chore(deps): bump oxsecurity/megalinter from 8 to 10 - #3
Open
dependabot[bot] wants to merge 1 commit into
Open
Conversation
Bumps [oxsecurity/megalinter](https://github.com/oxsecurity/megalinter) from 8 to 10. - [Release notes](https://github.com/oxsecurity/megalinter/releases) - [Changelog](https://github.com/oxsecurity/megalinter/blob/main/CHANGELOG.md) - [Commits](oxsecurity/megalinter@v8...v10) --- updated-dependencies: - dependency-name: oxsecurity/megalinter dependency-version: '10' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Max errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|---|
| ✅ ACTION | actionlint | 2 | 0 | 0 | 0.03s | ||
| zizmor | 2 | 0 | 1 | 0 | 0.21s | ||
| ✅ COPYPASTE | jscpd | yes | no | no | 0.71s | ||
| djlint | 1 | 8 | 0 | 1.4s | |||
| ✅ HTML | htmlhint | 1 | 0 | 0 | 0.18s | ||
| markdownlint | 3 | 2 | 1 | 0 | 0.82s | ||
| ✅ MARKDOWN | markdown-table-formatter | 3 | 2 | 0 | 0 | 0.22s | |
| bandit | 29 | 87 | 0 | 1.86s | |||
| ✅ PYTHON | black | 29 | 3 | 0 | 0 | 2.1s | |
| flake8 | 29 | 6 | 0 | 1.26s | |||
| ✅ PYTHON | isort | 29 | 6 | 0 | 0 | 0.49s | |
| ✅ PYTHON | mypy | 29 | 0 | 0 | 9.24s | ||
| pylint | 29 | 34 | 0 | 8.62s | |||
| pyright | 29 | 31 | 0 | 4.21s | |||
| ruff | 29 | 6 | 2 | 0 | 0.04s | ||
| ✅ REPOSITORY | betterleaks | yes | no | no | 0.84s | ||
| ✅ REPOSITORY | checkov | yes | no | no | 19.44s | ||
| devskim | yes | 1 | no | 2.38s | |||
| ✅ REPOSITORY | dustilock | yes | no | no | 1.59s | ||
| ✅ REPOSITORY | git_diff | yes | no | no | 0.01s | ||
| ✅ REPOSITORY | grype | yes | no | no | 74.43s | ||
| ✅ REPOSITORY | kingfisher | yes | no | no | 26.65s | ||
| osv-scanner | yes | 25 | no | 9.13s | |||
| ✅ REPOSITORY | secretlint | yes | no | no | 1.4s | ||
| ✅ REPOSITORY | syft | yes | no | no | 1.97s | ||
| trivy | yes | 1 | no | 10.77s | |||
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.28s | ||
| ✅ REPOSITORY | trufflehog | yes | no | no | 4.62s | ||
| cspell | 43 | 167 | 0 | 10.95s | |||
| lychee | 9 | 6 | 0 | 1.26s | |||
| ✅ YAML | prettier | 4 | 1 | 0 | 0 | 0.36s | |
| ✅ YAML | v8r | 4 | 0 | 0 | 6.2s | ||
| ✅ YAML | yamllint | 4 | 0 | 0 | 0.42s |
Detailed Issues
⚠️ PYTHON / bandit - 87 errors
_translate.py:9:4
8 assert code == "fr"
9 assert name == "french"
10
--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Severity: Low Confidence: High
CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
Location: ./tests/test_translate.py:15:4
14 code, name = translate.detect_language(" ni hao to chinese (traditional)")
15 assert code == "zh-tw"
16
--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Severity: Low Confidence: High
CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
Location: ./tests/test_translate.py:20:4
19 code, name = translate.detect_language(" hello world")
20 assert code is None
21 assert name is None
--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Severity: Low Confidence: High
CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
Location: ./tests/test_translate.py:21:4
20 assert code is None
21 assert name is None
22
--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Severity: Low Confidence: High
CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
Location: ./tests/test_translate.py:26:4
25 # The original monolith mapped ~100 languages; ensure coverage kept.
26 assert len(translate.LANGUAGES) >= 100
27 assert translate.LANGUAGES["hi"] == "hindi"
--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Severity: Low Confidence: High
CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
Location: ./tests/test_translate.py:27:4
26 assert len(translate.LANGUAGES) >= 100
27 assert translate.LANGUAGES["hi"] == "hindi"
--------------------------------------------------
Code scanned:
Total lines of code: 1457
Total lines skipped (#nosec): 0
Total potential issues skipped due to specifically being disabled (e.g., #nosec BXXX): 0
Run metrics:
Total issues (by severity):
Undefined: 0
Low: 85
Medium: 0
High: 2
Total issues (by confidence):
Undefined: 0
Low: 0
Medium: 2
High: 85
Files skipped (0):
(Truncated to last 3076 characters out of 45859)
⚠️ SPELL / cspell - 167 errors
ions: []
tests/test_config.py:24:57 - Unknown word (OPENWEATHER) -- OLIVIA_EMAIL_PASSWORD", "OPENWEATHER_API_KEY", "NEWS_API
Suggestions: []
tests/test_config.py:25:21 - Unknown word (delenv) -- monkeypatch.delenv(k, raising=False)
Suggestions: [dele, deena, deled, deles, decent]
tests/test_config.py:26:17 - Unknown word (delenv) -- monkeypatch.delenv("OLIVIA_VOICE_INDEX
Suggestions: [dele, deena, deled, deles, decent]
tests/test_router.py:8:17 - Unknown word (autouse) -- @pytest.fixture(autouse=True)
Suggestions: [autos, arouse, aurous, auto's, autobus]
tests/test_search.py:36:28 - Unknown word (somethingweird) -- search.open_site("open somethingweird")
Suggestions: []
tests/test_search.py:37:13 - Unknown word (duckduckgo) -- assert "duckduckgo.com" in opened[0]
Suggestions: []
CSpell: Files checked: 43, Issues found: 167 in 24 files.
You can skip this misspellings by defining the following .cspell.json file at the root of your repository
Of course, please correct real typos before :)
{
"version": "0.2",
"language": "en",
"ignorePaths": [
"**/node_modules/**",
"**/vscode-extension/**",
"**/.git/**",
"**/.pnpm-lock.json",
".vscode",
"package-lock.json",
"megalinter-reports"
],
"words": [
"Chirag",
"ONENOTE",
"OPENWEATHER",
"POWERPNT",
"Pytest",
"SAPI",
"Singhal",
"TASKKILL",
"Tkinter",
"WINWORD",
"abhinav",
"autouse",
"capslock",
"celcius",
"chichewa",
"chirag",
"creds",
"ctypes",
"cuda",
"dailymotion",
"delenv",
"duckduckgo",
"gameover",
"googletrans",
"hackerearth",
"heythere",
"hotstar",
"htmlcov",
"ipify",
"jabong",
"kurmanji",
"lofi",
"luxembourgish",
"mspaint",
"myntra",
"nojekyll",
"numpy",
"odia",
"onenote",
"oriz",
"paytm",
"playonyt",
"psutil",
"pyautogui",
"pycache",
"pyjokes",
"pyowm",
"pyperclip",
"pyproject",
"pytest",
"pyttsx",
"pywhatkit",
"pywin",
"qbittorrent",
"quora",
"rundll",
"samplerate",
"sesotho",
"shona",
"shopclues",
"sinhala",
"snapdeal",
"somethingweird",
"soundcloud",
"sounddevice",
"stackoverflow",
"startfile",
"taskmgr",
"udacity",
"udemy",
"unmute",
"uyghur",
"venv",
"wassup",
"wikibooks",
"wikinews",
"wikiquote",
"wikisource",
"wikispecies",
"wikiversity",
"wikivoyage",
"winshell",
"wmplayer",
"wordpad"
]
}
You can also copy-paste megalinter-reports/.cspell.json at the root of your repository
(Truncated to last 3076 characters out of 25920)
⚠️ REPOSITORY / devskim - 1 error
{"$schema":"https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0-rtm.6.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"devskim","fullName":"Microsoft DevSkim Command Line Interface","version":"1.0.70+d69541fde7","informationUri":"https://github.com/microsoft/DevSkim/","rules":[{"id":"DS148264","name":"DoNotUseWeaknoncryptographicRandomNumberGenerators","fullDescription":{"text":"Do not use weak/non-cryptographic random number generators: Use cryptographic random numbers generators for anything even close to a security function."},"help":{"text":"Replacements depend on language.","markdown":"Replacements depend on language. Visit [https://github.com/Microsoft/DevSkim/blob/main/guidance/DS148264.md](https://github.com/Microsoft/DevSkim/blob/main/guidance/DS148264.md) for additional guidance on this issue."},"shortDescription":{"text":"Use cryptographic random numbers generators for anything even close to a security function."},"defaultConfiguration":{"level":"error"},"helpUri":"https://github.com/Microsoft/DevSkim/blob/main/guidance/DS148264.md","properties":{"precision":"high","problem.severity":"warning","DevSkimSeverity":"Important","DevSkimConfidence":"High"}}]}},"versionControlProvenance":[{"repositoryUri":"https://github.com/chirag127/olivia","revisionId":"1ae49239a14310eba4fca7fc083a2cd15094b4f2","branch":"(no branch)"}],"results":[{"ruleId":"DS148264","level":"error","message":{"text":"Do not use weak/non-cryptographic random number generators"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/olivia/skills/fun.py"},"region":{"startLine":80,"startColumn":11,"endLine":80,"endColumn":19,"charOffset":2087,"charLength":8,"snippet":{"text":"shuffle(","rendered":{"text":"shuffle(","markdown":"`shuffle(`"}},"sourceLanguage":"python"}}}],"properties":{"tags":["Cryptography.PRNG.Weak"],"DevSkimSeverity":"Important","DevSkimConfidence":"High"}}],"columnKind":"utf16CodeUnits"}]}
⚠️ HTML / djlint - 8 errors
::warning file=docs/index.html,line=43::H015 Follow h tags with a line break.
::warning file=docs/index.html,line=44::H015 Follow h tags with a line break.
::warning file=docs/index.html,line=45::H015 Follow h tags with a line break.
::warning file=docs/index.html,line=46::H015 Follow h tags with a line break.
::warning file=docs/index.html,line=47::H015 Follow h tags with a line break.
::warning file=docs/index.html,line=48::H015 Follow h tags with a line break.
::warning file=docs/index.html,line=49::H015 Follow h tags with a line break.
::warning file=docs/index.html,line=50::H015 Follow h tags with a line break.
⚠️ PYTHON / flake8 - 6 errors
src/olivia/core/assistant.py:40:89: E501 line too long (96 > 88 characters)
src/olivia/core/speech.py:52:89: E501 line too long (90 > 88 characters)
src/olivia/skills/automation.py:1:89: E501 line too long (91 > 88 characters)
src/olivia/skills/media.py:28:5: F841 local variable 'img' is assigned to but never used
src/olivia/skills/media.py:54:89: E501 line too long (93 > 88 characters)
tests/test_tic_tac_toe.py:7:1: E741 ambiguous variable name 'O'
⚠️ SPELL / lychee - 6 errors
📝 Summary
---------------------
🔍 Total...........24
🔗 Unique..........22
✅ Successful......18
⏳ Timeouts.........0
🔀 Redirected.......2
👻 Excluded.........0
❓ Unknown..........0
🚫 Errors...........6
⛔ Unsupported......6
Errors in docs/index.html
[503] https://github.com/chirag127 (at 60:44) | Rejected status code: 503 Service Unavailable
[503] https://github.com/chirag127/olivia (at 37:34) | Rejected status code: 503 Service Unavailable
[503] https://github.com/chirag127/olivia (at 60:99) | Rejected status code: 503 Service Unavailable
[503] https://github.com/chirag127/olivia#setup (at 38:32) | Rejected status code: 503 Service Unavailable
Errors in README.md
[503] https://github.com/chirag127/olivia/actions/workflows/ci.yml (at 9:1) | Rejected status code: 503 Service Unavailable
[404] https://github.com/chirag127/olivia/stargazers (at 7:1) | Rejected status code: 404 Not Found
Hint: Followed 2 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
⚠️ MARKDOWN / markdownlint - 1 error
README.md:42 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
⚠️ REPOSITORY / osv-scanner - 25 errors
12.2.0 | requirements.txt |
| https://osv.dev/GHSA-r73j-pqj5-w3x7 | | | | | | |
| https://osv.dev/PYSEC-2026-3451 | 7.5 | PyPI | pillow | 9.5.0 | 12.3.0 | requirements.txt |
| https://osv.dev/GHSA-6r8x-57c9-28j4 | | | | | | |
| https://osv.dev/PYSEC-2026-3453 | 7.5 | PyPI | pillow | 9.5.0 | 12.3.0 | requirements.txt |
| https://osv.dev/GHSA-9hw9-ch79-4vh6 | | | | | | |
| https://osv.dev/PYSEC-2026-3454 | 8.2 | PyPI | pillow | 9.5.0 | 12.3.0 | requirements.txt |
| https://osv.dev/GHSA-xj96-63gp-2gmr | | | | | | |
| https://osv.dev/PYSEC-2026-3493 | 8.3 | PyPI | pillow | 9.5.0 | 12.3.0 | requirements.txt |
| https://osv.dev/GHSA-62p4-gmf7-7g93 | | | | | | |
| https://osv.dev/PYSEC-2026-3494 | 6.5 | PyPI | pillow | 9.5.0 | 12.3.0 | requirements.txt |
| https://osv.dev/GHSA-fj7v-r99m-22gq | | | | | | |
| https://osv.dev/PYSEC-2026-3495 | 7.5 | PyPI | pillow | 9.5.0 | 12.3.0 | requirements.txt |
| https://osv.dev/GHSA-jjj6-mw9f-p565 | | | | | | |
| https://osv.dev/PYSEC-2026-3496 | 8.7 | PyPI | pillow | 9.5.0 | 12.3.0 | requirements.txt |
| https://osv.dev/GHSA-vjc4-5qp5-m44j | | | | | | |
| https://osv.dev/PYSEC-2026-457 | 9.3 | PyPI | pillow | 9.5.0 | 10.2.0 | requirements.txt |
| https://osv.dev/GHSA-3f63-hfp8-52jq | | | | | | |
| https://osv.dev/PYSEC-2022-43012 | 8.7 | PyPI | setuptools | 9.1.0 | 65.5.1 | requirements.txt |
| https://osv.dev/GHSA-r9hx-vwmv-q579 | | | | | | |
| https://osv.dev/PYSEC-2025-49 | 8.8 | PyPI | setuptools | 9.1.0 | 78.1.1 | requirements.txt |
| https://osv.dev/GHSA-5rjg-fvgr-3xxf | | | | | | |
| https://osv.dev/PYSEC-2026-1918 | 8.8 | PyPI | setuptools | 9.1.0 | 70.0.0 | requirements.txt |
| https://osv.dev/GHSA-cx63-2mw6-8hw5 | | | | | | |
| https://osv.dev/PYSEC-2026-3447 | 6.1 | PyPI | setuptools | 9.1.0 | 83.0.0 | requirements.txt |
| https://osv.dev/GHSA-h35f-9h28-mq5c | | | | | | |
+-------------------------------------+------+-----------+------------+---------+---------------+------------------+
(Truncated to last 3076 characters out of 6801)
⚠️ PYTHON / pylint - 34 errors
68:4: E0401: Unable to import 'sounddevice' (import-error)
************* Module olivia.games.tic_tac_toe
src/olivia/games/tic_tac_toe.py:3:0: E0401: Unable to import 'numpy' (import-error)
************* Module olivia.skills.automation
src/olivia/skills/automation.py:78:12: E1101: Module 'os' has no 'startfile' member (no-member)
src/olivia/skills/automation.py:94:4: E0401: Unable to import 'pyautogui' (import-error)
src/olivia/skills/automation.py:117:4: E0401: Unable to import 'pyautogui' (import-error)
src/olivia/skills/automation.py:135:4: E0401: Unable to import 'pyautogui' (import-error)
************* Module olivia.skills.communication
src/olivia/skills/communication.py:33:4: E0401: Unable to import 'pyautogui' (import-error)
************* Module olivia.skills.fun
src/olivia/skills/fun.py:7:0: E0401: Unable to import 'requests' (import-error)
src/olivia/skills/fun.py:19:4: E0401: Unable to import 'pyjokes' (import-error)
************* Module olivia.skills.media
src/olivia/skills/media.py:15:4: E0401: Unable to import 'pywhatkit' (import-error)
src/olivia/skills/media.py:23:4: E0401: Unable to import 'pyautogui' (import-error)
src/olivia/skills/media.py:55:4: E0401: Unable to import 'pyautogui' (import-error)
************* Module olivia.skills.news
src/olivia/skills/news.py:3:0: E0401: Unable to import 'requests' (import-error)
************* Module olivia.skills.search
src/olivia/skills/search.py:84:4: E0401: Unable to import 'wikipedia' (import-error)
src/olivia/skills/search.py:98:4: E0401: Unable to import 'wikipedia' (import-error)
************* Module olivia.skills.system
src/olivia/skills/system.py:9:4: E0401: Unable to import 'psutil' (import-error)
src/olivia/skills/system.py:15:4: E0401: Unable to import 'psutil' (import-error)
src/olivia/skills/system.py:21:4: E0401: Unable to import 'psutil' (import-error)
src/olivia/skills/system.py:27:4: E0401: Unable to import 'psutil' (import-error)
src/olivia/skills/system.py:33:4: E0401: Unable to import 'psutil' (import-error)
src/olivia/skills/system.py:41:4: E0401: Unable to import 'requests' (import-error)
************* Module olivia.skills.translate
src/olivia/skills/translate.py:138:4: E0401: Unable to import 'googletrans' (import-error)
************* Module olivia.skills.weather
src/olivia/skills/weather.py:15:4: E0401: Unable to import 'pyowm' (import-error)
src/olivia/skills/weather.py:32:4: E0401: Unable to import 'speedtest' (import-error)
************* Module olivia.utils.helpers
src/olivia/utils/helpers.py:52:4: E0401: Unable to import 'pyperclip' (import-error)
src/olivia/utils/helpers.py:61:4: E0401: Unable to import 'pyautogui' (import-error)
src/olivia/utils/helpers.py:70:4: E0401: Unable to import 'pyautogui' (import-error)
************* Module test_imports
tests/test_imports.py:5:0: E0401: Unable to import 'pytest' (import-error)
************* Module test_router
tests/test_router.py:3:0: E0401: Unable to import 'pytest' (import-error)
************* Module test_tic_tac_toe
tests/test_tic_tac_toe.py:3:0: E0401: Unable to import 'numpy' (import-error)
(Truncated to last 3076 characters out of 3556)
⚠️ PYTHON / pyright - 31 errors
"__fspath__" is not present (reportArgumentType)
src/olivia/skills/media.py:55:12 - warning: Import "pyautogui" could not be resolved from source (reportMissingModuleSource)
src/olivia/skills/search.py
src/olivia/skills/search.py:84:12 - error: Import "wikipedia" could not be resolved (reportMissingImports)
src/olivia/skills/search.py:98:12 - error: Import "wikipedia" could not be resolved (reportMissingImports)
src/olivia/skills/system.py
src/olivia/skills/system.py:9:12 - warning: Import "psutil" could not be resolved from source (reportMissingModuleSource)
src/olivia/skills/system.py:15:12 - warning: Import "psutil" could not be resolved from source (reportMissingModuleSource)
src/olivia/skills/system.py:21:12 - warning: Import "psutil" could not be resolved from source (reportMissingModuleSource)
src/olivia/skills/system.py:27:12 - warning: Import "psutil" could not be resolved from source (reportMissingModuleSource)
src/olivia/skills/system.py:29:59 - error: "percent" is not a known attribute of "None" (reportOptionalMemberAccess)
src/olivia/skills/system.py:33:12 - warning: Import "psutil" could not be resolved from source (reportMissingModuleSource)
src/olivia/skills/system.py:35:40 - error: "power_plugged" is not a known attribute of "None" (reportOptionalMemberAccess)
src/olivia/skills/translate.py
src/olivia/skills/translate.py:138:10 - error: Import "googletrans" could not be resolved (reportMissingImports)
src/olivia/skills/weather.py
src/olivia/skills/weather.py:15:10 - error: Import "pyowm" could not be resolved (reportMissingImports)
src/olivia/skills/weather.py:32:12 - error: Import "speedtest" could not be resolved (reportMissingImports)
src/olivia/utils/helpers.py
src/olivia/utils/helpers.py:52:12 - warning: Import "pyperclip" could not be resolved from source (reportMissingModuleSource)
src/olivia/utils/helpers.py:61:12 - warning: Import "pyautogui" could not be resolved from source (reportMissingModuleSource)
src/olivia/utils/helpers.py:70:12 - warning: Import "pyautogui" could not be resolved from source (reportMissingModuleSource)
tests/test_helpers.py
tests/test_helpers.py:11:13 - error: Method "now" overrides class "datetime" in an incompatible manner
Positional parameter count mismatch; base method has 2, but override has 1
Parameter 2 mismatch: base parameter "tz" is keyword parameter, override parameter is position-only (reportIncompatibleMethodOverride)
tests/test_helpers.py:23:13 - error: Method "now" overrides class "datetime" in an incompatible manner
Positional parameter count mismatch; base method has 2, but override has 1
Parameter 2 mismatch: base parameter "tz" is keyword parameter, override parameter is position-only (reportIncompatibleMethodOverride)
tests/test_imports.py
tests/test_imports.py:5:8 - error: Import "pytest" could not be resolved (reportMissingImports)
tests/test_router.py
tests/test_router.py:3:8 - error: Import "pytest" could not be resolved (reportMissingImports)
31 errors, 14 warnings, 0 informations
(Truncated to last 3076 characters out of 10897)
⚠️ PYTHON / ruff - 2 errors
F841 Local variable `img` is assigned to but never used
--> src/olivia/skills/media.py:28:5
|
26 | os.makedirs(config.SCREENSHOT_DIR, exist_ok=True)
27 | path = os.path.join(config.SCREENSHOT_DIR, name + ".png")
28 | img = pyautogui.screenshot(path)
| ^^^
29 | print("Screenshot taken")
30 | return path
|
help: Remove assignment to unused variable `img`
E741 Ambiguous variable name: `O`
--> tests/test_tic_tac_toe.py:7:1
|
6 | X = -1
7 | O = 1
| ^
Found 2 errors.
No fixes available (1 hidden fix can be enabled with the `--unsafe-fixes` option).
⚠️ REPOSITORY / trivy - 1 error
234.65 KiB / 234.65 KiB [------------------------------------------------------] 100.00% ? p/s 100ms2026-08-12T20:32:12Z INFO Number of language-specific files num=1
2026-08-12T20:32:12Z INFO [pip] Detecting vulnerabilities...
2026-08-12T20:32:12Z INFO Detected config files num=0
Report Summary
┌──────────────────┬──────┬─────────────────┬───────────────────┐
│ Target │ Type │ Vulnerabilities │ Misconfigurations │
├──────────────────┼──────┼─────────────────┼───────────────────┤
│ requirements.txt │ pip │ 2 │ - │
└──────────────────┴──────┴─────────────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)
For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.73/guide/supply-chain/vex/repo#publishing-vex-documents
To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.
requirements.txt (pip)
======================
Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 0, CRITICAL: 0)
┌──────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├──────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ requests │ CVE-2024-47081 │ MEDIUM │ fixed │ 2.32.3 │ 2.32.4 │ requests: Requests vulnerable to .netrc credentials leak via │
│ │ │ │ │ │ │ malicious URLs │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-47081 │
│ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2026-25645 │ │ │ │ 2.33.0 │ requests: Requests: Security bypass due to predictable │
│ │ │ │ │ │ │ temporary file creation │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2026-25645 │
└──────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘
(Truncated to last 3076 characters out of 7295)
⚠️ ACTION / zizmor - 1 error
INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'ref-confusion' audit failed on file://.github/workflows/ci.yml
Caused by:
0: error in 'ref-confusion' audit
1: couldn't list branches for actions/checkout
2: request error while accessing GitHub API
3: HTTP status client error (401 Unauthorized) for url (https://github.com/actions/checkout.git/git-upload-pack)
[ACTION_ZIZMOR_ERROR_GITHUB_API_UNREACHABLE] Zizmor could not access a repository referenced by a `uses:` clause via the GitHub API (missing token, insufficient scope, or cross-repo private access).
To allow zizmor to authenticate with GITHUB_TOKEN (or a PAT with `Contents: read-only`), whitelist the variable in your .mega-linter.yml:
ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
- GITHUB_TOKEN
If the referenced workflow is in a private repo outside the current one, provide a PAT with cross-repo access instead of the default GITHUB_TOKEN, or run zizmor in offline mode.
See detailed reports in MegaLinter artifacts
Show us your support by starring ⭐ the repository
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps oxsecurity/megalinter from 8 to 10.
Release notes
Sourced from oxsecurity/megalinter's releases.
... (truncated)
Changelog
Sourced from oxsecurity/megalinter's changelog.
... (truncated)
Commits
15e5b45Release MegaLinter v10.0.0861855amegalinter-setup skill: enforce ghcr.io image references in upgrade mode (#8694)572dc81[automation] Auto-update linters version, help and documentation (#8695)2f62977Refresh OX Security PR comment banner and home page banner (#8692)3b8c632chore(deps): update dependency mongodb/kingfisher to v1.112.0 (#8691)7efac01chore(deps): update mstruebing/editorconfig-checker docker tag to v3.10.0 (#8...8cea326Make custom flavor generator output pass MegaLinter (#8686)a057dcb[automation] Auto-update linters version, help and documentation (#8690)6dece72chore(deps): update dependency virtualenv to v21.7.2 (#8683)08a6d16docs: highlight impactful contributors in the Special thanks section (#8688)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)