Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build(deps): bump megalinter/megalinter from 5 to 6 #58

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Nov 21, 2022

Bumps megalinter/megalinter from 5 to 6.

Release notes

Sourced from megalinter/megalinter's releases.

MegaLinter v6.0.0

  • Move Repo to OX Security

  • Breaking changes: you must run npx mega-linter-runner --upgrade to use MegaLinter v6

  • Core architecture

    • New reporter SARIF_REPORTER that aggregates all SARIF output files into a single one
      • Correct SARIF files for known format errors
    • New config variable DISABLE_LINTERS_ERRORS to define a list of linters that will be considered as non blocking
    • Upgrade base docker image to python:3.10.4-alpine3.15
    • Rename default report folder from report to megalinter-reports
    • Display GitHub stars in linters summary table in documentation
  • Linters:

    • Add DevSkim security linter by Microsoft
    • Add dustilock to check for dependency confusion attacks with node and python packages
    • Add gitleaks to lint git repository
    • Add goodcheck as regex-based linter
    • Add PMD to lint java files (disabled for now)
    • Add semgrep as regex-based linter with many community rules
    • Add syft to generate SBOM (Software Bill Of Materials)
    • Add trivy security linter
    • Remove dockerfilelint, as it is not maintained anymore and hadolint contains all its rules
    • Remove rstfmt as it is not maintained anymore
    • SARIF management for:
      • bandit
      • checkov
      • checkstyle
      • cfn-lint
      • devskim
      • eslint
      • gitleaks
      • hadolint
      • ktlint
      • npm-groovy-lint
      • psalm
      • semgrep
      • secretlint
      • revive
      • terrascan
      • tflint
      • trivy
  • Descriptors:

    • New flavor Security
    • New descriptor repository: contains DevSkip, dustilock, gitleaks, secretlint, semgrep, syft, trivy
    • Remove CREDENTIALS and GIT descriptors

... (truncated)

Changelog

Sourced from megalinter/megalinter's changelog.

[v6.12.0] - 2022-10-16

[v6.11.1] - 2022-10-03

  • Remove no-space-check from MegaLinter default .pylintrc file (#1923)

[v6.11.0] - 2022-10-02

  • Linters

  • Core

    • Improve support for devcontainers by using Python base image
      • Fixed Python version in devcontainer from 3.9 -> 3.10
      • Fix build command on linux (thanks a lot to Edouard Choinière for the investigation and solution !)
    • Azure Comments reporter - Change status when all tests pass (#1915)

... (truncated)

Commits
  • e7a797f Merge branch 'main' into v6-branch
  • 03302f4 [automation] Auto-update linters version, help and documentation (#2061)
  • 17c3c8b [automation] Auto-update linters version, help and documentation (#2060)
  • 02ffbe3 Initial Drone CI documentation (#2053)
  • a9bec95 [automation] Auto-update linters version, help and documentation (#2059)
  • 404fbc8 [automation] Auto-update linters version, help and documentation (#2057)
  • 4197772 [automation] Auto-update linters version, help and documentation (#2054)
  • b624a7d Build
  • 5f067f7 Release MegaLinter v6.14.0
  • 9754569 [automation] Auto-update linters version, help and documentation (#2051)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [megalinter/megalinter](https://github.com/megalinter/megalinter) from 5 to 6.
- [Release notes](https://github.com/megalinter/megalinter/releases)
- [Changelog](https://github.com/oxsecurity/megalinter/blob/main/CHANGELOG.md)
- [Commits](oxsecurity/megalinter@v5...v6)

---
updated-dependencies:
- dependency-name: megalinter/megalinter
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 21, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants