Bump oxsecurity/megalinter from a151007c426d6bc89bfde35a7bd3cd64cf373493 to e050c1bdc82e671e2b0d30d0dc64150899554a47

[dependabot]

Bumps oxsecurity/megalinter from a151007c426d6bc89bfde35a7bd3cd64cf373493 to e050c1bdc82e671e2b0d30d0dc64150899554a47.

Changelog

Sourced from oxsecurity/megalinter's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased] (beta, main branch content)

Note: Can be used with oxsecurity/megalinter@beta in your GitHub Action mega-linter.yml file, or with oxsecurity/megalinter:beta docker image

• Breaking changes

  • @eslint/eslintrc shim removed from JavaScript/TypeScript/JSX/TSX Docker images (was only needed for legacy FlatCompat); MegaLinter's bundled test fixtures use native flat config.
  • ESLint linters now force migration off .eslintrc.*: JAVASCRIPT_ES, TYPESCRIPT_ES, JSX_ESLINT, TSX_ESLINT activate when they find any eslint.config.* or any deprecated .eslintrc.* / package.json#eslintConfig. In the legacy case the linter does not call ESLint at all — it emits a single hard failure with a migration message so the build stays red until the config is migrated to flat config. See the ESLint flat-config migration guide. To opt out, set DISABLE_LINTERS or DISABLE to exclude the affected linter/descriptor.
  • JSON_ESLINT_PLUGIN_JSONC removed: upstream bug ota-meshi/eslint-plugin-jsonc#328 blocks ESLint v10 compatibility and will not be fixed. Use JSON_JSONLINT, JSON_PRETTIER, or JSON_V8R for JSON validation instead.

• Core

  • New linter descriptor property common_linter_errors: declare known non-lint failure patterns (config issue, remote service down, missing credentials…) and the guidance message shown to users, directly in YAML — no custom Python class needed.

• New linters

• Disabled linters

• Re-enabled linters

• Deprecated linters

• Removed linters

  • JSON_ESLINT_PLUGIN_JSONC — permanently broken by upstream bug (see Breaking changes)

• Media

• Linters enhancements

• Fixes

  • Complete the Alpine 3.24 upgrade across the whole image and fix how alpine version is detected.
  • Exclude REPORT_OUTPUT_FOLDER from linting when configured as an absolute path inside the workspace (e.g. /tmp/lint/megalinter-reports), fixing #7845.
  • Fix command injection in Roslynator linter (DOTNET_ROSLYNATOR) where a crafted .csproj filename could break out of dotnet restore arguments and execute arbitrary shell commands. The command is now invoked via argv list instead of a shell string. Reported by Francesco Sabiu.
  • Fix IndexError when building the single-linter Docker image for a linter whose activation depends on a file (e.g. SPELL_VALE requires .vale.ini): python -m megalinter.run --linterversion now bypasses activation filtering since the per-linter image is built for that linter unconditionally.

• Reporters

• Flavors

• Doc

  • Update Docker pull counters in README badges and flavors-stats.json with latest ghcr.io stats

• mega-linter-runner

• Dev

  • Stop generating per-linter Dockerfiles for linters marked disabled: true in their descriptor. The matching images were already excluded from the build matrix (linters_matrix.json) and never published, so the on-disk linters/<linter>/Dockerfile was dead code. Deleted the 8 corresponding stale Dockerfile directories.

... (truncated)

Commits

• e050c1b Make mega-linter-runner/index.js executable in git (#8091)
• d1de200 chore(deps): update dependency friendsofphp/php-cs-fixer to v3.95.7 (#8087)
• 5948cdf chore(deps): update dependency graphql to v16.14.2 (#8088)
• b3e3ebd chore(deps): update dependency aiohttp to v3.14.1 (#8081)
• abaf49b [automation] Auto-update linters version, help and documentation (#8086)
• 9df97c7 chore(deps): update dependency @​eslint-react/eslint-plugin to v5.8.18 (#8085)
• 094f78f chore(deps): update dependency djlint to v1.39.2 (#8083)
• 6bdc769 chore(deps): update dependency dart to v3.12.2 (#8082)
• e50b072 chore(deps): bump aiohttp from 3.14.0 to 3.14.1 in /.config/python/dev (#8072)
• db34004 Update Dockerfiles to use Python 3.14-alpine3.24 and Alpine 3.24 (#8080)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
❌ COPYPASTE	jscpd	yes		3	no	2.11s
✅ REPOSITORY	gitleaks	yes		no	no	0.7s
✅ REPOSITORY	git_diff	yes		no	no	0.01s
✅ REPOSITORY	grype	yes		no	no	47.78s
❌ REPOSITORY	osv-scanner	yes		1	no	0.42s
✅ REPOSITORY	secretlint	yes		no	no	1.19s
✅ REPOSITORY	syft	yes		no	no	1.99s
✅ REPOSITORY	trivy	yes		no	no	10.21s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.18s
✅ REPOSITORY	trufflehog	yes		no	no	4.03s

Detailed Issues

❌ COPYPASTE / jscpd - 3 errors

Clone found (cpp):
 - WinMTRNet-Getters.cpp [20:1 - 33:7] (13 lines, 70 tokens)
   WinMTRNet-Tracing.cpp [20:1 - 33:2]

Clone found (cpp):
 - WinMTRDialog-display.cpp [1:1 - 33:30] (32 lines, 66 tokens)
   WinMTRDialog-exporter.cpp [1:1 - 33:57]

Clone found (cpp):
 - WinMTRDialog-StateMachine.cpp [46:1 - 58:5] (12 lines, 75 tokens)
   WinMTRNet-Tracing.cpp [40:1 - 50:7]

┌──────────┬────────────────┬─────────────┬──────────────┬──────────────┬──────────────────┬───────────────────┐
│ Format   │ Files analyzed │ Total lines │ Total tokens │ Clones found │ Duplicated lines │ Duplicated tokens │
├──────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ c-header │ 6              │ 353         │ 1173         │ 0            │ 0 (0%)           │ 0 (0%)            │
├──────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ cpp      │ 10             │ 2087        │ 14697        │ 3            │ 57 (2.73%)       │ 211 (1.44%)       │
├──────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ markdown │ 1              │ 35          │ 114          │ 0            │ 0 (0%)           │ 0 (0%)            │
├──────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ Total:   │ 17             │ 2475        │ 15984        │ 3            │ 57 (2.3%)        │ 211 (1.32%)       │
└──────────┴────────────────┴─────────────┴──────────────┴──────────────┴──────────────────┴───────────────────┘
Found 3 clones.
HTML report saved to megalinter-reports/copy-paste/html/
ERROR: jscpd found too many duplicates (2.3%) over threshold (0%)
Error: ERROR: jscpd found too many duplicates (2.3%) over threshold (0%)
    at ThresholdReporter.report (/node-deps/node_modules/@jscpd/finder/dist/index.js:615:13)
    at /node-deps/node_modules/@jscpd/finder/dist/index.js:109:18
    at Array.forEach (<anonymous>)
    at /node-deps/node_modules/@jscpd/finder/dist/index.js:108:22
    at async /node-deps/node_modules/jscpd/dist/bin/jscpd.js:9:5

❌ REPOSITORY / osv-scanner - 1 error

Scanning dir .
Starting filesystem walk for root: /
End status: 31 dirs visited, 123 inodes visited, 0 Extract calls, 6.216006ms elapsed, 6.216257ms wall time
No package sources found, --help for usage information.

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

Show us your support by starring ⭐ the repository

[dependabot]

Superseded by #446.