Skip to content

chore(deps): update dependency sfdx-hardis to v8 - #8880

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/sfdx-hardis-8.x
Open

chore(deps): update dependency sfdx-hardis to v8#8880
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/sfdx-hardis-8.x

Conversation

@renovate

@renovate renovate Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
sfdx-hardis (source) 7.23.08.2.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Release Notes

hardisgroupcom/sfdx-hardis (sfdx-hardis)

v8.2.0

Compare Source

  • Personal data is now anonymized in all reports, notifications, and monitoring output when running in CI - see Security & Privacy for details.
  • URLs are now clickable in every generated XLSX file.
  • All configured JIRA credentials are now tried until one works, instead of only the first one.
  • A progress bar replaces per-ticket log lines while collecting JIRA and Azure Boards ticket information.
  • JIRA authentication failures are now reported in the release notes and Pull Request comments instead of passing unnoticed.

v8.1.0

Compare Source

Core
  • Queries report their number of records to VS Code: SOQL, Tooling API, Bulk API and Data Cloud queries now tell the VS Code extension when they start, when they complete (with the number of records retrieved) and when they fail, so the Command Runner can show a record count chip next to each query. A failed query now also logs a Query failed line with the error message.
  • A skipped action no longer erases the record that it was performed: when a manual action ticked as done was later skipped by its execution context or branch filter on another job, the skip overwrote the success entry in the Deployment Actions state, and the next job's checkbox sync recorded the tick again - re-dating the entry and rewriting the Pull Request comment on every deployment. A skip now leaves an existing success entry for the same action and org branch untouched.
  • A ticked manual action of a Pull Request outside the deployment scope is no longer recorded again on every run: the validation comment of a promotion lists the manual actions of every Pull Request it carries, and a tick placed there belongs to a Pull Request whose state was not loaded with the scope. The tick was recorded again with the date and job of every later run scanning that comment, and that Pull Request's Deployment Actions comment rewritten each time, losing the original completion date. The source Pull Request's state is now loaded on demand before the check.
  • Action Details of the Deployment Actions comment rendered as tables: each action now shows its properties (ID, type, context, run-once, allow-failure, target branches, type-specific parameters) in a two-column table and its results in an org-by-org table (status, date, job link), with the outputs below. Manual instructions stay a readable block under the properties table. The former one-line run of bold key/value pairs and italic per-org lines was hard to scan.
  • Deployment action allowed to fail reported as a warning: an action with allowFailure: true that fails now shows warning (⚠️) in the Pull Request comments instead of failed, and no longer turns the Deployment Actions comment banner red, since the deployment went on. The action still runs again on the next deployment.
  • Validation job of a feature Pull Request scoped to that Pull Request: the check deployment collected the deployment actions, manual actions and Apex test classes of every Pull Request ever merged upstream (341 on one project), because the promotion window has no meaning for a branch that was never merged into its target. The validation job now applies the same rule as the deployment job: a feature branch carries only its own Pull Request, a major or retrofit branch carries the whole promotion window. The check comment no longer lists manual actions belonging to other Pull Requests.
  • Release notes: Pull Requests and Commits columns in the Metadata Changes XLSX tab: each metadata item of hardis:doc:release-notes now lists the Pull Requests (number, title, author) and the commits (title, author, date) that touched it, one per line.
  • Progress bars instead of log spam in VS Code: loading the deployment actions state of many Pull Requests and cross-referencing release notes metadata with commits now show a progress bar, and the per-PR git commands are no longer logged. The Markdown report button of the release notes is labeled "(MD)" to match the PDF and XLSX ones.
  • Release notes of an intermediate major branch titled Promotion Notes: merging into a major branch that still has a merge target (for example integration to uat) is a promotion, and only merging into the last branch of the pipeline (for example main) is a release. The document generated by hardis:doc:release-notes for an intermediate branch is now titled Promotion Notes instead of Release Notes, and the mode and merge commit prompts now say release or promotion.
  • Fixed the Fetching batch X/{{MAX}} log line of paginated SOQL queries showing a raw placeholder instead of the maximum number of batches.
  • Fixed the VS Code UI looking stuck after an org selection prompt: the org connection check now logs its action before running sf org display.
Dependencies
  • Smaller supply-chain attack surface: 14 more npm dependencies removed (@actions/github, jsdoc-to-markdown, inquirer, fs-extra, ora, open, sort-array, farmhash, cross-spawn, which, debug, dotenv, form-data, unused langchain), replaced by Node.js built-ins and small internal helpers; yarn test now fails when a dependency is unused or the lock file grows past a ceiling. Node.js 22 or more is required (like the Salesforce CLI).
Documentation
  • The Installation page is rewritten for first-time users: a table to pick between VS Code, the CLI plugin and the Docker images, then the VS Code setup step by step, with the IDE compatibility table and the troubleshooting tips moved to the end.
  • Deployment Actions: the Target orgs section now shows two screenshots of the editor, one action restricted to uat and main to enable an integration, and one running everywhere except main to upsert the sample records used to test the agents.

v8.0.0

Compare Source

Summary
  • Deployment Actions are now generally available, and are the major enhancement of this version: define the data loads, Apex scripts, commands, Experience Cloud publications, scheduled batches and manual steps that must run with your Pull Request, restrict them to the major branches of your choice, and follow their execution org by org from the Pull Request itself.
  • Pull Request comments are redesigned: colored banners, navigation between the three comments, a status matrix for deployment actions, and manual actions you tick as done.
  • Deleting a Flow is now supported in destructive changes: it is deactivated then deleted through the Tooling API, version by version.
  • CI/CD pipelines run in the sfdx-hardis Docker image on GitHub, Azure and Bitbucket like they already did on GitLab, so jobs start faster and are no longer broken by a bad release of a dependency.
  • Lighter and safer install: the npm dependency tree is ~20% smaller (axios, xml2js, openai, cloudflare, md-to-pdf and others removed), so there is less third-party code to trust, a smaller supply-chain attack surface, and a faster install of the plugin and of the CI/CD Docker images.
  • Usage and cost monitoring: three new commands and a Grafana dashboard for entitlement consumption, Salesforce utilization alerts and Agentforce credits, with the amounts converted in your own currency.
  • Sandbox refresh covers what it could not before: Connected Apps to convert into External Client Apps, Scheduled Apex rescheduled with its original owners, and restores that can be resumed after a failure.
  • Documentation reorganized for v8, with every VS Code extension screenshot and animation refreshed.
Deployment & CI/CD
  • Deployment Actions leave beta and become generally available:
    • hardis:project:action:create: Restrict an action to some major branches, or to all of them except a few, and target developer sandboxes with dev-sandboxes.
    • Actions now also run on merges into the production branch, and are replayed downstream when a retrofit branch brings a hotfix to another major branch.
    • Merging a feature branch now processes only the Pull Request just merged, while merges between major branches keep replaying the whole batch of upstream Pull Requests.
    • Fix actions never running on GitHub push-triggered deployment jobs.
    • A failed action displays why it failed, in the job log and in the Pull Request comment. Actions whose command ends with --json used to fail with no output at all.
    • Manual actions are reported as waiting for manual execution and keep their markdown formatting, and distinct actions sharing the same label are flagged instead of looking like a duplicated row.
  • Pull Request comments are much easier to read:
    • A colored banner at the top of each comment says which of the three comments you are reading (Validation, Deployment, Deployment Actions) and how it went.
    • A navigation line links the three comments together, and the same navigation is added at the top of the Pull Request description.
    • The Deployment Actions comment shows a status matrix (one row per action, one column per org branch), a pending manual actions checklist, a legend and a last-updated date.
    • Manual actions can be marked as done by ticking their checkbox in any comment: the next job records them for the org branch and ticks the same checkbox everywhere else.
    • Comments only mention what they actually contain, say which Pull Requests the deployment actions and Apex test classes come from, and explain when Quick Deploy applies, so "Apex tests: none run" on a merge job is no longer a surprise.
    • The commits summary is collapsed by default, hides technical merge commits and truncates very long commit bodies. The Tickets section warns when ticket details could not be retrieved from JIRA.
    • Fix the deployment comment displaying no banner and no result title when the deployment used Quick Deploy: a successful Quick Deploy recorded no deployment status, so the comment stayed in its "waiting for a result" state.
    • A deployment that succeeds now displays success alone: when a job is run again after a failure, for example once a manual action has been performed, the failure title and the failure banner of the previous attempt are replaced instead of being kept.
    • Set SFDX_HARDIS_PR_COMMENT_BANNERS=false, SFDX_HARDIS_PR_COMMENT_NAV=false or SFDX_HARDIS_PR_DESCRIPTION_NAV=false to opt out of banners and navigation.
  • hardis:project:deploy:smart:
    • Delete the Flows listed in destructive changes: they are removed from the manifest sent to the org and deleted through the Tooling API (deactivate, then delete every version), because a Flow deletion can neither be validated by a --check deployment nor survive a Quick Deploy. A --check reports the deletion plan in the Pull Request comment, and fails if Flow Interviews block a deletion.
    • New FLOW_DELETE_INTERVIEWS Pull Request keyword and flowDeleteInterviews property, to authorize deleting the Flow Interviews that block a Flow deletion.
      Caution: deleting Flow Interviews is irreversible and destroys in-flight process state.
    • Warn before deploying when the package lists the same Report or Dashboard API name under several folders: their API name is unique in the whole org, so the org keeps a single component and moves it at every deployment.
    • CI logs display a readable deployment summary instead of the complete deployment JSON, which is published as a CI job artifact.
  • hardis:work:save:
    • New Update the Deployment Actions of your Pull Request button at the end of the command, opening the DevOps Pipeline on the deployment actions of your branch. Requires VS Code extension sfdx-hardis v7.19.0 or later.
    • When a Pull Request is already open between your branch and its target branch, propose to Update Pull Request and link to it, instead of proposing to create a new one.
  • hardis:org:purge:flow: Flow version deletion is much faster, with far fewer API calls.
  • package-no-overwrite.xml: Fix Reports and Dashboards being overwritten when the target org holds them in another folder than the sources, as their API name is unique in the whole org.
  • Azure DevOps: Fix the links to Pull Requests, which opened the raw JSON of the REST API response instead of the Pull Request page.
  • Deployment logs explain what each filtering step means: what changed between the compared commits, what is protected because it already exists in the target org, and how many items of each type are skipped versus deployed. The really final package.xml is now displayed after the package-no-overwrite filtering.
  • A destructive changes manifest configured but missing on disk now logs a warning, instead of being skipped silently.
  • The two CI/CD jobs are now consistently called the validation job and the deployment job, in job logs, Pull Request comments and documentation. Existing configurations keep working without any update.
  • The default GitHub Actions, Azure Pipelines and Bitbucket Pipelines workflows (CI/CD and Org Monitoring) now run in the sfdx-hardis Docker image, like GitLab always did: jobs no longer install Node.js, the Salesforce CLI and its plugins at every run, so they start faster and can no longer be broken by a bad release of a dependency. Existing pipelines keep working, as the templates only apply when initializing a new project or monitoring repository.
  • To let the pipeline auto-fix deployment errors with coding agents, switch to the ghcr.io/hardisgroupcom/sfdx-hardis-ubuntu-with-agents:latest image instead of uncommenting npm install lines.
  • Docker images are published to GitHub Container Registry (ghcr.io/hardisgroupcom/sfdx-hardis, the recommended default, whose publication does not rely on any long-lived token) and mirrored on Docker Hub.
  • New CI/CD Setup Checklist page, to verify that a CI/CD setup is complete: what to do before the initialization merge request, what to check after it, and the integrations grouped by platform.
  • New documentation page explaining how to add the hardis-report artifacts upload step to existing GitHub, GitLab, Azure, Bitbucket or Jenkins pipelines.
Org Monitoring & Grafana
  • New hardis:org:diagnose:usage-entitlements: Monitor usage-based entitlements like Einstein Requests, Flex Credits, Data 360 credits and API calls, and warn when consumption is on track to exceed the allowance before the end of the billing period.
  • New hardis:org:diagnose:consumption-alerts: Report the consumption and license utilization alerts Salesforce raises on the org.
  • New hardis:org:diagnose:ai-usage: Break down Agentforce and Data 360 credit consumption by agent and action (requires Data 360).
  • Declare your contracted rates in usageCost, and monitoring reports entitlement overage and Agentforce credits in your own currency, next to the percentages.
  • New "08 - Usage & Cost" Grafana dashboard, and a new "MFA readiness" section on the "05 - Security Posture" dashboard listing the privileged users who are not passkey-ready yet.
  • hardis:org:diagnose:mfa:
    • Fix privileged users and MFA-bypass users being missed when their permissions come from a Permission Set Group, which made them face the Salesforce passkey requirement without ever appearing in the report.
    • Report an error when neither built-in authenticators nor security keys are enabled in the org, because no user can then register the phishing-resistant method Salesforce requires.
  • hardis:org:diagnose:audittrail: New monitoringAllowedUsersActions property to allow expected actions for specific users, like an integration user whose portal provisioning automatically creates account roles. Any other action from the same user is still flagged as suspect.
  • hardis:org:user:unlink-security-key: Notifications and reports show who triggered the run.
Documentation
  • The Salesforce CI/CD documentation is reorganized for v8: the overview page presents the contribution workflow from User Story to production, and the Contributor, Release Manager and Setup guides get their own overview pages and numbered steps.
  • Every VS Code extension screenshot and animation is refreshed with the new design of the extension, with sample data modeled on real projects. The animations are 10 to 100 times lighter than before, so the pages displaying them load much faster.
  • The deployment actions guide is rewritten for end users, with one illustrated section per action type and the YAML reference moved into collapsible technical sections.
  • VS Code extension: Document the DevOps Pipeline view, the Org Monitoring Workbench and the command execution panel.
  • Redraw the CI/CD schemas of the Release and Delta-deployment pages, and update the events list with the latest talks and photos.
Sandbox Refresh
  • hardis:org:refresh:before-refresh:
    • List the Connected Apps not yet converted to External Client Apps, and pause so they can be converted before the refresh.
    • Generate one Apex script per user to reschedule Scheduled Apex jobs with their original owners, to run with "Login As" + Execute Anonymous.
    • Keep selections and action reports separate for each sandbox, so preparing several refreshes no longer overwrites each other's choices.
    • No longer fail on Connected Apps that cannot be retrieved, like external OAuth apps (OwnBackup and other tools connected via "Log in with Salesforce"): their re-authentication needs are captured and displayed later as a manual actions checklist.
  • hardis:org:refresh:after-refresh:
    • Detect the restore steps already performed by a previous run, and ask for confirmation before doing them again.
    • When a metadata restore fails, list the components rejected by the org with their error, so they can be removed from package-metadata-to-restore.xml before running the command again.
Core
  • Commands start faster in VS Code: they connect to the extension about 5 seconds earlier, so the command panel opens right after the click, and the upgrade check no longer delays startup.
  • VS Code UI: log lines, tables and command outputs displayed right after a prompt are no longer hidden, and tables that can hold more than 20 rows always come with a CSV/XLSX report.
  • hardis:org:data:import, hardis:org:data:export and hardis:org:data:delete:
    • Follow the real progress of SFDMU jobs (phase, object, records processed and failed, Bulk job id) instead of a progress bar stuck at "almost done" for the whole data load.
    • Display what the SFDMU workspace will do, object by object, and ask for confirmation before touching any data.
  • hardis:project:clean:profiles-extract:
    • Much faster extraction, with a progress bar in VS Code.
    • The SObject selection is remembered between runs and proposed as the default selection on the next one.
    • Items are sorted alphabetically in every sheet of the XLSX report, and profile field access is limited to profiles of active users.
  • Fix the project name prompt, whose answer was not awaited: projectName and devHubAlias were written to .sfdx-hardis.yml as [object Promise] the first time a command asked for them.
Technical
  • Behavior changes to check before upgrading:
    • Post-deployment actions are no longer run when the metadata deployment failed. They are reported as not run in the Pull Request comment, and the job fails on the deployment error. The skipIfError property is removed, and ignored if still present in your configuration.
    • packageXmlToDeploy, packageXmlToDelete and packageXmlToDeletePreDeploy are no longer ignored. A bug made the default manifest/ and config/ paths always win, so a project pointing to a custom destructive manifest could delete nothing at all and still exit with success. These properties (and the --packagexml flag) are now honored, which can deploy and delete a different set of metadata than in your previous runs.
    • A Flow listed in destructive changes is no longer deleted inside the deployment transaction. Its deactivation and its deletion are committed on their own, so a deployment that fails leaves the Flow deactivated or deleted instead of rolling it back. Every step is re-runnable, so retrying the pipeline converges.
    • --check no longer validates Flow destructive members against the org. A Flow missing from the target org, a typo included, is reported as FLOW_DELETE_NOOP and passes, because the same destructive changes are replayed along the promotion chain.
    • Connected Apps can no longer be restored after a sandbox refresh. Convert them to External Client Apps before refreshing: before-refresh now lists the ones left to convert and pauses.
  • Reduce the npm dependency tree by ~20% (14 packages removed, among which axios, xml2js, openai, cloudflare and md-to-pdf), with no functional change: fewer transitive packages to trust and to audit, so a smaller supply-chain attack surface, and fewer packages to download, so a faster install of the plugin and of the Docker images.
  • Upgrade puppeteer-core to 25.6.0, which drops the unmaintained and vulnerable extract-zip transitive dependency (GHSA-jmr9-qjv8-65gv, CVE-2026-56876), and MegaLinter to v10.
  • .sfdx-hardis.yml schema fixes, so validation and autocompletion match what the commands accept: commandsPostDeploy accepts the schedule-batch action type, whose className, cronExpression and jobName parameters are now declared.
  • New flowDeleteMaxAttempts and flowDeleteRetryDelayMs properties (and their env variables) to tune how many times a Flow version deletion is retried when a Flow Interview still blocks it, and how long to wait between attempts.
  • New SFDX_HARDIS_DEPLOY_CHECK_ID env variable to force the Quick Deploy job id instead of reading it from Pull Request comments.
  • The ubuntu Docker images now include sudo, so custom steps added to Azure Pipelines container jobs (which run as a non-root user) can elevate privileges when they need to.
  • Job logs are lighter: the resolved Pull Request scope on a single line, a major orgs table instead of a raw JSON dump of every branch configuration, provider fetch internals kept out of the UI log, and repeated JIRA errors aggregated into a single warning.
  • Plugin API: bulkDeleteTooling now always returns { results: [{ Id, success, errors }] }, and the CSV/XLSX reports of the Bulk API helpers are written in the reports directory like every other report.
  • Fix a misleading "Image file not found" warning displayed for remote image URLs used in Pull Request comments.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Sep 2, 2026
@renovate
renovate Bot requested a review from Kurt-von-Laven as a code owner September 2, 2026 10:33
@github-actions

github-actions Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

⚠️MegaLinter analysis: Success with warnings

⚠️ PYTHON / bandit - 197 errors
hell_equals_true] subprocess call - check for execution of untrusted input.
   Severity: Low   Confidence: High
   CWE: CWE-78 (https://cwe.mitre.org/data/definitions/78.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b603_subprocess_without_shell_equals_true.html
   Location: ./megalinter/utils_reporter.py:406:18
405	    try:
406	        process = subprocess.run(
407	            sarif_fmt_command,
408	            stdout=subprocess.PIPE,
409	            stderr=subprocess.STDOUT,
410	            text=True,
411	            input=sarif_in + "\n",
412	            env=config.build_env(request_id),
413	        )
414	        return_code = process.returncode

--------------------------------------------------
>> Issue: [B113:request_without_timeout] Call to requests without timeout
   Severity: Medium   Confidence: Low
   CWE: CWE-400 (https://cwe.mitre.org/data/definitions/400.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b113_request_without_timeout.html
   Location: ./megalinter/utils_reporter.py:572:19
571	    try:
572	        response = requests.post(
573	            hook_url,
574	            headers=build_webhook_headers(reporter.master.request_id),
575	            json=payload,
576	        )
577	        if 200 <= response.status_code < 299:

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: ./megalinter/utils_sarif.py:156:61
155	                        rule["id"] = (
156	                            rule["id"] + "_DUPLICATE_" + str(random.randint(1, 99999))
157	                        )

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:127:4
126	    )
127	    assert os.path.isdir(config.get(request_id, "DEFAULT_WORKSPACE")), (
128	        "DEFAULT_WORKSPACE "
129	        + config.get(request_id, "DEFAULT_WORKSPACE")
130	        + " is not a valid folder"
131	    )
132	

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:172:4
171	    tmp_report_folder = tempfile.gettempdir() + os.path.sep + str(uuid.uuid4())
172	    assert os.path.isdir(workspace), f"Test folder {workspace} is not existing"
173	    linter_name = linter.linter_name

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:246:4
245	    tmp_report_folder = tempfile.gettempdir() + os.path.sep + str(uuid.uuid4())
246	    assert os.path.isdir(workspace), f"Test folder {workspace} is not existing"
247	    if os.path.isfile(workspace + os.path.sep + "no_test_failure"):

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:495:4
494	    )
495	    assert os.path.isdir(workspace), f"Test folder {workspace} is not existing"
496	    expected_file_name = ""

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:595:4
594	        workspace += os.path.sep + "bad"
595	    assert os.path.isdir(workspace), f"Test folder {workspace} is not existing"
596	    # Call linter

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:695:4
694	        workspace = workspace + os.path.sep + "fix"
695	    assert os.path.isdir(workspace), f"Test folder {workspace} is not existing"
696	

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:801:12
800	            ]
801	            assert (len(list(diffs))) > 0, f"No changes in the {file} file"
802	

--------------------------------------------------
>> Issue: [B108:hardcoded_tmp_directory] Probable insecure usage of temp file/directory.
   Severity: Medium   Confidence: Medium
   CWE: CWE-377 (https://cwe.mitre.org/data/definitions/377.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html
   Location: ./server/server.py:81:42
80	    if item.fileUploadId:
81	        uploaded_file_path = os.path.join("/tmp/server-files", item.fileUploadId)
82	        if not os.path.isdir(uploaded_file_path):

--------------------------------------------------
>> Issue: [B108:hardcoded_tmp_directory] Probable insecure usage of temp file/directory.
   Severity: Medium   Confidence: Medium
   CWE: CWE-377 (https://cwe.mitre.org/data/definitions/377.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html
   Location: ./server/server.py:103:38
102	    file_upload_id = "FILE_" + str(uuid1())
103	    uploaded_file_path = os.path.join("/tmp/server-files", file_upload_id)
104	    os.makedirs(uploaded_file_path)

--------------------------------------------------
>> Issue: [B108:hardcoded_tmp_directory] Probable insecure usage of temp file/directory.
   Severity: Medium   Confidence: Medium
   CWE: CWE-377 (https://cwe.mitre.org/data/definitions/377.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html
   Location: ./server/server_worker.py:102:34
101	        temp_dir = self.create_temp_dir()
102	        upload_dir = os.path.join("/tmp/server-files", file_upload_id)
103	        if os.path.exists(upload_dir):

--------------------------------------------------

Code scanned:
	Total lines of code: 30549
	Total lines skipped (#nosec): 0
	Total potential issues skipped due to specifically being disabled (e.g., #nosec BXXX): 0

Run metrics:
	Total issues (by severity):
		Undefined: 0
		Low: 130
		Medium: 59
		High: 8
	Total issues (by confidence):
		Undefined: 0
		Low: 44
		Medium: 40
		High: 113
Files skipped (0):

(Truncated to last 8000 characters out of 136301)
⚠️ SPELL / lychee - 57 errors
//pinterest.github.io/ktlint/latest/api/custom-rule-set/ (at 69:15) | Rejected status code: 404 Not Found
[404] https://pinterest.github.io/ktlint/latest/faq/#how-do-i-suppress-errors-for-a-lineblockfile (at 38:38) | Rejected status code: 404 Not Found
[404] https://pinterest.github.io/ktlint/latest/rules/configuration-ktlint/ (at 37:37) | Rejected status code: 404 Not Found

Errors in megalinter/descriptors/kubernetes.megalinter-descriptor.yml
[404] https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/%7B%7B.Group%7D%7D/%7B%7B.ResourceKind%7D%7D_%7B%7B.ResourceAPIVersion%7D%7D.json (at 72:22) | Rejected status code: 404 Not Found

Errors in megalinter/descriptors/latex.megalinter-descriptor.yml
[TIMEOUT] https://www.nongnu.org/chktex (at 26:17) | Request timed out
[TIMEOUT] https://www.nongnu.org/chktex/ (at 29:23) | Request timed out
[TIMEOUT] https://www.nongnu.org/chktex/ (at 31:38) | Request timed out

Errors in megalinter/descriptors/markdown.megalinter-descriptor.yml
[403] https://www.npmjs.com/package/markdown-table-formatter (at 103:17) | Rejected status code: 403 Forbidden

Errors in megalinter/descriptors/repository.megalinter-descriptor.yml
[404] https://raw.githubusercontent.com/oxsecurity/megalinter/main/docs/assets/icons/linters/betterleaks.png (at 297:26) | Rejected status code: 404 Not Found

Errors in megalinter/descriptors/rst.megalinter-descriptor.yml
[403] https://docutils.sourceforge.io/docs/ref/rst/directives.html#raw-data-pass-through (at 34:38) | Rejected status code: 403 Forbidden

Errors in megalinter/descriptors/salesforce.megalinter-descriptor.yml
[403] https://developer.salesforce.com/docs/platform/salesforce-cli-reference/guide/cli_reference_org_display.html (at 174:185) | Rejected status code: 403 Forbidden
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/config.html (at 188:37) | Rejected status code: 403 Forbidden
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/config.html (at 501:37) | Error (cached)
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/engine-apexguru.html (at 185:17) | Rejected status code: 403 Forbidden
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/engine-apexguru.html (at 187:23) | Rejected status code: 403 Forbidden
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/engine-flow.html (at 498:17) | Rejected status code: 403 Forbidden
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/get-started.html (at 303:17) | Error (cached)
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/get-started.html (at 403:17) | Error (cached)
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/get-started.html (at 74:17) | Rejected status code: 403 Forbidden
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/rules-flow.html (at 500:23) | Rejected status code: 403 Forbidden
[TIMEOUT] https://docs.pmd-code.org/latest/pmd_rules_apex.html (at 76:23) | Request timed out
[TIMEOUT] https://docs.pmd-code.org/latest/pmd_userdocs_making_rulesets.html (at 77:37) | Request timed out
[TIMEOUT] https://docs.pmd-code.org/latest/pmd_userdocs_suppressing_warnings.html (at 78:38) | Request timed out

Errors in megalinter/descriptors/shared/biome.megalinter-linter.yml
[404] https://biomejs.dev/linter/rules/ (at 21:19) | Rejected status code: 404 Not Found

Errors in megalinter/descriptors/shared/cppcheck.megalinter-linter.yml
[403] https://cppcheck.sourceforge.io/ (at 3:13) | Rejected status code: 403 Forbidden
[403] https://cppcheck.sourceforge.io/ (at 4:14) | Rejected status code: 403 Forbidden
[403] https://cppcheck.sourceforge.io/manual.html#configuration (at 8:33) | Rejected status code: 403 Forbidden

Errors in megalinter/descriptors/spell.megalinter-descriptor.yml
[404] https://vale.sh/docs/topics/vocab/ (at 190:38) | Rejected status code: 404 Not Found | Followed 2 redirects. Redirects: https://vale.sh/docs/topics/vocab/ --[301]--> https://docs.vale.sh/topics/vocab/ --[302]--> https://docs.vale.sh/topics/vocab
[404] https://vale.sh/docs/vale-cli/structure/ (at 183:95) | Rejected status code: 404 Not Found | Followed 2 redirects. Redirects: https://vale.sh/docs/vale-cli/structure/ --[301]--> https://docs.vale.sh/vale-cli/structure/ --[302]--> https://docs.vale.sh/vale-cli/structure

Errors in megalinter/descriptors/tsx.megalinter-descriptor.yml
[404] https://eslint-react.xyz/docs/getting-started/installation (at 81:37) | Rejected status code: 404 Not Found

Errors in megalinter/descriptors/xml.megalinter-descriptor.yml
[406] https://gitlab.gnome.org/GNOME/libxml2/-/wikis/home (at 38:17) | Rejected status code: 406 Not Acceptable

Errors in README.md
[ERROR] https://ampcode.com/ (at 248:1) | HTTP/2 protocol error. Server may not support HTTP/2 properly
[301] https://future-architect.github.io/authors/%E5%AE%AE%E6%B0%B8%E5%B4%87%E5%8F%B2 (at 2034:104) | Rejected status code: 301 Moved Permanently
[TIMEOUT] https://generated.at/ (at 1370:301) | Request timed out
[404] https://github.com/oxsecurity/megalinter/stargazers (at 2200:3) | Rejected status code: 404 Not Found
[404] https://github.com/oxsecurity/megalinter/stargazers/ (at 23:1) | Rejected status code: 404 Not Found
[403] https://javascript.plainenglish.io/node-js-coding-standard-tools-with-megalinter-on-gitlab-ci-a43b55915811 (at 2017:3) | Rejected status code: 403 Forbidden
[403] https://medium.com/@caodanju/30-seconds-to-setup-megalinter-your-go-to-tool-for-automated-code-quality-and-iac-security-969d90a5a99c (at 2002:3) | Rejected status code: 403 Forbidden
[403] https://medium.com/@SeasonedDeveloper/looking-for-the-best-ci-cd-pipeline-linting-tool-try-megalinter-d89c9eba850d (at 1998:3) | Rejected status code: 403 Forbidden
[403] https://medium.com/datamindedbe/integrating-megalinter-to-automate-linting-across-multiple-codebases-a-technical-description-a200bb235b71 (at 1999:3) | Rejected status code: 403 Forbidden
[403] https://nicolas.vuillamy.fr/improve-uniformize-and-secure-your-code-base-with-megalinter-62ebab422c1 (at 2020:3) | Rejected status code: 403 Forbidden
[403] https://nicolas.vuillamy.fr/megalinter-sells-his-soul-and-joins-ox-security-2a91a0027628 (at 2019:3) | Rejected status code: 403 Forbidden
[403] https://nklya.medium.com/ (at 2016:255) | Rejected status code: 403 Forbidden
[403] https://nklya.medium.com/hot-to-linter-basic-things-like-trailing-whitespaces-and-newlines-7b40da8f688d (at 2016:3) | Rejected status code: 403 Forbidden
[403] https://npmjs.org/package/mega-linter-runner (at 1285:1) | Error (cached)
[403] https://npmjs.org/package/mega-linter-runner (at 1286:1) | Error (cached)
[403] https://npmjs.org/package/mega-linter-runner (at 1287:1) | Error (cached)
[403] https://npmjs.org/package/mega-linter-runner (at 21:1) | Rejected status code: 403 Forbidden | Followed 1 redirect. Redirects: https://npmjs.org/package/mega-linter-runner --[301]--> https://www.npmjs.com/package/mega-linter-runner
[403] https://openai.com/codex/ (at 240:1) | Rejected status code: 403 Forbidden
[403] https://pmd.sourceforge.io/pmd-6.55.0/pmd_userdocs_tools_ci.html (at 2105:3) | Error (cached)
[TIMEOUT] https://www.neosoft.fr/nos-publications/blog-tech/mega-linter-votre-meilleur-ami-pour-un-code-de-qualite/?utm_source=twitter&utm_medium=organic&utm_campaign=article-mega-linter (at 2028:3) | Request timed out
[403] https://www.npmjs.com/package/@downatthebottomofthemolehole/megalinter-mcp-server (at 1976:354) | Rejected status code: 403 Forbidden

Hint: Followed 772 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: Rejected redirectional status codes. This means some redirects were not followed. You might want to increase the limit for `-m`/`--max-redirects`.

(Truncated to last 8000 characters out of 33802)
⚠️ MARKDOWN / markdownlint - 353 errors
in the same document [Context: "Docker container"]
docs/install-drone.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Drone CI"]
docs/install-github.md:10 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "GitHub Action"]
docs/install-gitlab.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "GitLab CI"]
docs/install-jenkins.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Jenkins"]
docs/install-jenkins.md:40 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "PR Comment Reporting from Jenk..."]
docs/install-locally.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Run MegaLinter locally"]
docs/install-version.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Which version to use ?"]
docs/license-explanations.md:7 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Why AGPL V3 License ?"]
docs/mega-linter-vs-super-linter.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "MegaLinter vs Super-Linter"]
docs/plugins.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Plugins"]
docs/quick-start.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Quick Start"]
docs/removed-linters.md:9 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Removed linters"]
docs/reporters.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Reporters"]
docs/reporters/AzureCommentReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Azure Comment Reporter"]
docs/reporters/BitbucketCommentReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Bitbucket Comment Reporter"]
docs/reporters/ConfigReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "IDE Configuration Reporter"]
docs/reporters/ConsoleReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Console Reporter"]
docs/reporters/EmailReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "E-mail Reporter"]
docs/reporters/FileIoReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "File.io Reporter"]
docs/reporters/GitHubCommentReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "GitHub Comment Reporter"]
docs/reporters/GitHubCommentReporter.md:27:196 error MD056/table-column-count Table column count [Expected: 4; Actual: 3; Too few cells, row will be missing data]
docs/reporters/GitHubCommentReporter.md:27:46 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:27:174 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:27:196 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:28:179 error MD056/table-column-count Table column count [Expected: 4; Actual: 3; Too few cells, row will be missing data]
docs/reporters/GitHubCommentReporter.md:28:46 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:28:160 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:28:179 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:29:159 error MD056/table-column-count Table column count [Expected: 4; Actual: 3; Too few cells, row will be missing data]
docs/reporters/GitHubCommentReporter.md:29:48 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:29:143 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:29:159 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:30:171 error MD056/table-column-count Table column count [Expected: 4; Actual: 3; Too few cells, row will be missing data]
docs/reporters/GitHubCommentReporter.md:30:46 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:30:152 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:30:171 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubStatusReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "GitHub Status Reporter"]
docs/reporters/GitlabCommentReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Gitlab Comment Reporter"]
docs/reporters/JsonReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "JSON Reporter"]
docs/reporters/MarkdownSummaryReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Markdown Summary Reporter"]
docs/reporters/SarifReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "SARIF Reporter (beta)"]
docs/reporters/TapReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "TAP Reporter"]
docs/reporters/TextReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Text Reporter"]
docs/reporters/UpdatedSourcesReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Updated Sources Reporter"]
docs/special-thanks.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Special thanks"]
docs/special-thanks.md:23:3 error MD045/no-alt-text Images should have alternate text (alt text)
docs/sponsor.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Sponsoring"]
docs/supported-linters.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Supported Linters"]
mega-linter-runner/README.md:27:274 error MD051/link-fragments Link fragments should be valid [Context: "[**apply formatting and auto-fixes**](#apply-fixes)"]
mega-linter-runner/README.md:27:217 error MD051/link-fragments Link fragments should be valid [Context: "[**reports in several formats**](#reports)"]
README.md:220:127 error MD051/link-fragments Link fragments should be valid [Context: "[many additional features](#mega-linter-vs-super-linter)"]
README.md:2227:3 error MD045/no-alt-text Images should have alternate text (alt text)
skills/megalinter-check/performance.md:27:601 error MD013/line-length Line length [Expected: 600; Actual: 713]
skills/megalinter-setup/agents/megalinter-runner.md:33:601 error MD013/line-length Line length [Expected: 600; Actual: 620]

(Truncated to last 8000 characters out of 46725)
⚠️ YAML / prettier - 14 errors
roselint/Hedging.yml 3ms (unchanged)
.github/linters/valestyles/proselint/Hyperbole.yml 2ms (unchanged)
.github/linters/valestyles/proselint/Jargon.yml 2ms (unchanged)
.github/linters/valestyles/proselint/LGBTOffensive.yml 1ms (unchanged)
.github/linters/valestyles/proselint/LGBTTerms.yml 2ms (unchanged)
.github/linters/valestyles/proselint/Malapropisms.yml 2ms (unchanged)
.github/linters/valestyles/proselint/Needless.yml 37ms (unchanged)
.github/linters/valestyles/proselint/Nonwords.yml 4ms (unchanged)
.github/linters/valestyles/proselint/Oxymorons.yml 3ms (unchanged)
.github/linters/valestyles/proselint/P-Value.yml 1ms (unchanged)
.github/linters/valestyles/proselint/RASSyndrome.yml 4ms (unchanged)
.github/linters/valestyles/proselint/Skunked.yml 1ms (unchanged)
.github/linters/valestyles/proselint/Spelling.yml 2ms (unchanged)
.github/linters/valestyles/proselint/Typography.yml 3ms (unchanged)
.github/linters/valestyles/proselint/Uncomparables.yml 4ms (unchanged)
.github/linters/valestyles/proselint/Very.yml 6ms (unchanged)
.github/release-drafter.yml 11ms (unchanged)
.grype.yaml 3ms (unchanged)
.mega-linter.yml 12ms (unchanged)
.pre-commit-hooks.yaml 9ms (unchanged)
action.yml 5ms (unchanged)
codecov.yml 2ms (unchanged)
mega-linter-runner/.eslintrc.yml 3ms (unchanged)
mega-linter-runner/.mega-linter.yml 7ms (unchanged)
mega-linter-runner/generators/mega-linter-custom-flavor/templates/action.yml 4ms (unchanged)
mega-linter-runner/generators/mega-linter-custom-flavor/templates/check-new-megalinter-version.yml 17ms (unchanged)
mega-linter-runner/generators/mega-linter-custom-flavor/templates/megalinter-custom-flavor-builder.yml 21ms (unchanged)
[error] mega-linter-runner/generators/mega-linter-custom-flavor/templates/megalinter-custom-flavor.yml: SyntaxError: Implicit map keys need to be followed by map values (6:1)
[error]   4 | label: <%= CUSTOM_FLAVOR_LABEL %>
[error]   5 | linters:
[error] > 6 | <%= CUSTOM_FLAVOR_LINTERS %>
[error]     | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[error]   7 |
mega-linter-runner/generators/mega-linter-custom-flavor/templates/zizmor.yml 3ms (unchanged)
mega-linter-runner/generators/mega-linter/templates/.drone.yml 5ms (unchanged)
mega-linter-runner/generators/mega-linter/templates/.gitlab-ci.yml 7ms (unchanged)
mega-linter-runner/generators/mega-linter/templates/azure-pipelines.yml 11ms (unchanged)
mega-linter-runner/generators/mega-linter/templates/bitbucket-pipelines.yml 3ms (unchanged)
mega-linter-runner/generators/mega-linter/templates/concourse-task.yml 6ms (unchanged)
[error] mega-linter-runner/generators/mega-linter/templates/mega-linter.yml: SyntaxError: Implicit map keys need to be followed by map values (67:11)
[error]   65 |           # Only define `secrets.PAT` if you fully understand the trade-off.
[error]   66 |           token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
[error] > 67 |           <%- PERSIST_CREDENTIALS %>
[error]      |           ^^^^^^^^^^^^^^^^^^^^^^^^^^
[error]   68 |
[error]   69 |           # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to
[error]   70 |           # improve performance
megalinter/descriptors/action.megalinter-descriptor.yml 15ms (unchanged)
megalinter/descriptors/ansible.megalinter-descriptor.yml 8ms (unchanged)
megalinter/descriptors/api.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/arm.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/bash.megalinter-descriptor.yml 21ms (unchanged)
megalinter/descriptors/bicep.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/c.megalinter-descriptor.yml 3ms (unchanged)
megalinter/descriptors/clojure.megalinter-descriptor.yml 9ms (unchanged)
megalinter/descriptors/cloudformation.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/coffee.megalinter-descriptor.yml 8ms (unchanged)
megalinter/descriptors/copypaste.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/cpp.megalinter-descriptor.yml 3ms (unchanged)
megalinter/descriptors/csharp.megalinter-descriptor.yml 9ms (unchanged)
megalinter/descriptors/css.megalinter-descriptor.yml 14ms (unchanged)
megalinter/descriptors/dart.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/dockerfile.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/editorconfig.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/env.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/gherkin.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/go.megalinter-descriptor.yml 11ms (unchanged)
megalinter/descriptors/graphql.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/groovy.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/html.megalinter-descriptor.yml 13ms (unchanged)
megalinter/descriptors/java.megalinter-descriptor.yml 17ms (unchanged)
megalinter/descriptors/javascript.megalinter-descriptor.yml 12ms (unchanged)
megalinter/descriptors/json.megalinter-descriptor.yml 11ms (unchanged)
megalinter/descriptors/jsx.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/kotlin.megalinter-descriptor.yml 9ms (unchanged)
megalinter/descriptors/kubernetes.megalinter-descriptor.yml 14ms (unchanged)
megalinter/descriptors/latex.megalinter-descriptor.yml 3ms (unchanged)
megalinter/descriptors/lua.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/markdown.megalinter-descriptor.yml 13ms (unchanged)
megalinter/descriptors/perl.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/php.megalinter-descriptor.yml 18ms (unchanged)
megalinter/descriptors/powershell.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/protobuf.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/python.megalinter-descriptor.yml 84ms (unchanged)
megalinter/descriptors/r.megalinter-descriptor.yml 10ms (unchanged)
megalinter/descriptors/raku.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/repository.megalinter-descriptor.yml 84ms (unchanged)
megalinter/descriptors/robotframework.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/rst.megalinter-descriptor.yml 9ms (unchanged)
megalinter/descriptors/ruby.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/rust.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/salesforce.megalinter-descriptor.yml 27ms (unchanged)
megalinter/descriptors/scala.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/shared/biome.megalinter-linter.yml 5ms (unchanged)
megalinter/descriptors/shared/clang-format.megalinter-linter.yml 4ms (unchanged)
megalinter/descriptors/shared/cppcheck.megalinter-linter.yml 4ms (unchanged)
megalinter/descriptors/shared/cpplint.megalinter-linter.yml 2ms (unchanged)
megalinter/descriptors/shared/dotnet-format.megalinter-linter.yml 2ms (unchanged)
megalinter/descriptors/shared/eslint.megalinter-linter.yml 5ms (unchanged)
megalinter/descriptors/shared/prettier.megalinter-linter.yml 3ms (unchanged)
megalinter/descriptors/shared/v8r.megalinter-linter.yml 3ms (unchanged)
megalinter/descriptors/snakemake.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/spell.megalinter-descriptor.yml 41ms (unchanged)
megalinter/descriptors/sql.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/swift.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/tekton.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/terraform.megalinter-descriptor.yml 31ms (unchanged)
megalinter/descriptors/tsx.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/typescript.megalinter-descriptor.yml 10ms (unchanged)
megalinter/descriptors/vbdotnet.megalinter-descriptor.yml 1ms (unchanged)
megalinter/descriptors/xml.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/yaml.megalinter-descriptor.yml 18ms (unchanged)
server/docker-compose-dev.yml 9ms (unchanged)
server/docker-compose.yml 3ms (unchanged)
trivy-secret.yaml 1ms (unchanged)
zizmor.yml 4ms (unchanged)

(Truncated to last 8000 characters out of 12557)
⚠️ YAML / yamllint - 53 errors
.grype.yaml
  6:1       warning  missing document start "---"  (document-start)

mega-linter-runner/.eslintrc.yml
  11:9      warning  too few spaces inside empty braces  (braces)

mega-linter-runner/generators/mega-linter-custom-flavor/templates/megalinter-custom-flavor-builder.yml
  48:15     warning  too few spaces inside empty braces  (braces)

mega-linter-runner/generators/mega-linter-custom-flavor/templates/megalinter-custom-flavor.yml
  7:1       error    syntax error: could not find expected ':' (syntax)

mega-linter-runner/generators/mega-linter/templates/mega-linter.yml
  38:15     warning  too few spaces inside empty braces  (braces)
  69:11     error    syntax error: could not find expected ':' (syntax)

megalinter/descriptors/copypaste.megalinter-descriptor.yml
  19:301    warning  line too long (313 > 300 characters)  (line-length)
  25:301    warning  line too long (384 > 300 characters)  (line-length)

megalinter/descriptors/javascript.megalinter-descriptor.yml
  52:301    warning  line too long (475 > 300 characters)  (line-length)
  328:301   warning  line too long (307 > 300 characters)  (line-length)
  354:301   warning  line too long (315 > 300 characters)  (line-length)

megalinter/descriptors/json.megalinter-descriptor.yml
  112:301   warning  line too long (315 > 300 characters)  (line-length)

megalinter/descriptors/jsx.megalinter-descriptor.yml
  29:301    warning  line too long (475 > 300 characters)  (line-length)

megalinter/descriptors/perl.megalinter-descriptor.yml
  25:301    warning  line too long (310 > 300 characters)  (line-length)

megalinter/descriptors/php.megalinter-descriptor.yml
  200:301   warning  line too long (389 > 300 characters)  (line-length)
  214:301   warning  line too long (302 > 300 characters)  (line-length)

megalinter/descriptors/repository.megalinter-descriptor.yml
  27:301    warning  line too long (666 > 300 characters)  (line-length)
  193:301   warning  line too long (408 > 300 characters)  (line-length)
  299:301   warning  line too long (345 > 300 characters)  (line-length)
  537:301   warning  line too long (306 > 300 characters)  (line-length)
  616:301   warning  line too long (374 > 300 characters)  (line-length)
  701:301   warning  line too long (316 > 300 characters)  (line-length)
  1038:301  warning  line too long (1263 > 300 characters)  (line-length)
  1135:301  warning  line too long (879 > 300 characters)  (line-length)
  1149:301  warning  line too long (358 > 300 characters)  (line-length)
  1212:301  warning  line too long (346 > 300 characters)  (line-length)
  1219:301  warning  line too long (307 > 300 characters)  (line-length)

megalinter/descriptors/salesforce.megalinter-descriptor.yml
  54:301    warning  line too long (359 > 300 characters)  (line-length)
  158:301   warning  line too long (390 > 300 characters)  (line-length)
  170:301   warning  line too long (408 > 300 characters)  (line-length)
  174:301   warning  line too long (413 > 300 characters)  (line-length)

megalinter/descriptors/spell.megalinter-descriptor.yml
  181:301   warning  line too long (315 > 300 characters)  (line-length)

megalinter/descriptors/sql.megalinter-descriptor.yml
  27:301    warning  line too long (403 > 300 characters)  (line-length)

megalinter/descriptors/terraform.megalinter-descriptor.yml
  28:301    warning  line too long (330 > 300 characters)  (line-length)
  43:301    warning  line too long (330 > 300 characters)  (line-length)
  97:301    warning  line too long (346 > 300 characters)  (line-length)
  164:301   warning  line too long (328 > 300 characters)  (line-length)
  239:301   warning  line too long (307 > 300 characters)  (line-length)
  250:301   warning  line too long (386 > 300 characters)  (line-length)
  304:301   warning  line too long (302 > 300 characters)  (line-length)
  319:301   warning  line too long (334 > 300 characters)  (line-length)
  329:301   warning  line too long (525 > 300 characters)  (line-length)
  339:301   warning  line too long (315 > 300 characters)  (line-length)
  343:301   warning  line too long (436 > 300 characters)  (line-length)

megalinter/descriptors/tsx.megalinter-descriptor.yml
  29:301    warning  line too long (475 > 300 characters)  (line-length)

megalinter/descriptors/typescript.megalinter-descriptor.yml
  39:301    warning  line too long (475 > 300 characters)  (line-length)
  318:301   warning  line too long (314 > 300 characters)  (line-length)
  344:301   warning  line too long (315 > 300 characters)  (line-length)

megalinter/descriptors/yaml.megalinter-descriptor.yml
  38:301    warning  line too long (315 > 300 characters)  (line-length)

mkdocs.yml
  8:301     warning  line too long (590 > 300 characters)  (line-length)
  86:5      warning  wrong indentation: expected 6 but found 4  (indentation)
  100:5     warning  wrong indentation: expected 6 but found 4  (indentation)

zizmor.yml
  1:1       warning  missing document start "---"  (document-start)

✅ Linters with no issues

actionlint, bash-exec, betterleaks, black, checkov, cspell, flake8, git_diff, grype, hadolint, isort, jscpd, jsonlint, markdown-table-formatter, mypy, npm-groovy-lint, osv-scanner, pylint, ruff, secretlint, shellcheck, shfmt, spectral, syft, trivy, trivy-sbom, trufflehog, v8r, v8r, xmllint, zizmor

See detailed reports in MegaLinter artifacts

MegaLinter is provided by OX Security
Show us your support by starring ⭐ the repository

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants