Bump oxsecurity/megalinter from 10.0.0 to 10.1.0 by dependabot[bot] · Pull Request #614 · EIPStackGroup/OpENer

dependabot · 2026-10-26T08:25:53Z

Bumps oxsecurity/megalinter from 10.0.0 to 10.1.0.

Release notes

Sourced from oxsecurity/megalinter's releases.

v10.1.0

What's Changed

Core

MegaLinter now prints a crash traceback when it is killed by a fatal signal (SIGSEGV, SIGBUS…), instead of exiting silently with no clue about what happened (#8779)

The LLM Advisor supports a new provider, OrcaRouter, an OpenAI-compatible AI gateway: set LLM_PROVIDER: orcarouter and ORCAROUTER_API_KEY in your environment to get fix suggestions routed through OrcaRouter (see the OrcaRouter provider page) (#8826)

New linters

biome, one fast toolchain linting, formatting and sorting imports of JavaScript, TypeScript, JSX, TSX, JSON, CSS and GraphQL files, available as JAVASCRIPT_BIOME, TYPESCRIPT_BIOME, JSX_BIOME, TSX_BIOME, JSON_BIOME, CSS_BIOME and GRAPHQL_BIOME (#8706)

Activated only when a biome.json or biome.jsonc configuration file is found in the repository

Supports APPLY_FIXES (safe fixes with --write) and native SARIF output

EXCLUDED_DIRECTORIES are forwarded in project lint mode through a generated configuration extending the workspace one

ApexGuru, the AI-driven engine of Salesforce Code Analyzer, available as SALESFORCE_CODE_ANALYZER_APEXGURU (#8820)

Detects SOQL inefficiencies, critical anti-patterns and scalability hotspots in your .cls and .trigger files, with line-level highlights, severity ratings and suggested fixes

The analysis runs in a connected Salesforce org, not locally: store the auth url of the target org in a CI secret named SFDX_AUTH_URL, and MegaLinter logs in to that org before the scan

The scan is sent to that org explicitly, so a .sfdx/sfdx-config.json left at the root of the repository, usually naming a long gone scratch org, can not hijack it

Inactive by default: it activates only when SFDX_AUTH_URL is defined, so nothing changes for existing Salesforce projects

Requires ApexGuru to be enabled on the org: it needs Scale Center, and is available for Unlimited Edition production orgs, full copy sandboxes, Signature orgs and Scale Test customers

A run where the engine could not analyze anything is reported as an error rather than a silent success, together with the reason and how to fix it

Supports native SARIF output, like the other Code Analyzer engines

tofu fmt, the built-in formatter of OpenTofu (the MPL-2.0 licensed fork of Terraform), available as TERRAFORM_TOFU_FMT (#8729)

Analyzes .tofu files only, the OpenTofu specific extension, so it never doubles up with TERRAFORM_TERRAFORM_FMT which keeps .tf

To format your .tf files with OpenTofu instead, set TERRAFORM_TOFU_FMT_FILE_EXTENSIONS: [".tofu", ".tf", ".tfvars"] and DISABLE_LINTERS: [TERRAFORM_TERRAFORM_FMT]

Supports APPLY_FIXES to rewrite files in the canonical OpenTofu style

tofu validate, the built-in validator of OpenTofu, available as TERRAFORM_TOFU_VALIDATE (#8793)

Reports what formatters and rule-based linters can not see: unsupported or missing arguments, wrong attribute types, references to undeclared variables, locals or outputs, and broken module input contracts

Analyzes .tofu files only, like TERRAFORM_TOFU_FMT, leaving .tf free for a future terraform validate linter. To validate .tf files, set TERRAFORM_TOFU_VALIDATE_FILE_EXTENSIONS: [".tofu", ".tf"]

Validates one whole module per directory, so every .tf and .tofu file of a selected directory is parsed and can produce diagnostics

Every directory is initialized with tofu init -backend=false beforehand, so no state is read, no state lock is taken and no cloud credentials are needed

Set TERRAFORM_TOFU_VALIDATE_INIT_ARGUMENTS to change those initialization arguments, for example adding -lockfile=readonly to have an out-of-sync .terraform.lock.hcl reported as an error instead of being updated

Disabled linters

COFFEE_COFFEELINT is disabled: CoffeeScript tooling is discontinued, and coffeelint can not receive EXCLUDED_DIRECTORIES in project lint mode (it has no exclusion option and reads .coffeelintignore only from its working directory). The linter will be removed in a future version (#8720)

GRAPHQL_GRAPHQL_SCHEMA_LINTER is disabled: graphql-schema-linter is unmaintained, with no release or commit since May 2022, and its peer dependency range pins graphql to ^15 || ^16, which held the whole GraphQL install back from graphql v17. Use GRAPHQL_BIOME to lint your GraphQL files. The linter will be removed in a future version (#8894)

Re-enabled linters

spectral is back as API_SPECTRAL, together with the API descriptor, to lint your OpenAPI, AsyncAPI and Arazzo specifications (#8717)

It was removed in v10.0.0 because it crashed at startup on every run: the cause has been found and fixed

Nothing to change in your configuration: API_SPECTRAL works again in ENABLE_LINTERS / DISABLE_LINTERS, and the default ruleset file is still .spectral.yaml

Linters enhancements

TERRAFORM_TFLINT now documents the tflint native GITHUB_TOKEN_github_com variable to authenticate plugin downloads on github.com, which is the recommended way to fix tflint --init failures when your GITHUB_TOKEN targets a GitHub Enterprise instance (#8795)

Set your github.com token in GITHUB_TOKEN_github_com, then list it in TERRAFORM_TFLINT_UNSECURED_ENV_VARIABLES: tflint gives it priority over GITHUB_TOKEN, which other linters and reporters keep using

PAT_GITHUB_COM is deprecated: it still works and now logs a warning, and will be removed in a future major release

CLOJURE_CLJSTYLE now forwards EXCLUDED_DIRECTORIES through its native repeatable --ignore argument, instead of a temporary .cljstyle written in your repository. Exclusions are now also applied when your repository already has a .cljstyle config, whose own ignore patterns are preserved (#8720)

SQL_SQLFLUFF does not receive EXCLUDED_DIRECTORIES in project lint mode anymore: sqlfluff reads path exclusions only from a .sqlfluffignore, .sqlfluff or pyproject.toml located inside the analyzed sources, where MegaLinter used to write a temporary file. List the directories to skip in your own .sqlfluffignore, or keep the default list_of_files lint mode where MegaLinter filters the files itself (#8720)

SARIF output is now available for 13 more linters: zizmor, bicep_linter, cppcheck, clj-kondo, roslynator, htmlhint, protolint, sqlfluff, swiftlint, osv-scanner, trufflehog, jscpd and lintr. Enable it the same way as any other SARIF-capable linter, with SARIF_REPORTER: true (optionally scoped with SARIF_REPORTER_LINTERS) (#8715)

The 4 Salesforce Code Analyzer engines (SALESFORCE_CODE_ANALYZER_APEX, _AURA, _LWC, _FLOW) also gained SARIF output: their report switches from CSV to SARIF automatically when SARIF reporting is requested

csharp_roslynator is bumped from 0.12.0 to 0.13.0, the first release including its SARIF output support

... (truncated)

Changelog

Sourced from oxsecurity/megalinter's changelog.

[v10.1.0] - 2026-09-05

Core

MegaLinter now prints a crash traceback when it is killed by a fatal signal (SIGSEGV, SIGBUS…), instead of exiting silently with no clue about what happened (#8779)

The LLM Advisor supports a new provider, OrcaRouter, an OpenAI-compatible AI gateway: set LLM_PROVIDER: orcarouter and ORCAROUTER_API_KEY in your environment to get fix suggestions routed through OrcaRouter (see the OrcaRouter provider page) (#8826)

New linters

biome, one fast toolchain linting, formatting and sorting imports of JavaScript, TypeScript, JSX, TSX, JSON, CSS and GraphQL files, available as JAVASCRIPT_BIOME, TYPESCRIPT_BIOME, JSX_BIOME, TSX_BIOME, JSON_BIOME, CSS_BIOME and GRAPHQL_BIOME (#8706)

Activated only when a biome.json or biome.jsonc configuration file is found in the repository

Supports APPLY_FIXES (safe fixes with --write) and native SARIF output

EXCLUDED_DIRECTORIES are forwarded in project lint mode through a generated configuration extending the workspace one

ApexGuru, the AI-driven engine of Salesforce Code Analyzer, available as SALESFORCE_CODE_ANALYZER_APEXGURU (#8820)

Detects SOQL inefficiencies, critical anti-patterns and scalability hotspots in your .cls and .trigger files, with line-level highlights, severity ratings and suggested fixes

The analysis runs in a connected Salesforce org, not locally: store the auth url of the target org in a CI secret named SFDX_AUTH_URL, and MegaLinter logs in to that org before the scan

The scan is sent to that org explicitly, so a .sfdx/sfdx-config.json left at the root of the repository, usually naming a long gone scratch org, can not hijack it

Inactive by default: it activates only when SFDX_AUTH_URL is defined, so nothing changes for existing Salesforce projects

Requires ApexGuru to be enabled on the org: it needs Scale Center, and is available for Unlimited Edition production orgs, full copy sandboxes, Signature orgs and Scale Test customers

A run where the engine could not analyze anything is reported as an error rather than a silent success, together with the reason and how to fix it

Supports native SARIF output, like the other Code Analyzer engines

tofu fmt, the built-in formatter of OpenTofu (the MPL-2.0 licensed fork of Terraform), available as TERRAFORM_TOFU_FMT (#8729)

Analyzes .tofu files only, the OpenTofu specific extension, so it never doubles up with TERRAFORM_TERRAFORM_FMT which keeps .tf

To format your .tf files with OpenTofu instead, set TERRAFORM_TOFU_FMT_FILE_EXTENSIONS: [".tofu", ".tf", ".tfvars"] and DISABLE_LINTERS: [TERRAFORM_TERRAFORM_FMT]

Supports APPLY_FIXES to rewrite files in the canonical OpenTofu style

tofu validate, the built-in validator of OpenTofu, available as TERRAFORM_TOFU_VALIDATE (#8793)

Reports what formatters and rule-based linters can not see: unsupported or missing arguments, wrong attribute types, references to undeclared variables, locals or outputs, and broken module input contracts

Analyzes .tofu files only, like TERRAFORM_TOFU_FMT, leaving .tf free for a future terraform validate linter. To validate .tf files, set TERRAFORM_TOFU_VALIDATE_FILE_EXTENSIONS: [".tofu", ".tf"]

Validates one whole module per directory, so every .tf and .tofu file of a selected directory is parsed and can produce diagnostics

Every directory is initialized with tofu init -backend=false beforehand, so no state is read, no state lock is taken and no cloud credentials are needed

Set TERRAFORM_TOFU_VALIDATE_INIT_ARGUMENTS to change those initialization arguments, for example adding -lockfile=readonly to have an out-of-sync .terraform.lock.hcl reported as an error instead of being updated

Disabled linters

COFFEE_COFFEELINT is disabled: CoffeeScript tooling is discontinued, and coffeelint can not receive EXCLUDED_DIRECTORIES in project lint mode (it has no exclusion option and reads .coffeelintignore only from its working directory). The linter will be removed in a future version (#8720)

GRAPHQL_GRAPHQL_SCHEMA_LINTER is disabled: graphql-schema-linter is unmaintained, with no release or commit since May 2022, and its peer dependency range pins graphql to ^15 || ^16, which held the whole GraphQL install back from graphql v17. Use GRAPHQL_BIOME to lint your GraphQL files. The linter will be removed in a future version (#8894)

Re-enabled linters

spectral is back as API_SPECTRAL, together with the API descriptor, to lint your OpenAPI, AsyncAPI and Arazzo specifications (#8717)

It was removed in v10.0.0 because it crashed at startup on every run: the cause has been found and fixed

Nothing to change in your configuration: API_SPECTRAL works again in ENABLE_LINTERS / DISABLE_LINTERS, and the default ruleset file is still .spectral.yaml

Linters enhancements

TERRAFORM_TFLINT now documents the tflint native GITHUB_TOKEN_github_com variable to authenticate plugin downloads on github.com, which is the recommended way to fix tflint --init failures when your GITHUB_TOKEN targets a GitHub Enterprise instance (#8795)

Set your github.com token in GITHUB_TOKEN_github_com, then list it in TERRAFORM_TFLINT_UNSECURED_ENV_VARIABLES: tflint gives it priority over GITHUB_TOKEN, which other linters and reporters keep using

PAT_GITHUB_COM is deprecated: it still works and now logs a warning, and will be removed in a future major release

CLOJURE_CLJSTYLE now forwards EXCLUDED_DIRECTORIES through its native repeatable --ignore argument, instead of a temporary .cljstyle written in your repository. Exclusions are now also applied when your repository already has a .cljstyle config, whose own ignore patterns are preserved (#8720)

SQL_SQLFLUFF does not receive EXCLUDED_DIRECTORIES in project lint mode anymore: sqlfluff reads path exclusions only from a .sqlfluffignore, .sqlfluff or pyproject.toml located inside the analyzed sources, where MegaLinter used to write a temporary file. List the directories to skip in your own .sqlfluffignore, or keep the default list_of_files lint mode where MegaLinter filters the files itself (#8720)

SARIF output is now available for 13 more linters: zizmor, bicep_linter, cppcheck, clj-kondo, roslynator, htmlhint, protolint, sqlfluff, swiftlint, osv-scanner, trufflehog, jscpd and lintr. Enable it the same way as any other SARIF-capable linter, with SARIF_REPORTER: true (optionally scoped with SARIF_REPORTER_LINTERS) (#8715)

The 4 Salesforce Code Analyzer engines (SALESFORCE_CODE_ANALYZER_APEX, _AURA, _LWC, _FLOW) also gained SARIF output: their report switches from CSV to SARIF automatically when SARIF reporting is requested

csharp_roslynator is bumped from 0.12.0 to 0.13.0, the first release including its SARIF output support

clj-kondo's upstream SARIF output currently nests the regionclj-kondo/clj-kondo#2345

Prettier linters (JSON_PRETTIER, YAML_PRETTIER, JAVASCRIPT_PRETTIER, TYPESCRIPT_PRETTIER) now tell you how to install a Prettier plugin when one declared in your .prettierrc fails to load with Cannot find package ... imported from noop.js (#6980)

... (truncated)

Commits

9949bad Release MegaLinter v10.1.0
4270990 fix release workflow
4d8bf14 [automation] Auto-update linters version, help and documentation (#8902)
98bcce2 fix(ci): install zensical in the auto-update linters container (#8901)
b63dee7 fix(deps): update langchain (minor) (#8878)
4d17aee fix(renovate-rebase): force UTF-8 console output in tick_dashboard (#8900)
b034be4 Disable the unmaintained graphql-schema-linter (#8894)
e00d096 chore(deps): update dependency snakemake to v9.26.1 (#8897)
9591933 chore(deps): update dependency langsmith to v0.11.2 (#8896)
e87989e chore(deps): update dependency golangci/golangci-lint to v2.13.2 (#8895)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [oxsecurity/megalinter](https://github.com/oxsecurity/megalinter) from 10.0.0 to 10.1.0. - [Release notes](https://github.com/oxsecurity/megalinter/releases) - [Changelog](https://github.com/oxsecurity/megalinter/blob/main/CHANGELOG.md) - [Commits](oxsecurity/megalinter@v10.0.0...v10.1.0) --- updated-dependencies: - dependency-name: oxsecurity/megalinter dependency-version: 10.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-10-26T08:28:25Z

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Errors	Warnings	Elapsed time
❌ ACTION	actionlint	1	1	0	0.02s
❌ ACTION	zizmor	1	1	0	0.16s
❌ C	clang-format	112	1	0	0.19s
❌ C	cppcheck	112	1	0	3.11s
❌ C	cpplint	112	3360	0	7.19s
❌ COPYPASTE	jscpd	yes	266	no	1.58s
❌ CPP	clang-format	72	1	0	0.14s
❌ CPP	cppcheck	72	1	0	0.68s
❌ CPP	cpplint	72	857	0	2.5s
⚠️ MARKDOWN	markdownlint	1	52	0	0.34s
✅ MARKDOWN	markdown-table-formatter	1	0	0	0.11s
✅ REPOSITORY	betterleaks	yes	no	no	1.26s
✅ REPOSITORY	checkov	yes	no	no	22.3s
✅ REPOSITORY	git_diff	yes	no	no	0.12s
✅ REPOSITORY	grype	yes	no	no	68.77s
✅ REPOSITORY	osv-scanner	yes	no	no	0.08s
✅ REPOSITORY	secretlint	yes	no	no	0.85s
✅ REPOSITORY	syft	yes	no	no	1.66s
✅ REPOSITORY	trivy	yes	no	no	11.86s
✅ REPOSITORY	trivy-sbom	yes	no	no	0.11s
✅ REPOSITORY	trufflehog	yes	no	no	2.4s
❌ SPELL	lychee	24	1	0	0.51s
✅ XML	xmllint	1	0	0	0.03s
⚠️ YAML	prettier	2	1	2	0.23s
✅ YAML	v8r	2	0	0	2.53s
❌ YAML	yamllint	2	9	0	0.34s

Detailed Issues

❌ ACTION / actionlint - 1 error

.github/workflows/build.yml:135:9: shellcheck reported issue in this script: SC2086:info:3:41: Double quote to prevent globbing and word splitting [shellcheck]
    |
135 |         run: |
    |         ^~~~

❌ C / clang-format - 1 error

: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument

(Truncated to last 3076 characters out of 19263)

❌ CPP / clang-format - 1 error

: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument
.clang-format:62:36: error: invalid boolean
AllowShortCaseLabelsOnASingleLine: Never
                                   ^~~~~
Error reading .clang-format: Invalid argument

(Truncated to last 3076 characters out of 12383)

❌ C / cppcheck - 1 error

ndler.c: STM32=STM32;__MINGW32__=__MINGW32__...
Checking source/src/ports/generic_networkhandler.c: _WIN32=_WIN32...
86/112 files checked 94% done
Checking source/src/ports/generic_networkhandler.h ...
Checking source/src/ports/generic_networkhandler.h: STM32...
87/112 files checked 94% done
Checking source/src/ports/networkhandler.h ...
88/112 files checked 95% done
Checking source/src/ports/nvdata/conffile.c ...
Checking source/src/ports/nvdata/conffile.c: _MSC_VER=_MSC_VER...
Checking source/src/ports/nvdata/conffile.c: _WIN32=_WIN32...
89/112 files checked 95% done
Checking source/src/ports/nvdata/conffile.h ...
90/112 files checked 95% done
Checking source/src/ports/nvdata/nvdata.c ...
91/112 files checked 96% done
Checking source/src/ports/nvdata/nvdata.h ...
92/112 files checked 96% done
Checking source/src/ports/nvdata/nvqos.c ...
Checking source/src/ports/nvdata/nvqos.c: _MSC_VER=_MSC_VER...
93/112 files checked 96% done
Checking source/src/ports/nvdata/nvqos.h ...
94/112 files checked 96% done
Checking source/src/ports/nvdata/nvtcpip.c ...
95/112 files checked 96% done
Checking source/src/ports/nvdata/nvtcpip.h ...
96/112 files checked 97% done
Checking source/src/ports/opener_error.h ...
97/112 files checked 97% done
Checking source/src/ports/socket_timer.c ...
98/112 files checked 97% done
Checking source/src/ports/socket_timer.h ...
99/112 files checked 97% done
Checking source/src/trace.h ...
Checking source/src/trace.h: OPENER_WITH_TRACES=OPENER_WITH_TRACES...
Checking source/src/trace.h: OPENER_WITH_TRACES=OPENER_WITH_TRACES;WIN32=WIN32...
100/112 files checked 97% done
Checking source/src/typedefs.h ...
101/112 files checked 98% done
Checking source/src/utils/doublylinkedlist.c ...
102/112 files checked 98% done
Checking source/src/utils/doublylinkedlist.h ...
103/112 files checked 99% done
Checking source/src/utils/enipmessage.c ...
104/112 files checked 99% done
Checking source/src/utils/enipmessage.h ...
105/112 files checked 99% done
Checking source/src/utils/random.c ...
source/src/utils/random.c:14:4: warning: If memory allocation fails, then there is a possible null pointer dereference: random [nullPointerOutOfMemory]
  *random =
   ^
source/src/utils/random.c:13:26: note: Assuming allocation function fails
  Random *random = malloc( sizeof(Random) );
                         ^
source/src/utils/random.c:13:26: note: Assignment 'random=malloc(sizeof(struct Random))', assigned value is 0
  Random *random = malloc( sizeof(Random) );
                         ^
source/src/utils/random.c:14:4: note: Null pointer dereference
  *random =
   ^
106/112 files checked 99% done
Checking source/src/utils/random.h ...
107/112 files checked 99% done
Checking source/src/utils/xorshiftrandom.c ...
108/112 files checked 99% done
Checking source/src/utils/xorshiftrandom.h ...
109/112 files checked 99% done
Checking source/tests/OpENerTests.h ...
110/112 files checked 99% done
Checking source/tests/check_assert.h ...
111/112 files checked 99% done
Checking source/tests/test_assert.h ...
112/112 files checked 100% done

