Skip to content

chore(deps): update all non-major dependencies#244

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#244
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/all-minor-patch

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented May 18, 2026 •
edited
Loading

This PR contains the following updates:

Package Type Update Change Age Confidence
actions/create-github-app-token action minor v3.1.1 → v3.2.0 age confidence
docker.io/library/python final patch 3.14.4-slim → 3.14.5-slim age confidence
github/codeql-action action patch v4.35.4 → v4.35.5 age confidence
oxsecurity/megalinter action minor v9.4.0 → v9.5.0 age confidence
step-security/harden-runner action patch v2.19.1 → v2.19.3 age confidence
zizmor (source) minor 1.24.1 → 1.25.2 age confidence

Release Notes

actions/create-github-app-token (actions/create-github-app-token)

v3.2.0

Compare Source

Features
Bug Fixes
github/codeql-action (github/codeql-action)

v4.35.5

Compare Source

  • We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #​3899
  • For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #​3791
  • If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #​3892
  • Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #​3880
oxsecurity/megalinter (oxsecurity/megalinter)

v9.5.0

Compare Source

Take 2 mn to read MegaLinter v9.5.0 announcements

  • Breaking changes

    • Docker images published only to GitHub Container Registry (ghcr.io) until OIDC-based publishing to Docker Hub is implemented. The Docker Hub registry (docker.io/oxsecurity/megalinter) is frozen at v9.4.0: pulls of oxsecurity/megalinter:v9 (or :beta, or any flavor tag) will keep returning v9.4.0. To get v9.5.0 and later from CI tools other than GitHub Actions (GitLab CI, Azure Pipelines, Bitbucket, Jenkins, Drone, raw docker run, …), switch your image references:

      • oxsecurity/megalinter:v9 → ghcr.io/oxsecurity/megalinter:v9
      • oxsecurity/megalinter:beta → ghcr.io/oxsecurity/megalinter:beta
      • oxsecurity/megalinter-<flavor>:v9 → ghcr.io/oxsecurity/megalinter-<flavor>:v9

      GitHub Action users (uses: oxsecurity/megalinter@v9) and mega-linter-runner users are not affected, as both already pull from ghcr.io.

    • ESLint-based linters upgraded to v10+. Legacy .eslintrc.* configs are no longer supported: you must migrate to flat-config (eslint.config.js) to keep using JAVASCRIPT_ES, TYPESCRIPT_ES, JSX_ESLINT, TSX_ESLINT, and JSON_ESLINT_PLUGIN_JSONC.

    • Airbnb and Standard ESLint configs replaced (they never shipped ESLint 9+ support):

      • extends: ["airbnb"] → extends: ["airbnb-extended"]
      • extends: ["standard"] → extends: ["neostandard"]

  • Core

    • User notifications system: linters can surface structured "Notices" to end users in the PR comment / report footer (used for ESLint migration, deprecated options, etc.), replaces the ad-hoc migration warnings
    • Security: more default hidden environment variables, so a compromised linter cannot leak your secrets
    • Upgrade .NET runtime to 10.0 (csharpier, dotnet-format, roslynator, devskim, tsqllint, vbdotnet-format)
    • Upgrade GO runtime to 1.26.3

  • New linters

    • osv-scanner: trivy-like vulnerability scanner by Google
    • zizmor: GitHub Actions static analysis

  • Disabled linters

    • KICS (until upstream security issue is fixed)
    • Spectral (crashing)

  • Re-enabled linters

  • Deprecated linters

  • Removed linters

  • Media

  • Linters enhancements

    • ESLint: legacy .eslintrc.* configs are now detected and a migration notice is emitted in the report so users know they need to switch to flat-config
    • shellcheck: honour the BASH_SHELLCHECK_CONFIG_FILE variable / .shellcheckrc config file
    • raku (Rakudo): now ships on ARM64 too
    • scala: linter installation is now deterministic (same binary across rebuilds)
    • v8r (JSON/YAML schema validation): output now shows only validation errors (no more "no schema found" or success noise)
    • lychee: removed the deprecated exclude_mail option (no longer supported by lychee upstream)
    • Faster image pulls: several linters (Lua/StyLua arm64, clj-kondo, kubescape, ls-lint, dotenv-linter) now use pre-built Alpine binaries instead of compiling from source

  • Fixes

    • Console output: linters now show their log sections (not only on errors), the results table and reporter logs are printed after linters complete, and parallel-run logs are no longer interleaved
    • YAML_V8R_CONFIG_FILE / JSON_V8R_CONFIG_FILE are now correctly applied (the v8r --catalogs option is wired through)
    • lychee: fix the configured headers / Accept settings being ignored
    • Custom flavor builder: works correctly for repositories whose name contains uppercase characters
    • Docs: corrected the documented default value for the pre-commands cwd option

  • Reporters

    • Comment reporters (GitHub, GitLab, Azure DevOps, Bitbucket) now work when running MegaLinter from Jenkins CI
    • GitlabCommentReporter activates as soon as GITLAB_ACCESS_TOKEN_MEGALINTER is set (no longer requires CI_JOB_TOKEN)
    • BitbucketCommentReporter: per-linter sections rendered as ### headings (Bitbucket Cloud markdown was displaying the previous <details> HTML tags as literal text)
    • Display a default user notification on PR/console reports inviting users to read the MegaLinter 9.5.0 release announcement. Can be disabled by setting SECURITY_SUGGESTIONS: false.

  • Flavors

    • Multi-arch images: In custom flavors, linters can now build for linux/arm64 in addition to linux/amd64 whenever possible (Apple Silicon, AWS Graviton, Ampere…)

  • Doc

    • Add documentation for the megalinter-ado Azure DevOps extension and the megalinter-mcp-server MCP server
    • Explicitly discourage the use of Personal Access Tokens (PAT) in workflows for security reasons

  • mega-linter-runner

    • New --list-vars [pattern] flag (with --json) lists every MegaLinter env variable that can be passed via -e, with type, default, allowed values and examples (handy for AI coding agents)
    • -e ENABLE_LINTERS=YAML_PRETTIER,YAML_YAMLLINT no longer silently drops values after the first comma (#​7500). The --env=KEY=VALUE long form is also accepted.

  • Dev

    • Add CLAUDE.md and a set of /add-linter, /update-linter-version, /review-descriptor, /fix-linter-test, /add-reporter, /add-flavor, /build, /diagnose-config, /fix-security-issue skills to help work on MegaLinter with coding agents (Claude Code, GitHub Copilot, Codex, gemini-cli…)
    • Migrate copilot-instructions into Claude Code Agents & Skills
    • New descriptor capabilities for custom linter integrations: cli_lint_extra_args_after per lint mode (list_of_files / project / file), a {file} template variable usable in command-line args, and a customizable files separator

  • CI

    • Run ARM linter jobs only when the commit message contains "ARM" (avoids 200 jobs per PR)
    • Do not push a fix commit if only markdown or JSON files were updated
    • Run osv-scanner on MegaLinter's own sources
    • Optimize the linter-job matrix for dependabot and renovate PRs
    • Exclude test dependencies from dependabot
    • Faster Docker image builds: optimized Dockerfile layer order, buildx layer cache (type=gha, zstd-compressed) on all deploy workflows, DEV pipeline split into parallel jobs sharing the image via cache, and cargo-based tools (sarif-fmt, zizmor, shellcheck-sarif, stylua) built in parallel multi-stage builders so the Rust toolchain no longer ships in the final image (except for clippy)
    • Hardened MegaLinter's own GitHub Actions workflows against script injection via untrusted PR contexts (zizmor findings)

  • Linter versions upgrades (62)

step-security/harden-runner (step-security/harden-runner)

v2.19.3

Compare Source

What's Changed

Full Changelog: step-security/harden-runner@v2.19.2...v2.19.3

v2.19.2

Compare Source

What's Changed
  • Update the Harden Runner agent for enterprise tier to use go 1.26 and fix minor bugs.

Full Changelog: step-security/harden-runner@v2.19.1...v2.19.2

zizmorcore/zizmor (zizmor)

v1.25.2

Compare Source

Bug Fixes 🐛🔗

v1.25.1

Compare Source

Bug Fixes 🐛🔗

v1.25.0

Compare Source

New Features 🌈🔗

  • zizmor's finding severities can now be remapped on a per-audit basis. See the configuration for details (#​1913)

    Many thanks to @​Proximyst for proposing and implementing this improvement!

  • New audit: github-app detects dangerous usages of GitHub App installation tokens (#​1926)

  • New audit: [unpinned-tools] detects actions that install tools without pinning to a specific version (#​1820)

  • zizmor now accepts the --no-ignores flag to disable all ignore comments and configurations when reporting findings (#​1935)

  • zizmor's LSP now honors the --persona flag on the CLI (#​1943)

  • zizmor is now aware of Docker-based action definitions, in addition to the pre-existing support for "composite" actions (#​1965)

Enhancements🔗

Performance Improvements 🚄🔗

  • The impostor-commit audit is now significantly faster (in addition to being more correct) when the user has pinned their action to a tag SHA instead of a commit SHA (#​1998)
    Bug Fixes 🐛🔗

  • Fixed a crash in the template-injection audit when a workflow uses a parenthesized compound expression in context position (#​1904)

  • Fixed a bug where local directory input collection could miss workflows for relative-path invocations from within .github subdirectories (#​1909)

  • Fixed a bug where the unpinned-images audit would miss images defined in container: clauses (#​1944)

  • Fixed a bug where inline ignore comments could not be easily applied to superfluous-actions findings (#​1945)

  • Fixed a bug where the cache-poisoning audit would fail to detect some release trigger patterns (#​1946)

  • Fixed a bug where inline ignore comments could not be easily applied to cache-poisoning findings (#​1962)

  • Fixed a class of imprecisions where the cache-poisoning audit would incorrectly flag cache usage that doesn't actually occur on release events (#​1940)

    Many thanks to @​reubenwong97 for implementing this fix!

  • Fixed a bug where dependabot.yml files containing a private cargo repository couldn't be parsed (#​1976)

  • Fixed a bug where zizmor's input validation warnings lacked a mention of which files failed to validate (#​1980)

  • Fixed a bug where the impostor-commit audit would falsely indicate impostor commits if an action was pinned to a tag SHA instead of a commit SHA (#​1998)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-advanced-security[bot]
github-advanced-security AI found potential problems May 18, 2026
View reviewed changes
Comment thread .github/workflows/standard-release.yaml
egress-policy: audit # change to 'egress-policy: block' after couple of runs

- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 18, 2026 •
edited
Loading

❌MegaLinter analysis: Error

Descriptor Linter Files Fixed Errors Warnings Elapsed time
✅ ACTION actionlint 4 0 0 0.25s
❌ ACTION zizmor 4 1 0 0.56s
✅ COPYPASTE jscpd yes no no 1.1s
✅ DOCKERFILE hadolint 1 0 0 0.37s
✅ JSON jsonlint 3 0 0 0.22s
✅ JSON prettier 3 0 0 0.58s
✅ JSON v8r 3 0 0 2.99s
✅ MARKDOWN markdownlint 1 0 0 1.03s
✅ MARKDOWN markdown-table-formatter 1 0 0 0.29s
✅ PYTHON bandit 1 0 0 3.12s
✅ PYTHON black 1 0 0 1.19s
✅ PYTHON flake8 1 0 0 1.0s
✅ PYTHON isort 1 0 0 0.92s
✅ PYTHON mypy 1 0 0 4.11s
✅ PYTHON pylint 1 0 0 4.67s
✅ PYTHON pyright 1 0 0 2.03s
✅ PYTHON ruff 1 0 0 0.21s
✅ REPOSITORY checkov yes no no 34.29s
✅ REPOSITORY dustilock yes no no 0.06s
✅ REPOSITORY gitleaks yes no no 0.66s
✅ REPOSITORY git_diff yes no no 0.01s
✅ REPOSITORY grype yes no no 61.02s
✅ REPOSITORY kingfisher yes no no 11.42s
❌ REPOSITORY osv-scanner yes 1 no 0.16s
✅ REPOSITORY secretlint yes no no 1.57s
✅ REPOSITORY syft yes no no 2.79s
✅ REPOSITORY trivy yes no no 11.23s
✅ REPOSITORY trivy-sbom yes no no 0.18s
✅ REPOSITORY trufflehog yes no no 5.38s
✅ YAML prettier 6 0 0 1.15s
✅ YAML v8r 6 0 0 7.81s
✅ YAML yamllint 6 0 0 0.77s

Detailed Issues

❌ REPOSITORY / osv-scanner - 1 error 
Scanning dir .
Starting filesystem walk for root: /
End status: 43 dirs visited, 111 inodes visited, 0 Extract calls, 2.873667ms elapsed, 2.873847ms wall time
No package sources found, --help for usage information.
❌ ACTION / zizmor - 1 error 
INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'impostor-commit' audit failed on file://.github/workflows/ci.yaml

Caused by:
    0: error in 'impostor-commit' audit
    1: couldn't list tags for docker/setup-buildx-action
    2: request error while accessing GitHub API
    3: HTTP status client error (401 Unauthorized) for url (https://github.com/docker/setup-buildx-action.git/git-upload-pack)


[ZizmorLinter] Zizmor failed to reach the GitHub API.
To allow zizmor to use GITHUB_TOKEN, add the following to your .mega-linter.yml:
ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
  - GITHUB_TOKEN

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

  • Documentation: Custom Flavors
  • Command: npx mega-linter-runner@9.5.0 --custom-flavor-setup --custom-flavor-linters PYTHON_PYLINT,PYTHON_BLACK,PYTHON_FLAKE8,PYTHON_ISORT,PYTHON_BANDIT,PYTHON_MYPY,PYTHON_PYRIGHT,PYTHON_RUFF,ACTION_ACTIONLINT,ACTION_ZIZMOR,COPYPASTE_JSCPD,DOCKERFILE_HADOLINT,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_DUSTILOCK,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,REPOSITORY_KINGFISHER,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

MegaLinter is graciously provided by OX Security
Show us your support by starring ⭐ the repository

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 107df68 to 7ef9b71 Compare May 20, 2026 04:35
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 7ef9b71 to 605dba8 Compare May 20, 2026 11:32
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 20, 2026

Trivy image scan report

ghcr.io/chgl/github-reusable-workflow-without-test-image:pr-244 (debian 13.5)

No Vulnerabilities found

No Misconfigurations found

Python

No Vulnerabilities found

No Misconfigurations found

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 20, 2026

Trivy image scan report

ghcr.io/chgl/github-reusable-workflow-with-fixed-image-tags:v1.2.3-beta.123 (debian 13.5)

No Vulnerabilities found

No Misconfigurations found

Python

No Vulnerabilities found

No Misconfigurations found

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 20, 2026

Trivy image scan report

ghcr.io/chgl/github-reusable-workflow:pr-244 (debian 13.5)

No Vulnerabilities found

No Misconfigurations found

Python

No Vulnerabilities found

No Misconfigurations found

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@renovate-approve renovate-approve[bot] renovate-approve[bot] approved these changes

@renovate-approve-2 renovate-approve-2[bot] renovate-approve-2[bot] approved these changes

+1 more reviewer

@github-advanced-security github-advanced-security[bot] github-advanced-security[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@github-advanced-security