MegaLinter Files

What's Changed

• Core
• Create your own Megalinter Custom Flavors to dramatically improve your performances
  • See documentation for usage
  • Use npx mega-linter-runner@beta --custom-flavor-setup to initialize repo
  • Suggest new flavors in reporters with a mega-linter-runner including the list of linters
• New LLM Advisor: call external LLMs to get hints to solve linter errors, available in:
  • Console Reporter
  • Text Reporter
  • Git platforms PR/MR comments Reporter
• Use ghcr.io docker images by default because of rate limits on docker.io
• Use uv to create the venv folder for pip-installed linters
• Add copilot instructions for GitHub Copilot

• Update base image to python:3.13-alpine3.21 (also embeds go 1.24)

• Disabled linters

• puppet-lint: Disabled Until fix is provided for https://github.com/puppetlabs/puppet-lint/issues/251

• checkov: Disabled until fix is provided for https://github.com/bridgecrewio/checkov/issues/7263

• Removed linters

• markdown-link-check has been removed because lychee can be used instead, and has much better performances

• Linters enhancements

• PHP-CS-Fixer is able to run on PHP 8.4 without error (change default configuration) by @llaville
• cspell: Filter output lines that do not contain found issues
• hadolint: Extend DOCKERFILE_HADOLINT_FILE_NAMES_REGEX to include the purpose.Dockerfile convention eg service.Dockerfile.

• sqlfluff: Handle fixing of issues

• Fixes

• When linter is docker based, force --platform=linux/amd64 so it works when running locally on Mac

• Added checking of *.pyi and *.ipynb files to the ruff and ruff-format linters

• Reporters

• New default display for Pull Request comments, with expandable sections containing the first 1000 lines of the output log. Former display remains available by defining REPORTERS_MARKDOWN_SUMMARY_TYPE=table
• Markdown summary reporter:
  • Write a file for Github integration if GITHUB_STEP_SUMMARY is set
  • Truncate less linter output lines
• Text reporter: Change the output file names to put the linter name first, then the status

• Enhance display of markdown summary

• Doc

• Update documentation in all megalinter descriptor files to improve accuracy and consistency
• Fix incorrect information in linters documentation and descriptors
• Remove dead links
• Add linter description (linter_text) in all linter descriptor, to generate a more exhaustive documentation.

• Update contributing guide to explain how to manage python dependencies in the codebase

• Flavors

• Do not suggest flavors that have more linters than the current one

• CI

• Update default MegaLinter CI/CD workflows to disable LLM_ADVISOR in case of bot pull requests

• mega-linter-runner

• Add all CI/CD providers in the --install command
• Use ghcr.io docker images by default
• New parameter --container-engine allowing to use podman as runner
• mega-linter-runner --upgrade: Handle upgrade of github actions to their latest version

• mega-linter-runner --upgrade: Upgrades MegaLinter actions and images to v9

• Linter versions upgrades (68)

• ansible-lint from 25.5.0 to 25.9.0
• bandit from 1.8.3 to 1.8.6
• bicep_linter from 0.36.1 to 0.37.4
• black from 25.1.0 to 25.9.0
• cfn-lint from 1.36.0 to 1.39.1
• checkstyle from 10.25.0 to 11.0.1
• clang-format from 19.1.4 to 20.1.8
• clippy from 0.1.87 to 0.1.90
• clj-kondo from 2025.06.05 to 2025.09.19
• csharpier from 1.0.2 to 1.1.2
• cspell from 9.1.1 to 9.2.1
• dartanalyzer from 3.8.1 to 3.8.3
• devskim from 1.0.59 to 1.0.67
• dotnet-format from 9.0.106 to 9.0.110
• editorconfig-checker from 3.3.0 to 3.4.0
• flake8 from 7.2.0 to 7.3.0
• git_diff from 2.47.2 to 2.49.1
• gitleaks from 8.27.2 to 8.28.0
• golangci-lint from 2.1.6 to 2.4.0
• grype from 0.94.0 to 0.100.0
• hadolint from 2.12.0 to 2.13.1
• helm from 3.16.3 to 3.18.4
• htmlhint from 1.5.1 to 1.7.1
• kics from 2.1.10 to 2.1.13
• ktlint from 1.6.0 to 1.7.1
• kubescape from 3.0.34 to 3.0.41
• lightning-flow-scanner from 3.23.0 to 3.29.0
• mypy from 1.16.0 to 1.18.2
• npm-groovy-lint from 15.2.0 to 15.2.1
• npm-package-json-lint from 8.0.0 to 9.0.0
• php-cs-fixer from 3.75.0 to 3.87.2
• phpcs from 3.13.1 to 4.0.0
• phpstan from 2.1.17 to 2.1.28
• pmd from 7.14.0 to 7.17.0
• powershell from 7.5.1 to 7.5.3
• powershell_formatter from 7.5.1 to 7.5.3
• prettier from 3.5.3 to 3.6.2
• protolint from 0.55.6 to 0.56.4
• psalm from Psalm.6.12.0@ to Psalm.6.13.1@
• pylint from 3.3.7 to 3.3.8
• pyright from 1.1.402 to 1.1.405
• revive from 1.10.0 to 1.12.0
• roslynator from 0.10.1.0 to 0.10.2.0
• rubocop from 1.76.1 to 1.80.2
• ruff-format from 0.11.13 to 0.13.1
• ruff from 0.11.13 to 0.13.1
• secretlint from 10.1.0 to 11.2.4
• selene from 0.28.0 to 0.29.0
• shellcheck from 0.10.0 to 0.11.0
• shfmt from 3.11.0 to 3.12.0
• snakefmt from 0.11.0 to 0.11.2
• snakemake from 9.5.1 to 9.11.4
• sqlfluff from 3.4.1 to 3.4.2
• stylelint from 16.20.0 to 16.24.0
• swiftlint from 0.59.1 to 0.61.0
• syft from 1.27.1 to 1.33.0
• terraform-fmt from 1.12.2 to 1.13.2
• terragrunt from 0.81.6 to 0.87.2
• tflint from 0.58.0 to 0.59.1
• trivy-sbom from 0.63.0 to 0.66.0
• trivy from 0.63.0 to 0.66.0
• trufflehog from 3.89.1 to 3.90.8
• v8r from 5.0.0 to 5.1.0
• vale from 3.11.2 to 3.12.0
• xmllint from 21304 to 21308

New Contributors

• @firedigger made their first contribution in https://github.com/oxsecurity/megalinter/pull/5870
• @dannystaple made their first contribution in https://github.com/oxsecurity/megalinter/pull/5934
• @pessi-v made their first contribution in https://github.com/oxsecurity/megalinter/pull/5987
• @fevrin made their first contribution in https://github.com/oxsecurity/megalinter/pull/6043
• @CraigCallender made their first contribution in https://github.com/oxsecurity/megalinter/pull/6186

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v8.8.0...v9.0.0