Download Latest Version v9.6.0 source code.zip (48.5 MB)
Email in envelope

Get an email when there's a new version of MegaLinter

Home / v9.6.0
Name Modified Size InfoDownloads / Week
Parent folder
README.md 2026-06-28 62.2 kB
0
v9.6.0 source code.tar.gz 2026-06-28 46.8 MB
0
v9.6.0 source code.zip 2026-06-28 48.5 MB
1 1 weekly downloads
Totals: 3 Items   95.4 MB 1

What's Changed

  • Breaking changes
  • Linters can no longer be run via a sibling Docker image at runtime. The cli_docker_image, cli_docker_image_version and cli_docker_args descriptor properties (and the matching <LINTER>_DOCKER_IMAGE_VERSION variable) have been removed, and MegaLinter no longer mounts /var/run/docker.sock (in mega-linter-runner, the GitHub Action action.yml files, and the Docker daemon previously bundled in flavor images). This closes the host-privilege escalation surface that the mounted Docker socket exposed. The only linter that used this mechanism was SWIFT_SWIFTLINT, now installed natively (see below). (#8216)
  • SWIFT_SWIFTLINT is now installed from the static swiftlint-static binary instead of running the ghcr.io/realm/swiftlint container. It runs natively on the Alpine image with no Docker socket required. SourceKit-dependent rules are disabled in this build and reported to the console when encountered; pure-syntax style rules are unaffected. (#8216)
  • @eslint/eslintrc shim removed from JavaScript/TypeScript/JSX/TSX Docker images (was only needed for legacy FlatCompat); MegaLinter's bundled test fixtures use native flat config. (#7869)
  • ESLint linters now force migration off .eslintrc.*: JAVASCRIPT_ES, TYPESCRIPT_ES, JSX_ESLINT, TSX_ESLINT activate when they find any eslint.config.* or any deprecated .eslintrc.* / package.json#eslintConfig. In the legacy case the linter does not call ESLint at all — it emits a single hard failure with a migration message so the build stays red until the config is migrated to flat config. See the ESLint flat-config migration guide. To opt out, set DISABLE_LINTERS or DISABLE to exclude the affected linter/descriptor. (#7869)

  • JSON_ESLINT_PLUGIN_JSONC removed: upstream bug [ota-meshi/eslint-plugin-jsonc#328](https://github.com/ota-meshi/eslint-plugin-jsonc/issues/328) blocks ESLint v10 compatibility and will not be fixed. Use JSON_JSONLINT, JSON_PRETTIER, or JSON_V8R for JSON validation instead. (#7869)

  • Core

  • New linter descriptor property common_linter_errors: declare known non-lint failure patterns (config issue, remote service down, missing credentials…) and the guidance message shown to users, directly in YAML — no custom Python class needed. (#7907)

  • Skipped-linters summary now explains why a linter was skipped by an activation rule, including the variable to set to activate it (e.g. MARKDOWN_RUMDL: MARKDOWN_DEFAULT_STYLE=markdownlint (set MARKDOWN_DEFAULT_STYLE=rumdl to activate)), fixing #8017.

  • New linters

  • Add betterleaks linter for repository secrets scanning — successor to gitleaks with higher recall (98.6% vs 70.4%), lower false-positive rates, and 4–5× faster scanning via BPE-based detection and CEL filter expressions (#8186)

  • Disabled linters

  • SALESFORCE_SFDX_SCANNER_APEX, SALESFORCE_SFDX_SCANNER_AURA and SALESFORCE_SFDX_SCANNER_LWC — disabled because sfdx-scanner 4.12.0 crashes on Node.js 22+ (TypeError: Cannot read properties of undefined (reading 'prototype'), caused by the removal of SlowBuffer.prototype), which is shipped with Alpine 3.24. These linters were already deprecated; use the SALESFORCE_CODE_ANALYZER_APEX / SALESFORCE_CODE_ANALYZER_AURA / SALESFORCE_CODE_ANALYZER_LWC variants instead (#8080).

  • Deprecated linters

  • REPOSITORY_GITLEAKS — deprecated in favour of REPOSITORY_BETTERLEAKS (same author, fully compatible config, significantly better detection). Will be removed in the next major release. Disable it by adding REPOSITORY_GITLEAKS to DISABLE_LINTERS in your .mega-linter.yml. (#8186)

  • Removed linters

  • JSON_ESLINT_PLUGIN_JSONC — permanently broken by upstream bug (see Breaking changes) (#7869)

  • Linters enhancements

  • REPOSITORY_CHECKOV: in pull-request mode, scan only the files modified in the PR instead of the whole repository (#7119)

  • Fixes

  • REPOSITORY_BETTERLEAKS: default scan now runs in filesystem (dir) mode instead of auto-switching to git-history (git) mode when a git repository is detected. betterleaks does not read the global git safe.directory config, so git mode failed with fatal: detected dubious ownership in repository in CI environments (e.g. GitHub Actions /github/workspace). Git-history mode is still used for the opt-in REPOSITORY_BETTERLEAKS_PR_COMMITS_SCAN feature. (#8186)
  • REPOSITORY_BETTERLEAKS: added --verbose so detected findings (file, line and rule) are reported instead of only the leaks found: N summary, matching gitleaks behavior. Secret values stay redacted via --redact. (#8186)
  • REPOSITORY_OSV_SCANNER: exit code 128 ("No package sources found") is now treated as a clean pass instead of a failure — osv-scanner returns this code when the repo contains no lockfiles/manifests/SBOMs, which is not a vulnerability finding (#7917).
  • Fix intermittent ansible-lint load-failure[not-found] error on github_conf/branch_protection_rules.json caused by a race condition with checkov running in parallel. Checkov's transient GitHub-conf directory is now written to a hidden path (.megalinter_github_conf) that project-mode linters skip, eliminating the conflict (#8092).
  • Complete the Alpine 3.24 upgrade across the whole image and fix how alpine version is detected. Docker images now build on the python:3.14-alpine3.24 base image (#8080).
  • Avoid DeprecationWarning / future breakage on Python 3.14 by no longer passing count and flags as positional arguments to re.sub (#8211).
  • Exclude REPORT_OUTPUT_FOLDER from linting when configured as an absolute path inside the workspace (e.g. /tmp/lint/megalinter-reports), fixing [#7845].
  • Fix command injection in Roslynator linter (DOTNET_ROSLYNATOR) where a crafted .csproj filename could break out of dotnet restore arguments and execute arbitrary shell commands. The command is now invoked via argv list instead of a shell string. Reported by Francesco Sabiu. (#7857)
  • Fix IndexError when building the single-linter Docker image for a linter whose activation depends on a file (e.g. SPELL_VALE requires .vale.ini): python -m megalinter.run --linterversion now bypasses activation filtering since the per-linter image is built for that linter unconditionally.
  • Fix make bootstrap appearing to hang because exported Make color variables re-evaluated tput during recursive make invocations. (#8090)
  • Allow MegaLinter containers to run in an opt-in non-root mode matching the host UID:GID on POSIX systems, avoiding root-owned generated files on the host (#1975).

  • Restore missing examples in the Dart descriptor that were dropped from the generated documentation (#7913).

  • Reporters

  • Update Bitbucket pipeline generator template to trigger builds on pull requests from any branch, by @yermulnik in https://github.com/oxsecurity/megalinter/pull/7421

  • Doc

  • Add pnpm installation and usage documentation for JavaScript and TypeScript linters (#8177)
  • Update Docker pull counters in README badges and flavors-stats.json with latest ghcr.io stats

  • Bump peter-evans/create-pull-request to v8 in the documented workflow examples (#8089)

  • mega-linter-runner

  • Add --user-map / --no-user-map to control whether the MegaLinter container runs in non-root mode. On POSIX systems --user-map uses the current host UID:GID; on other hosts it falls back to 1000:1000. (#8120)
  • Add --no-prompt flag to mega-linter-runner --upgrade for non-interactive upgrades (#8093)

  • Mark mega-linter-runner/index.js as executable in git (#8091)

  • Dev

  • Add specialized Claude Code sub-agents (pr-monitor, security-analyst, version-bumper) and assign cost-effective models to mechanical tasks, to speed up and reduce the token cost of contributor workflows (#7906).
  • Add the /fix-issue Claude Code skill for end-to-end GitHub issue fixes (gather context, implement on a branch, open a PR, watch CI) (#7848).
  • Stop generating per-linter Dockerfiles for linters marked disabled: true in their descriptor. The matching images were already excluded from the build matrix (linters_matrix.json) and never published, so the on-disk linters/<linter>/Dockerfile was dead code. Deleted the 8 corresponding stale Dockerfile directories.
  • Make the build's config-schema write atomic with a retry (write to a temp file then os.replace), so a transient file lock from an editor's JSON language server or antivirus no longer crashes the build with OSError: [Errno 22] on Windows.
  • Move the .devcontainer setup from the Dockerfile to a JSON configuration file (#7865).

  • Update the Python version in the devcontainer image (#7853).

  • CI

  • Build the real { linter, platform, runner } job list directly in get-linters-matrix for the DEV and BETA linter workflows, instead of a linter×runner cross-product filtered at runtime by job_enabled. Removes the Prepare step and the no-op jobs while preserving selection logic (#8133, [#8134]).
  • Track image-runtime shell scripts (setup-runtime-user, megalinter_exec) in the image-build path filters by renaming them to .sh, so changes to them correctly trigger image rebuilds; generated images now use root-independent command wrappers instead of shell aliases (#8213).
  • Suppress the new ref-version-mismatch audit introduced by zizmor 1.25.0 for the project's pinned uses: action references. The SHA pins are correct (the supply-chain property); only the inline # vX comments lag behind exact subversions, and renovate maintains the hashes.
  • Simplify the workflow trigger condition to prevent duplicate runs for pushes from forks.
  • Fix the deploy-dev workflow (#8154).
  • Remove unused QEMU setup from workflows (#8132).
  • Prevent FromAsCasing build warning in generated Dockerfiles (#8094).

  • Fix the documentation release workflow (#7837).

  • Linter versions upgrades (58)

  • bash-exec from 5.3.3 to 5.3.9
  • betterleaks from 1.5.0 to 1.6.0
  • bicep_linter from 0.43.8 to 0.44.1
  • black from 26.3.1 to 26.5.1
  • cfn-lint from 3.14 to 1.52.0
  • checkov from 3.2.529 to 3.3.2
  • clang-format from 21.1.2 to 22.1.3
  • clippy from 0.1.95 to 0.1.96
  • code-analyzer-apex from 5.12.0 to 5.13.0
  • code-analyzer-aura from 5.12.0 to 5.13.0
  • code-analyzer-lwc from 5.12.0 to 5.13.0
  • cppcheck from 2.18.3 to 2.21.0
  • cspell from 10.0.0 to 10.0.1
  • dartanalyzer from 3.11.6 to 3.12.2
  • djlint from 1.36.4 to 1.39.4
  • dotnet-format from 10.0.108 to 10.0.301
  • editorconfig-checker from 3.6.1 to 3.7.0
  • eslint from 10.3.0 to 10.5.0
  • git_diff from 2.52.0 to 2.54.0
  • grype from 0.112.0 to 0.115.0
  • jscpd from 4.1.1 to 5.0.11
  • kingfisher from 1.99.0 to 1.104.0
  • kubeconform from 0.7.0 to 0.8.0
  • kubescape from 4.0.8 to 4.0.9
  • markdownlint from 0.48.0 to 0.49.0
  • npm-package-json-lint from 10.4.0 to 10.4.1
  • php-cs-fixer from 3.95.2 to 3.95.11
  • phplint from 9.7.1 to 9.7.2
  • phpstan from 2.1.54 to 2.2.2
  • pmd from 7.24.0 to 7.25.0
  • powershell from 7.6.1 to 7.6.3
  • powershell_formatter from 7.6.1 to 7.6.3
  • prettier from 3.8.3 to 3.8.4
  • pylint from 4.0.5 to 4.0.6
  • pyright from 1.1.409 to 1.1.410
  • robocop from 8.2.8 to 8.3.2
  • rubocop from 1.86.2 to 1.88.0
  • ruff from 0.15.13 to 0.15.20
  • ruff-format from 0.15.13 to 0.15.20
  • rumdl from 0.1.93 to 0.2.24
  • scalafix from 0.14.6 to 0.14.7
  • semgrep from 1.163.0 to 1.168.0
  • snakefmt from 1.1.0 to 2.0.3
  • snakemake from 9.21.0 to 9.23.1
  • sqlfluff from 4.2.1 to 4.2.2
  • stylelint from 17.11.0 to 17.13.0
  • stylua from 2.4.1 to 2.5.2
  • swiftlint from 0.63.2 to 0.65.0
  • syft from 1.44.0 to 1.46.0
  • tekton-lint from 1.1.0 to 1.2.0
  • terraform-fmt from 1.15.2 to 1.15.6
  • terragrunt from 1.0.4 to 1.0.8
  • tflint from 0.62.1 to 0.63.1
  • trivy from 0.70.0 to 0.71.2
  • trivy-sbom from 0.70.0 to 0.71.2
  • trufflehog from 3.95.3 to 3.95.6
  • v8r from 6.0.0 to 6.1.0
  • vale from 3.14.2 to 3.15.1

Pull Requests

New Contributors

MegaLinter is graciously provided by OX Security

⭐ If MegaLinter is useful to you, please give it a star on GitHub, it helps the project a lot!

Full Changelog: https://github.com/oxsecurity/megalinter/compare/v9.5.0...v9.6.0

Source: README.md, updated 2026-06-28