(Truncated to last 3076 characters out of 15341)

❌ CPP / cppcheck - 1 error

^
source/tests/cip/cipepathtest.cpp:371:23: note: Assignment 'message=(CipOctet*)calloc(6,sizeof(CipOctet))', assigned value is 0
  CipOctet *message = (CipOctet *)calloc (6, sizeof(CipOctet) );
                      ^
source/tests/cip/cipepathtest.cpp:376:3: note: Null pointer dereference
  message[2] = 21;
  ^
source/tests/cip/cipepathtest.cpp:377:3: warning: If memory allocation fails, then there is a possible null pointer dereference: message [nullPointerOutOfMemory]
  message[3] = 22;
  ^
source/tests/cip/cipepathtest.cpp:371:42: note: Assuming allocation function fails
  CipOctet *message = (CipOctet *)calloc (6, sizeof(CipOctet) );
                                         ^
source/tests/cip/cipepathtest.cpp:371:23: note: Assignment 'message=(CipOctet*)calloc(6,sizeof(CipOctet))', assigned value is 0
  CipOctet *message = (CipOctet *)calloc (6, sizeof(CipOctet) );
                      ^
source/tests/cip/cipepathtest.cpp:377:3: note: Null pointer dereference
  message[3] = 22;
  ^
source/tests/cip/cipepathtest.cpp:378:3: warning: If memory allocation fails, then there is a possible null pointer dereference: message [nullPointerOutOfMemory]
  message[4] = 23;
  ^
source/tests/cip/cipepathtest.cpp:371:42: note: Assuming allocation function fails
  CipOctet *message = (CipOctet *)calloc (6, sizeof(CipOctet) );
                                         ^
source/tests/cip/cipepathtest.cpp:371:23: note: Assignment 'message=(CipOctet*)calloc(6,sizeof(CipOctet))', assigned value is 0
  CipOctet *message = (CipOctet *)calloc (6, sizeof(CipOctet) );
                      ^
source/tests/cip/cipepathtest.cpp:378:3: note: Null pointer dereference
  message[4] = 23;
  ^
source/tests/cip/cipepathtest.cpp:379:3: warning: If memory allocation fails, then there is a possible null pointer dereference: message [nullPointerOutOfMemory]
  message[5] = 24;
  ^
source/tests/cip/cipepathtest.cpp:371:42: note: Assuming allocation function fails
  CipOctet *message = (CipOctet *)calloc (6, sizeof(CipOctet) );
                                         ^
source/tests/cip/cipepathtest.cpp:371:23: note: Assignment 'message=(CipOctet*)calloc(6,sizeof(CipOctet))', assigned value is 0
  CipOctet *message = (CipOctet *)calloc (6, sizeof(CipOctet) );
                      ^
source/tests/cip/cipepathtest.cpp:379:3: note: Null pointer dereference
  message[5] = 24;
  ^
64/72 files checked 91% done
Checking source/tests/cip/cipstringtests.cpp ...
65/72 files checked 93% done
Checking source/tests/enet_encap/encaptest.cpp ...
66/72 files checked 94% done
Checking source/tests/enet_encap/endianconvtest.cpp ...
67/72 files checked 96% done
Checking source/tests/ports/socket_timer_tests.cpp ...
68/72 files checked 96% done
Checking source/tests/test_assert.h ...
69/72 files checked 96% done
Checking source/tests/utils/doublylinkedlistTests.cpp ...
70/72 files checked 99% done
Checking source/tests/utils/randomTests.cpp ...
71/72 files checked 99% done
Checking source/tests/utils/xorshiftrandomtests.cpp ...
72/72 files checked 100% done

(Truncated to last 3076 characters out of 20282)

❌ C / cpplint - 3360 errors

src/ports/POSIX/networkhandler.c
Done processing source/src/ports/POSIX/opener_error.c
Done processing source/src/ports/POSIX/platform_network_includes.h
Done processing source/src/ports/POSIX/sample_application/ethlinkcbs.c
Done processing source/src/ports/POSIX/sample_application/ethlinkcbs.h
Done processing source/src/ports/POSIX/sample_application/opener_user_conf.h
Done processing source/src/ports/POSIX/sample_application/sampleapplication.c
Done processing source/src/ports/STM32/networkconfig.c
Done processing source/src/ports/STM32/networkconfig.h
Done processing source/src/ports/STM32/networkhandler.c
Done processing source/src/ports/STM32/opener.c
Done processing source/src/ports/STM32/opener.h
Done processing source/src/ports/STM32/opener_error.c
Done processing source/src/ports/STM32/platform_network_includes.h
Done processing source/src/ports/STM32/sample_application/ethlinkcbs.c
Done processing source/src/ports/STM32/sample_application/ethlinkcbs.h
Done processing source/src/ports/STM32/sample_application/opener_user_conf.h
Done processing source/src/ports/STM32/sample_application/sampleapplication.c
Done processing source/src/ports/WIN32/main.c
Done processing source/src/ports/WIN32/networkconfig.c
Done processing source/src/ports/WIN32/networkconfig.h
Done processing source/src/ports/WIN32/networkhandler.c
Done processing source/src/ports/WIN32/opener_error.c
Done processing source/src/ports/WIN32/platform_network_includes.h
Done processing source/src/ports/WIN32/sample_application/ethlinkcbs.c
Done processing source/src/ports/WIN32/sample_application/ethlinkcbs.h
Done processing source/src/ports/WIN32/sample_application/opener_user_conf.h
Done processing source/src/ports/WIN32/sample_application/sampleapplication.c
Done processing source/src/ports/generic_networkhandler.c
Done processing source/src/ports/generic_networkhandler.h
Done processing source/src/ports/networkhandler.h
Done processing source/src/ports/nvdata/conffile.c
Done processing source/src/ports/nvdata/conffile.h
Done processing source/src/ports/nvdata/nvdata.c
Done processing source/src/ports/nvdata/nvdata.h
Done processing source/src/ports/nvdata/nvqos.c
Done processing source/src/ports/nvdata/nvqos.h
Done processing source/src/ports/nvdata/nvtcpip.c
Done processing source/src/ports/nvdata/nvtcpip.h
Done processing source/src/ports/opener_error.h
Done processing source/src/ports/socket_timer.c
Done processing source/src/ports/socket_timer.h
Done processing source/src/trace.h
Done processing source/src/typedefs.h
Done processing source/src/utils/doublylinkedlist.c
Done processing source/src/utils/doublylinkedlist.h
Done processing source/src/utils/enipmessage.c
Done processing source/src/utils/enipmessage.h
Done processing source/src/utils/random.c
Done processing source/src/utils/random.h
Done processing source/src/utils/xorshiftrandom.c
Done processing source/src/utils/xorshiftrandom.h
Done processing source/tests/OpENerTests.h
Done processing source/tests/check_assert.h
Done processing source/tests/test_assert.h
Total errors found: 3360

(Truncated to last 3076 characters out of 371525)

❌ CPP / cpplint - 857 errors

/src/cip/cipstringi.h
Done processing source/src/cip/ciptcpipinterface.h
Done processing source/src/cip/ciptypes.h
Done processing source/src/enet_encap/cpf.h
Done processing source/src/enet_encap/encap.h
Done processing source/src/enet_encap/endianconv.h
Done processing source/src/opener_api.h
Done processing source/src/ports/MINGW/networkconfig.h
Done processing source/src/ports/MINGW/platform_network_includes.h
Done processing source/src/ports/MINGW/sample_application/ethlinkcbs.h
Done processing source/src/ports/MINGW/sample_application/opener_user_conf.h
Done processing source/src/ports/POSIX/networkconfig.h
Done processing source/src/ports/POSIX/platform_network_includes.h
Done processing source/src/ports/POSIX/sample_application/ethlinkcbs.h
Done processing source/src/ports/POSIX/sample_application/opener_user_conf.h
Done processing source/src/ports/STM32/networkconfig.h
Done processing source/src/ports/STM32/opener.h
Done processing source/src/ports/STM32/platform_network_includes.h
Done processing source/src/ports/STM32/sample_application/ethlinkcbs.h
Done processing source/src/ports/STM32/sample_application/opener_user_conf.h
Done processing source/src/ports/WIN32/networkconfig.h
Done processing source/src/ports/WIN32/platform_network_includes.h
Done processing source/src/ports/WIN32/sample_application/ethlinkcbs.h
Done processing source/src/ports/WIN32/sample_application/opener_user_conf.h
Done processing source/src/ports/generic_networkhandler.h
Done processing source/src/ports/networkhandler.h
Done processing source/src/ports/nvdata/conffile.h
Done processing source/src/ports/nvdata/nvdata.h
Done processing source/src/ports/nvdata/nvqos.h
Done processing source/src/ports/nvdata/nvtcpip.h
Done processing source/src/ports/opener_error.h
Done processing source/src/ports/socket_timer.h
Done processing source/src/trace.h
Done processing source/src/typedefs.h
Done processing source/src/utils/doublylinkedlist.h
Done processing source/src/utils/enipmessage.h
Done processing source/src/utils/random.h
Done processing source/src/utils/xorshiftrandom.h
Done processing source/tests/OpENerTests.cpp
Done processing source/tests/OpENerTests.h
Done processing source/tests/callback_mock.cpp
Done processing source/tests/check_assert.h
Done processing source/tests/cip/cipcommontests.cpp
Done processing source/tests/cip/cipconnectionmanagertest.cpp
Done processing source/tests/cip/cipconnectionobjecttest.cpp
Done processing source/tests/cip/cipelectronickeyformattest.cpp
Done processing source/tests/cip/cipelectronickeytest.cpp
Done processing source/tests/cip/cipepathtest.cpp
Done processing source/tests/cip/cipstringtests.cpp
Done processing source/tests/enet_encap/encaptest.cpp
Done processing source/tests/enet_encap/endianconvtest.cpp
Done processing source/tests/ports/socket_timer_tests.cpp
Done processing source/tests/test_assert.h
Done processing source/tests/utils/doublylinkedlistTests.cpp
Done processing source/tests/utils/randomTests.cpp
Done processing source/tests/utils/xorshiftrandomtests.cpp
Total errors found: 857

(Truncated to last 3076 characters out of 107681)

❌ COPYPASTE / jscpd - 266 errors

lines, 52 tokens)
   source/tests/cip/cipstringtests.cpp [50:43 - 55:49]
Clone found (cpp)
 - source/tests/utils/doublylinkedlistTests.cpp [109:31 - 117:23] (9 lines, 75 tokens)
   source/tests/utils/doublylinkedlistTests.cpp [147:31 - 155:23]
Clone found (cpp)
 - source/tests/utils/doublylinkedlistTests.cpp [110:18 - 117:23] (8 lines, 64 tokens)
   source/tests/utils/doublylinkedlistTests.cpp [124:18 - 131:23]
Clone found (cpp)
 - source/tests/utils/doublylinkedlistTests.cpp [169:39 - 177:47] (9 lines, 55 tokens)
   source/tests/utils/doublylinkedlistTests.cpp [182:43 - 190:47]
Clone found (cpp)
 - source/tests/utils/doublylinkedlistTests.cpp [195:40 - 203:48] (9 lines, 55 tokens)
   source/tests/utils/doublylinkedlistTests.cpp [208:45 - 216:48]
┌──────────┬────────────────┬─────────────┬──────────────┬──────────────┬──────────────────┬───────────────────┐
│ Format   │ Files analyzed │ Total lines │ Total tokens │ Clones found │ Duplicated lines │ Duplicated tokens │
├──────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ c        │ 55             │ 17896       │ 215060       │ 162          │ 3147 (17.58%)    │ 49779 (23.15%)    │
├──────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ c-header │ 57             │ 6746        │ 169872       │ 67           │ 1123 (16.65%)    │ 34482 (20.30%)    │
├──────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ cpp      │ 15             │ 2738        │ 19853        │ 19           │ 137 (5.00%)      │ 2896 (14.59%)     │
├──────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ diff     │ 1              │ 172         │ 2591         │ 1            │ 6 (3.49%)        │ 68 (2.62%)        │
├──────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ latex    │ 1              │ 309         │ 4392         │ 0            │ 0 (0.00%)        │ 0 (0.00%)         │
├──────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ python   │ 1              │ 38          │ 239          │ 0            │ 0 (0.00%)        │ 0 (0.00%)         │
├──────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ txt      │ 19             │ 1349        │ 11063        │ 17           │ 196 (14.53%)     │ 2600 (23.50%)     │
├──────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ Total:   │ 149            │ 29248       │ 423070       │ 266          │ 4609 (15.76%)    │ 89825 (21.23%)    │
└──────────┴────────────────┴─────────────┴──────────────┴──────────────┴──────────────────┴───────────────────┘
Found 266 clones.
HTML report saved to megalinter-reports/copy-paste/jscpd-report.html
ERROR: jscpd found too many duplicates (15.8%) over threshold (0.0%)
time: 793.344ms

(Truncated to last 3076 characters out of 41245)

❌ SPELL / lychee - 1 error

[WARN] Skipping file with invalid UTF-8 content: license.txt
  [WARN] license.txt: No files found for this input source
📝 Summary
---------------------
🔍 Total............8
🔗 Unique...........8
✅ Successful.......7
⏳ Timeouts.........0
🔀 Redirected.......2
👻 Excluded.........0
❓ Unknown..........0
🚫 Errors...........1
⛔ Unsupported......1

Errors in .github/workflows/build.yml
[404] https://github.com/$ (at 124:120) | Rejected status code: 404 Not Found

Hint: Followed 2 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`

❌ YAML / yamllint - 9 errors

.github/dependabot.yml
  1:1       warning  missing document start "---"  (document-start)

.github/workflows/build.yml
  1:1       warning  missing document start "---"  (document-start)
  1:29      warning  wrong new line character: expected \n  (new-lines)
  3:1       warning  truthy value should be one of [false, true]  (truthy)
  5:16      error    too many spaces inside brackets  (brackets)
  5:25      error    too many spaces inside brackets  (brackets)
  7:16      error    too many spaces inside brackets  (brackets)
  7:25      error    too many spaces inside brackets  (brackets)
  145:44    error    no new line character at the end of file  (new-line-at-end-of-file)

❌ ACTION / zizmor - 1 error

INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'artipacked' audit failed on file://.github/workflows/build.yml

Caused by:
    0: error in 'artipacked' audit
    1: couldn't list tags for actions/checkout
    2: request error while accessing GitHub API
    3: HTTP status client error (401 Unauthorized) for url (https://github.com/actions/checkout.git/git-upload-pack)

⚠️ MARKDOWN / markdownlint - 52 errors

Hard tabs [Column: 1]
README.md:72:1 error MD010/no-hard-tabs Hard tabs [Column: 1]
README.md:74:1 error MD010/no-hard-tabs Hard tabs [Column: 1]
README.md:78:41 error MD026/no-trailing-punctuation Trailing punctuation in heading [Punctuation: ':']
README.md:89 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
README.md:96:20 error MD026/no-trailing-punctuation Trailing punctuation in heading [Punctuation: ':']
README.md:102:1 error MD007/ul-indent Unordered list indentation [Expected: 2; Actual: 1]
README.md:102:1 error MD010/no-hard-tabs Hard tabs [Column: 1]
README.md:103:1 error MD007/ul-indent Unordered list indentation [Expected: 4; Actual: 2]
README.md:103:1 error MD010/no-hard-tabs Hard tabs [Column: 1]
README.md:104:1 error MD007/ul-indent Unordered list indentation [Expected: 4; Actual: 2]
README.md:104:1 error MD010/no-hard-tabs Hard tabs [Column: 1]
README.md:105:1 error MD007/ul-indent Unordered list indentation [Expected: 4; Actual: 2]
README.md:105:1 error MD010/no-hard-tabs Hard tabs [Column: 1]
README.md:106:1 error MD007/ul-indent Unordered list indentation [Expected: 4; Actual: 2]
README.md:106:1 error MD010/no-hard-tabs Hard tabs [Column: 1]
README.md:107:1 error MD007/ul-indent Unordered list indentation [Expected: 4; Actual: 2]
README.md:107:1 error MD010/no-hard-tabs Hard tabs [Column: 1]
README.md:108:1 error MD007/ul-indent Unordered list indentation [Expected: 2; Actual: 1]
README.md:108:1 error MD010/no-hard-tabs Hard tabs [Column: 1]
README.md:109:1 error MD007/ul-indent Unordered list indentation [Expected: 4; Actual: 2]
README.md:109:1 error MD010/no-hard-tabs Hard tabs [Column: 1]
README.md:110:1 error MD007/ul-indent Unordered list indentation [Expected: 4; Actual: 2]
README.md:110:1 error MD010/no-hard-tabs Hard tabs [Column: 1]
README.md:112:14 error MD026/no-trailing-punctuation Trailing punctuation in heading [Punctuation: ':']
README.md:123 error MD003/heading-style Heading style [Expected: setext; Actual: atx]
README.md:136 error MD003/heading-style Heading style [Expected: setext; Actual: atx]
README.md:139 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
README.md:154 error MD003/heading-style Heading style [Expected: setext; Actual: atx]
README.md:156 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
README.md:165 error MD003/heading-style Heading style [Expected: setext; Actual: atx]
README.md:170:26 error MD026/no-trailing-punctuation Trailing punctuation in heading [Punctuation: ':']
README.md:183:1 error MD018/no-missing-space-atx No space after hash on atx style heading [Context: "#Filename: Dockerfile"]
README.md:202:15 error MD026/no-trailing-punctuation Trailing punctuation in heading [Punctuation: ':']
README.md:207:23 error MD026/no-trailing-punctuation Trailing punctuation in heading [Punctuation: ':']
README.md:215 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]

(Truncated to last 3076 characters out of 4484)

⚠️ YAML / prettier - 1 error

Checking formatting...
[warn] .github/workflows/build.yml
[warn] Code style issues found in the above file. Run Prettier with --write to fix.

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

Documentation: Custom Flavors
Command: npx mega-linter-runner@10.1.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,ACTION_ZIZMOR,C_CPPCHECK,C_CPPLINT,C_CLANG_FORMAT,COPYPASTE_JSCPD,CPP_CPPCHECK,CPP_CPPLINT,CPP_CLANG_FORMAT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,XML_XMLLINT,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

Show us your support by starring ⭐ the repository

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 26, 2026

azoitl approved these changes Oct 26, 2026

View reviewed changes

azoitl merged commit 080eb87 into master Oct 26, 2026
1 of 3 checks passed

Navigation Menu

Repository navigation

Bump oxsecurity/megalinter from 10.0.0 to 10.1.0 - #614

Bump oxsecurity/megalinter from 10.0.0 to 10.1.0#614
azoitl merged 1 commit into
masterfrom
dependabot/github_actions/oxsecurity/megalinter-10.1.0

dependabot Bot commented on behalf of github Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 26, 2026

v10.1.0

What's Changed

[v10.1.0] - 2026-09-05

Uh oh!

github-actions Bot commented Oct 26, 2026

❌MegaLinter analysis: Error

Detailed Issues

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant