to 0.14.85
  • cfn-lint from 0.72.10 to 0.74.0
  • checkmake from 0.2.1 to 0.2.0
  • checkov from 2.1.244 to 2.3.18
  • checkstyle from 10.7.0 to 10.8.0
  • clj-kondo from 2023.01.20 to 2023.02.17
  • cspell from 6.21.0 to 6.28.0
  • djlint from 1.19.13 to 1.19.16
  • dotnet-format from 6.0.405 to 6.0.406
  • dustilock from 0.0.0 to 1.2.0
  • editorconfig-checker from 2.4.0 to 2.7.0
  • eslint from 8.33.0 to 8.35.0
  • git_diff from 2.36.4 to 2.38.4
  • gitleaks from 8.15.3 to 8.16.0
  • golangci-lint from 1.51.0 to 1.51.2
  • jscpd from 3.3.26 to 3.5.3
  • jsonlint from 11.7.0 to 13.0.1
  • kics from 1.6.9 to 1.6.11
  • mypy from 0.991 to 1.0.1
  • perlcritic from 1.148 to 1.150
  • phpcs from 3.7.1 to 3.7.2
  • phpstan from 1.9.14 to 1.10.3
  • powershell_formatter from 7.3.2 to 7.3.3
  • powershell from 7.3.2 to 7.3.3
  • prettier from 2.8.3 to 2.8.4
  • protolint from 0.42.2 to 0.43.0
  • psalm from Psalm.5.6.0@ to Psalm.5.7.7@
  • puppet-lint from 3.0.1 to 3.2.0
  • pylint from 2.16.1 to 2.16.3
  • pyright from 1.1.270 to 1.1.296
  • rubocop from 1.44.1 to 1.47.0
  • secretlint from 6.2.0 to 6.2.3
  • semgrep from 1.9.0 to 1.14.0
  • sfdx-scanner-apex from 3.8.0 to 3.10.0
  • sfdx-scanner-aura from 3.8.0 to 3.10.0
  • sfdx-scanner-lwc from 3.8.0 to 3.10.0
  • snakemake from 7.21.0 to 7.24.0
  • spectral from 5.9.2 to 6.6.0
  • syft from 0.70.0 to 0.74.0
  • terraform-fmt from 1.3.7 to 1.3.9
  • terragrunt from 0.43.2 to 0.44.4
  • terrascan from 1.16.0 to 1.18.0
  • tflint from 0.44.1 to 0.45.0
  • trivy from 0.35.0 to 0.38.1
  • xmllint from 20914 to 21003

New Contributors

• @timgentry made their first contribution in https://github.com/oxsecurity/megalinter/pull/2366
• @drbothen made their first contribution in https://github.com/oxsecurity/megalinter/pull/2411

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v6.19.0...v6.20.0

What's Changed

• Core

  • Deploy additional Docker images to GitHub Container Registry, by @lars-reimann in #2117
  • Build: Disable generate_documentation_all_users as we use github-dependents-info

• Evolutions

  • Support xmllint autofix, by @bdovaz in https://github.com/oxsecurity/megalinter/pull/2244 (requires definition of XML_XMLLINT_AUTOFORMAT: true)

• Fixes

  • Change name of config file for powershell formatter to avoid collision with powershell linter config, by @nvuillam in https://github.com/oxsecurity/megalinter/pull/2231
  • Enhance find SARIF json in stdout output
  • Pass --show-context, --show-suggestions, and --no-must-find-files to CSpell for friendlier UX, by @Kurt-von-Laven in #2275.
  • Only run npm-package-json-lint when package.json is present, by @Kurt-von-Laven in #2280.
  • Fix local files with extends, by @bdovaz in https://github.com/oxsecurity/megalinter/pull/2236
  • Remove downgrading of ansible-lint, by @gotit96 in https://github.com/oxsecurity/megalinter/pull/2257
  • Tag some automatically updated files as generated files, by @echoix in https://github.com/oxsecurity/megalinter/pull/2285
  • Fix Sarif Reporter in Azure Devops with space in project name, by @EtienneDeneuve in https://github.com/oxsecurity/megalinter/pull/2301

• Documentation

  • Configure jsonschema documentation formatting (see Descriptor schema, Configuration schema), by @echoix in #2270
  • Update CONTRIBUTING.md and add documentation improvements hints, by @bdovaz in https://github.com/oxsecurity/megalinter/pull/2228
  • Add Powershell linters rules url, by @bdovaz in https://github.com/oxsecurity/megalinter/pull/2242
  • Fix syft logo, by @pjungermann in https://github.com/oxsecurity/megalinter/pull/2282
  • Fix docker run documentation, by @davidjeddy in https://github.com/oxsecurity/megalinter/pull/2258

• Linter versions upgrades

  • actionlint from 1.6.22 to 1.6.23
  • ansible-lint from 6.7.0 to 6.12.1
  • bicep_linter from 0.13.1 to 0.14.6
  • black from 22.12.0 to 23.1.0
  • cfn-lint from 0.72.6 to 0.72.10
  • checkstyle from 10.6.0 to 10.7.0
  • clippy from 0.1.66 to 0.1.67
  • clj-kondo from 2022.12.10 to 2023.01.20
  • csharpier from 0.21.0 to 0.22.1
  • cspell from 6.18.1 to 6.21.0
  • devskim from 0.7.101 to 0.7.104
  • djlint from 1.19.11 to 1.19.13
  • dotnet-format from 000 to 6.0.405
  • eslint from 8.31.0 to 8.33.0
  • git_diff from 2.36.3 to 2.36.4
  • gitleaks from 8.15.2 to 8.15.3
  • golangci-lint from 1.50.1 to 1.51.0
  • isort from 5.11.4 to 5.12.0
  • kics from 1.6.7 to 1.6.9
  • ktlint from 0.48.1 to 0.48.2
  • perlcritic from 1.146 to 1.148
  • phpstan from 1.9.7 to 1.9.14
  • powershell from 7.3.1 to 7.3.2
  • powershell_formatter from 7.3.1 to 7.3.2
  • prettier from 2.8.1 to 2.8.3
  • psalm from Psalm.dev-master@ to Psalm.5.6.0@
  • pylint from 2.15.10 to 2.16.1
  • revive from 1.2.4 to 1.2.5
  • rstfmt from 0.0.11 to 0.0.12
  • rubocop from 1.42.0 to 1.44.1
  • scss-lint from 0.59.0 to 0.60.0
  • secretlint from 6.0.2 to 6.2.0
  • semgrep from 1.3.0 to 1.9.0
  • snakefmt from 0.8.0 to 0.8.1
  • snakemake from 7.19.1 to 7.21.0
  • syft from 0.65.0 to 0.70.0
  • terraform-fmt from 1.3.6 to 1.3.7
  • terragrunt from 0.42.3 to 0.43.2
  • tflint from 0.44.0 to 0.44.1
  • tsqllint from 1.15.1.0 to 1.15.3.0
  • v8r from 0.13.1 to 0.14.0
  • yamllint from 1.28.0 to 1.29.0

New Contributors

• @davidjeddy made their first contribution in https://github.com/oxsecurity/megalinter/pull/2258
• @gotit96 made their first contribution in https://github.com/oxsecurity/megalinter/pull/2257
• @pjungermann made their first contribution in https://github.com/oxsecurity/megalinter/pull/2282
• @EtienneDeneuve made their first contribution in https://github.com/oxsecurity/megalinter/pull/2301

MegaLinter is graciously provided by

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v6...v6.19.0

What's Changed

• New linters

  • Add CSharpier linter, by @bdovaz in #2185 and #2198

• Core

  • Upgrade to dotnet 6.0, by @lexstatic in #1680
    • dotnet-format requires .sln, .csproj or .vbproj in the repo
  • Switch to docker buildx, by @bdovaz in #2199
  • Drone CI enhancements, by @NebulaOnion in #2195
    • Config generator tool now supports Drone CI
    • Added information about how to change trigger rules for Drone CI workflow
  • Unify the drawing of badges in documentation, by @bdovaz in #2220

• Fixes

  • Do not write output files if REPORT_OUTPUT_FOLDER is none
  • Fix Perl linter skipping files

• New MegaLinter plugins

  • linkcheck: Plugin to check and validate Markdown links, by @shiranr
  • salt-lint: Checks Salt State files (SLS) for best practices and behavior that could potentially be improved, by @grimmjo

• New article talking about MegaLinter: Writing documentation as a champ in engineering teams, by @gijsreyn

• Linter versions upgrades

  • cfn-lint from 0.72.5 to 0.72.6
  • checkstyle from 10.5.0 to 10.6.0
  • csharpier from 0.16.0 to 0.21.0
  • cspell from 6.18.0 to 6.18.1
  • devskim from 0.6.9 to 0.7.101
  • djlint from 1.19.10 to 1.19.11
  • eslint-plugin-jsonc from 2.5.0 to 2.6.0
  • eslint from 8.30.0 to 8.31.0
  • kics from 1.6.6 to 1.6.7
  • ktlint from 0.48.0 to 0.48.1
  • markdownlint from 0.32.2 to 0.33.0
  • phplint from 5.4 to 5.5
  • phpstan from 1.9.4 to 1.9.7
  • rubocop from 1.41.1 to 1.42.0
  • secretlint from 5.3.0 to 6.0.2
  • semgrep from 1.2.1 to 1.3.0 on 2023-01-06
  • sfdx-scanner from 3.7.1 to 3.8.0
  • stylelint from 14.16.0 to 14.16.1
  • syft from 0.64.0 to 0.65.0
  • tsqllint from 1.14.5.0 to 1.15.1.0

New Contributors

• @shiranr made their first contribution in https://github.com/oxsecurity/megalinter/pull/2193

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v6...v6.18.0

MegaLinter is graciously provided by

Attend OX Security next webinar, hosted by Neatsun Ziv, Co-founder & CEO !

What's Changed

• New linters

  • Add PowerShell formatter, by @bdovaz (#2176)

• Documentation

  • Improve meta tags in HTML documentation
  • Clarify how npm-package-json-lint files can be ignored, by @bdovaz (#2184)

• Linter versions upgrades

  • djlint from 1.19.9 to 1.19.10
  • dotenv-linter from 3.2.0 to 3.3.0
  • powershell_formatter from 5.1.22621 to 7.3.1
  • tflint from 0.43.0 to 0.44.0

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v6...v6.17.0

MegaLinter is graciously provided by

What's Changed

• New linters

  • Add npm-package-json-lint linter, by @bdovaz (#2150)

• Evolutions

  • Upgrade to alpine 3.16
  • Disable php7 & upgrade php8 to php81
  • Add Makefile linters to documentation flavor
  • PowershellLinter autofix capability, by @bdovaz (#2175)
  • Allow local files with EXTENDS configuration, by @bdovaz (#2151)
  • Add Trivy config file parameters, by @bdovaz (#2154)

• Fixes

  • Change reporter text for better UX, by @ashokm (#2168)
  • Remove workspace prefix from aggregate sarif report, by @janderssonse (#2119)
  • CSpell file name linting does not use (custom) CSpell configuration (#2058)
  • HTML email not rendering correctly (#2120). Set REPORTERS_MARKDOWN_TYPE to simple to avoid external images in PR/MR markdown comments.
  • mega-linter-runner: Fix Value for container-name of type String required, by @AlbanAndrieu ([#2123])(https://github.com/oxsecurity/megalinter/pull/2123)
  • Use warning emoji in reporters, by @ashokm (#2156)
  • Fix branding to use the correct 'OX Security' name, by @ashokm

• Doc

  • Enclose System.TeamProject in Azure Pipelines, by @ashokm (#2131)
  • Better contributing docs, by @bdovaz (#2162)

• Linter versions upgrades

  • bicep_linter from 0.12.40 to 0.13.1
  • black from 22.10.0 to 22.12.0
  • cfn-lint from 0.72.0 to 0.72.5
  • checkstyle from 10.4 to 10.5.0
  • clippy from 0.1.65 to 0.1.66
  • clj-kondo from 2022.10.14 to 2022.12.10
  • cspell from 6.14.3 to 6.18.0
  • djlint from 1.19.7 to 1.19.9
  • eslint from 8.28.0 to 8.29.0 to 8.30.0
  • git_diff from 2.34.5 to 2.36.3
  • gitleaks from 8.15.0 to 8.15.2
  • isort from 5.10.1 to 5.11.4
  • kics from 1.6.5 to 1.6.6
  • ktlint from 0.47.1 to 0.48.0
  • luacheck from 1.0.0 to 1.1.0
  • perlcritic from 1.140 to 1.146
  • phplint from 3.0 to 5.4
  • phpstan from 1.9.2 to 1.9.4
  • powershell from 7.3.0 to 7.3.1
  • prettier from 2.8.0 to 2.8.1
  • psalm from Psalm.4.x-dev@ to Psalm.dev-master@
  • pylint from 2.15.6 to 2.15.9
  • rubocop from 1.39.0 to 1.41.1
  • semgrep from 0.122.0 to 1.2.1
  • sfdx-scanner-apex from 3.6.2 to 3.7.1
  • sfdx-scanner-aura from 3.6.2 to 3.7.1
  • sfdx-scanner-lwc from 3.6.2 to 3.7.1
  • shellcheck from 0.8.0 to 0.9.0
  • snakefmt from 0.7.0 to 0.8.0
  • snakemake from 7.18.2 to 7.19.1
  • sqlfluff from 1.4.2 to 1.4.5
  • stylelint from 14.15.0 to 14.16.0
  • swiftlint from 0.50.0 to 0.50.3
  • syft from 0.62.1 to 0.64.0
  • terraform-fmt from 1.3.5 to 1.3.6
  • terragrunt from 0.40.2 to 0.42.3
  • terrascan from 1.17.0 to 1.16.0
  • tflint from 0.42.1 to 0.43.0
  • trivy from 0.29.2 to 0.35.0
  • v8r from 0.13.0 to 0.13.1

Contributors

• @bdovaz
• @ashokm
• @janderssonse
• @AlbanAndrieu

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v6.15.0...v6.16.0

MegaLinter is graciously provided by

What's Changed

• Switch to https://megalinter.io

• Initial Drone CI documentation

• Automatically generate "Used by" markdown documentation with github-dependents-info

• Add Docker container documentation

• Linter versions upgrades

  • bicep_linter from 0.12.1 to 0.12.40
  • cfn-lint from 0.70.1 to 0.72.0
  • coffeelint from 5.2.10 to 5.2.11
  • cspell from 6.14.0 to 6.14.3
  • djlint from 1.19.4 to 1.19.7
  • eslint from 8.27.0 to 8.28.0
  • flake8 from 5.0.4 to 6.0.0
  • hadolint from 2.10.0 to 2.12.0
  • kics from 1.6.3 to 1.6.5
  • mypy from 0.982 to 0.991
  • phpstan from 1.9.1 to 1.9.2
  • powershell from 7.2.7 to 7.3.0
  • prettier from 2.7.1 to 2.8.0
  • protolint from 0.41.0 to 0.42.2
  • psalm from Psalm.5.x-dev@ to Psalm.4.x-dev@
  • pylint from 2.15.5 to 2.15.6
  • rstcheck from 6.1.0 to 6.1.1
  • rubocop from 1.38.0 to 1.39.0
  • semgrep from 0.120.0 to 0.122.0
  • snakefmt from 0.6.1 to 0.7.0
  • snakemake from 7.18.1 to 7.18.2
  • sqlfluff from 1.4.1 to 1.4.2
  • stylelint from 14.14.1 to 14.15.0
  • swiftlint from 0.46.5 to 0.50.0
  • syft from 0.60.3 to 0.62.1
  • terraform-fmt from 1.3.4 to 1.3.5
  • terragrunt from 0.40.0 to 0.40.2
  • terrascan from 1.16.0 to 1.17.0

Contributors

• @NebulaOnion made their first contribution in https://github.com/oxsecurity/megalinter/pull/2053
• @rasa
• @nvuillam

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v6.14.0...v6.15.0

MegaLinter is graciously provided by

• Core

  • Replace set-output usage with GITHUB_OUTPUT to handle Github deprecation notice
  • Allow PRE_COMMANDS to be defined within a python venv (#2017)
  • Correct behavior of EXTENDS property in .megalinter.yml config file (#1516)
  • Fix flavor suggestion message in reporters

• New MegaLinter plugin: mustache: Plugin to validate Logstash pipeline definition files using mustache, by Yann Jouanique

• New article: GitHub Actions: sharing your secrets with third-party actions, by José Celano Martín, Constantin Bosse and Stephen Hosom

• Linters

  • Bring back rstfmt RestructuredText formatter
  • Add the SPELL_*_FILE_EXTENSIONS parameter for each SPELL type linter. If set, it will use this value to filter instead of the default behavior which is to parse the files of all other linters executed (#1997).
  • Allow cspell to also analyze file names (new variable SPELL_CSPELL_ANALYZE_FILE_NAMES) (#2009)
  • Fix bicep version regex

• Linter versions upgrades

  • actionlint from 1.6.21 to 1.6.22
  • bicep_linter from 0.11.1 to to 0.12.1
  • cfn-lint from 0.68.1 to 0.70.1
  • checkstyle from 10.3.4 to 10.4
  • clippy from 0.1.64 to 0.1.65
  • cspell from 6.12.0 to 6.14.0
  • djlint from 1.19.2 to 1.19.4
  • eslint-plugin-jsonc from 2.4.0 to 2.5.0
  • eslint from 8.26.0 to 8.27.0
  • kics from 1.6.2 to 1.6.3
  • kubeconform from 0.4.12 to 0.5.0
  • npm-groovy-lint from 11.0.0 to 11.1.1
  • phpstan from 1.8.10 to 1.9.1
  • revive from 0.0.0 to 1.2.4
  • rstfmt from 0.0.10 to 0.0.11
  • rubocop from 1.37.0 to 1.38.0
  • secretlint from 5.2.4 to 5.3.0
  • semgrep from 0.118.0 to 0.120.0
  • sfdx-scanner-apex from 2.13.9 to 3.6.2
  • sfdx-scanner-aura from 2.13.9 to 3.6.2
  • sfdx-scanner-lwc from 2.13.9 to 3.6.2
  • snakemake from 7.16.1 to 7.18.1
  • sqlfluff from 1.3.2 to 1.4.1
  • stylelint from 14.14.0 to 14.14.1
  • syft from 0.59.0 to 0.60.3
  • terraform-fmt from 1.3.3 to 1.3.4
  • terragrunt from 0.39.2 to 0.40.0
  • tflint from 0.41.0 to 0.42.1
  • yamllint from 1.26.3 to 1.26.3

MegaLinter is graciously provided by

• New cupcake flavor with 78 instead of 108 linters

• Don't add literal double quote character to filenames in mega-linter-runner (#1942).

• Remove default npm-groovy-lint extra arguments (#1872)

• Replace yaml.load by yaml.safe_load for better security

• Linter versions upgrades

  • cfn-lint from 0.67.0 to 0.68.1
  • clj-kondo from 2022.10.05 to 2022.10.14
  • djlint from 1.19.1 to 1.19.2
  • eslint from 8.25.0 to 8.26.0
  • git_diff from 2.34.4 to 2.34.5
  • gitleaks from 8.14.1 to 8.15.0
  • golangci-lint from 1.50.0 to 1.50.1
  • phpstan from 1.8.9 to 1.8.10
  • powershell from 7.2.6 to 7.2.7
  • puppet-lint from 3.0.0 to 3.0.1
  • pylint from 2.15.4 to 2.15.5
  • rubocop from 1.36.0 to 1.37.0
  • semgrep from 0.117.0 to 0.118.0
  • snakemake from 7.16.0 to 7.16.1
  • syft from 0.58.0 to 0.59.0
  • terraform-fmt from 1.3.2 to 1.3.3
  • terragrunt from 0.39.1 to 0.39.2
  • terrascan from 1.15.2 to 1.16.0

MegaLinter is graciously provided by

• Add Makefile linter in go flavor

• Fix invalid Docker container names in .pre-commit-hooks.yaml (#1932)

• Correct spelling of containername argument to mega-linter-runner (#1570)

• Correct removeContainer casing in runner (#1917)

• Fix use of TERRAFORM_KICS_ARGUMENTS (#1947)

• Use -p argument for pyright custom config file path (#1946)

• Fix incorrect link to pytype for pyright (#1967)

• Deduplicate SHOW_ELAPSED_TIME properties to address v8r error (#1962)

• Add link to article GitOps security topics you must address, by Wiebe de Roos

• Linter versions upgrades

  • actionlint from 1.6.16 to 1.6.21
  • ansible-lint from 6.7.0 to 6.7.0
  • bicep_linter from 0.10.61 to 0.11.1
  • black from 22.8.0 to 22.10.0
  • cfn-lint from 0.66.0 to 0.67.0
  • clj-kondo from 2022.09.08 to 2022.10.05
  • djlint from 1.18.0 to 1.19.1
  • eslint from 8.24.0 to 8.25.0
  • gitleaks from 8.13.0 to 8.14.1
  • golangci-lint from 1.49.0 to 1.50.0
  • kics from 1.6.1 to 1.6.2
  • mypy from 0.981 to 0.982
  • npm-groovy-lint from 10.1.0 to 11.0.0
  • phpstan from 1.8.6 to 1.8.9
  • puppet-lint from 2.5.2 to 3.0.0
  • pylint from 2.15.3 to 2.15.4
  • scalafix from 0.10.3 to 0.10.4
  • semgrep from 0.115.0 to 0.117.0
  • snakemake from 7.14.2 to 7.16.0
  • stylelint from 14.13.0 to 14.14.0
  • terraform-fmt from 1.3.1 to 1.3.2
  • terragrunt from 0.39.0 to 0.39.1

MegaLinter is graciously provided by

• Remove no-space-check from MegaLinter default .pylintrc file (#1923)

New article: https://nicolas.vuillamy.fr/megalinter-sells-his-soul-and-joins-ox-security-2a91a0027628

MegaLinter is graciously provided by

• New article: https://nicolas.vuillamy.fr/megalinter-sells-his-soul-and-joins-ox-security-2a91a0027628

• Linters

  • Add bicep linter (#1898)
  • Add quotes to arm-ttk linter command (#1879)
  • Add Makefile linter in java flavor

• Core

  • Improve support for devcontainers by using Python base image
    • Fixed Python version in devcontainer from 3.9 -> 3.10
    • Fix build command on linux (thanks a lot to Edouard Choinière for the investigation and solution !)
  • Azure Comments reporter - Change status when all tests pass (#1915)

• Doc

  • Document the -f argument to mega-linter-runner (#1895)
  • Fix a typo in documentation of bash-exec linter (#1892)

• Linter versions upgrades

  • ansible-lint from 6.6.0 to 6.7.0
  • cfn-lint from 0.65.0 to 0.66.0
  • checkov from 2.1.213 to 2.1.244
  • checkstyle from 10.3.3 to 10.3.4
  • clippy from 0.1.63 to 0.1.64
  • coffeelint from 5.2.9 to 5.2.10
  • cspell from 6.10.0 to 6.12.0
  • djlint from 1.16.0 to 1.18.0
  • eslint from 8.23.1 to 8.24.0
  • gitleaks from 8.12.0 to 8.13.0
  • jsonlint from 11.6.0 to 11.7.0
  • kics from 1.6.0 to 1.6.1
  • markdown-link-check from 3.10.2 to 3.10.3
  • mypy from 0.971 to 0.981
  • phpstan from 1.8.5 to 1.8.6
  • protolint from 0.40.0 to 0.41.0
  • scalafix from 0.10.2 to 0.10.3
  • semgrep from 0.113.0 to 0.115.0
  • snakemake from 7.14.0 to 7.14.2
  • sqlfluff from 1.3.1 to 1.3.2
  • stylelint from 14.12.0 to 14.13.0
  • syft from 0.56.0 to 0.58.0
  • terraform-fmt from 1.2.9 to 1.3.1
  • terragrunt from 0.38.12 to 0.39.0
  • tflint from 0.40.0 to 0.41.0

MegaLinter is graciously provided by

• Add git-lfs in Docker image to handle large files in git repositories

• MegaLinter Docker images size improvements

  • Remove NPM cache
  • Remove Cargo cache
  • Remove rustup when clippy is not embedded in the image
  • Remove npm packages useless files

• Linter versions upgrades

  • ansible-lint from 6.5.2 to 6.6.0
  • cfn-lint from 0.64.1 to 0.65.0
  • checkov from 2.1.201 to 2.1.213
  • cspell from 6.8.1 to 6.10.0
  • djlint from 1.12.3 to 1.16.0
  • eslint from 8.23.0 to 8.23.1
  • kics from 1.5.15 to 1.6.0
  • pylint from 2.15.2 to 2.15.3
  • scalafix from 0.10.1 to 0.10.2
  • semgrep from 0.112.1 to 0.113.0
  • sfdx-scanner-apex from 2.13.8 to 2.13.9
  • sfdx-scanner-aura from 2.13.8 to 2.13.9
  • sfdx-scanner-lwc from 2.13.8 to 2.13.9
  • stylelint from 14.11.0 to 14.12.0
  • syft from 0.55.0 to 0.56.0
  • terragrunt from 0.38.10 to 0.38.12
  • terragrunt from 0.38.9 to 0.38.10
  • yamllint from 1.27.1 to 1.28.0

• Linters

  • Add python type checker pyright, by Microsoft
  • New linters with available SARIF output for SARIF Reporter
    • ansible-lint
    • shellcheck thanks to shellcheck-sarif
  • Use list_of_files Cli lint mode for checkstyle, to have unique SARIF output and improve performances
  • Use list_of_files Cli lint mode for golangci-lint and revive, to improve performances
  • Reactivate snakefmt

• Core

  • Improve build performances and docker images sizes (reduce from 117 to 36 layers)
    • Use BUILDKIT
    • Join RUN instructions
    • Optimize core Dockerfile items
    • Clean npm, python and cargo caches
  • Create a venv for each python-based linter to avoid issues with dependencies
  • Fix broken link to documentation when using v6

• Linter versions upgrades

  • ansible-lint from 6.0.2 to 6.5.2
  • cfn-lint from 0.63.2 to 0.64.1
  • checkov from 2.1.183 to 2.1.201
  • clj-kondo from 2022.08.03 to 2022.09.08
  • djlint from 1.12.1 to 1.12.3
  • gitleaks from 8.11.2 to 8.12.0
  • golangci-lint from 1.48.0 to 1.49.0
  • ktlint from 0.47.0 to 0.47.1
  • phpstan from 1.8.4 to 1.8.5
  • protolint from 0.39.0 to 0.40.0
  • pylint from 2.15.0 to 2.15.2
  • semgrep from 0.103.0 to 0.112.1
  • sqlfluff from 1.3.0 to 1.3.1
  • standard from 15.0.1 to 17.0.0
  • terraform-fmt from 1.2.8 to 1.2.9
  • tflint from 0.39.3 to 0.40.0

Note: MegaLinter 6.9.0 release has been cancelled: it was fine but the docker image sizes were not optimized enough.

MegaLinter is graciously provided by

• Run MegaLinter pre-commit hooks serially (#1826).

• Replace deprecated StandardJS VS Code extension with the newer official version

• When SARIF_REPORTER is active, use sarif-fmt to convert SARIF into text for console and text reporters (#1822).

• Count checkstyle errors (#1820)

• Linter versions upgrades

  • black from 22.6.0 to 22.8.0
  • cfn-lint from 0.63.0 to 0.63.2
  • checkov from 2.1.160 to 2.1.183
  • checkstyle from 10.3.2 to 10.3.3
  • djlint from 1.12.0 to 1.12.1
  • kics from 1.5.14 to 1.5.15
  • phpstan from 1.8.2 to 1.8.4
  • rubocop from 1.35.1 to 1.36.0
  • snakemake from 7.13.0 to 7.14.0
  • syft from 0.54.0 to 0.55.0
  • terragrunt from 0.38.8 to 0.38.9

MegaLinter is graciously provided by

• Fix Azure Comments reporter: Use BuildId to build artifacts url
• Fix actionlint install command

MegaLinter is graciously provided by

• Linters

  • Add PMD java linter

• Azure Pipelines integration enhancements

  • Update installation instructions
  • Console reporter: manage collapsible groups for easier display & navigation in job logs (requires CI=true and TF_BUILD=true sent as env variables)
  • Azure comments reporter (see documentation)

• Performances improvements

  • When running linters in parallel, run in the same process only the linters from same descriptor and that can update the same sources (to avoid concurrency). Other linters can be run independently.
  • Define linter_speed of linter descriptors (default 3). Can be from 1 (super slow) to 5 (super fast). This is used to optimize the processing order of linters.

• Fixes

  • Fix: Properly match files_sub_directory as a prefix instead of partial string matching (#1765)
  • Match regex without workspace and sub_directory
  • Remove config variables that are not applicable to linters analyzing all files or all other linters files

• Linter versions upgrades

  • cfn-lint from 0.62.0 to 0.63.0
  • checkov from 2.1.139 to 2.1.160
  • cspell from 6.8.0 to 6.8.1
  • djlint from 1.11.0 to 1.12.0
  • eslint from 8.22.0 to 8.23.0
  • gitleaks from 8.11.0 to 8.11.2
  • golangci-lint from 1.48.0 to 1.49.0
  • luacheck from 0.26.1 to 1.0.0
  • pylint from 2.14.5 to 2.15.0
  • rubocop from 1.35.0 to 1.35.1
  • secretlint from 5.2.3 to 5.2.4
  • snakemake from 7.12.1 to 7.13.0
  • terraform-fmt from 1.2.7 to 1.2.8
  • terragrunt from 0.38.7 to 0.38.8
  • tflint from 0.35.0 to 0.39.3

MegaLinter is graciously provided by