Skip to content

chore(deps): bump oxsecurity/megalinter from 8 to 10 - #3

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/oxsecurity/megalinter-10
Open

chore(deps): bump oxsecurity/megalinter from 8 to 10#3
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/oxsecurity/megalinter-10

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 12, 2026

Copy link
Copy Markdown

Bumps oxsecurity/megalinter from 8 to 10.

Release notes

Sourced from oxsecurity/megalinter's releases.

v10.0.0

What's Changed

  • Breaking changes

    • Removed 14 deprecated or long-disabled linters, and the API, MAKEFILE and PUPPET descriptors, which had no other linter left. MegaLinter does not provide Makefile and Puppet linting anymore. See the new Removed linters page for the full list and suggested replacements. (#8606)
    • REPOSITORY_GITLEAKS has been removed: migrate to REPOSITORY_BETTERLEAKS, which reads your existing .gitleaks.toml and .gitleaksignore files unchanged. (#8606)
    • Existing .mega-linter.yml files keep working: configuration variables of removed linters are simply ignored (a single notice lists any found in your configuration) and remain valid in the JSON schema. (#8606)
    • API Reporter payload v2 replaces the v1 payload: metric series are renamed (linter_run_* becomes megalinter_linter_run_*, plus new run-level megalinter_run_* series), and the old docs/grafana dashboards are superseded. Re-provision the new dashboards with npx mega-linter-runner --upload-dashboards grafana — see the migration notes. Legacy NOTIF_API_* variables remain supported as aliases. (#8661)
    • Linters now time out after 5 minutes by default (LINTER_TIMEOUT_SECONDS: 300): a linter exceeding it is killed and reported as an error (exit code 124) instead of running (or hanging) unbounded. If some of your linters legitimately run longer, raise the limit globally with LINTER_TIMEOUT_SECONDS, per linter with <LINTER_KEY>_TIMEOUT_SECONDS, or restore the previous unbounded behavior with value 0. (#8665)
  • Core

    • Coding agents integration: MegaLinter can now be driven by Claude Code, Cursor CLI, GitHub Copilot CLI, Codex and many other coding agents — see the new Coding Agents documentation page (#8614)
      • Install the MegaLinter agent skills with npx skills add oxsecurity/megalinter
      • Then ask your agent to set up MegaLinter (megalinter-setup), watch CI or local runs (megalinter-check) or fix lint errors (megalinter-fix)
      • Before the first local run, the skills now make sure the user is aware that MegaLinter is Docker-based and needs a good computer configuration and internet connection (the image download can weigh several GB), and suggest watching CI results instead when that is a problem
      • Local runs launched by the skills now cap PARALLEL_PROCESS_NUMBER to 4 on local computers (CI runs keep one parallel linter process per CPU core), so linting does not saturate the machine
      • Local runs launched by the skills now always activate the JSON reporter (not generated by default) to read results reliably, and fall back to the report folder configuration then the console output instead of waiting for report files that a repository configuration may have disabled
    • Excluded directories are now forwarded to project-mode linters, massively speeding up local runs, fixes #8645
      • Linters that scan the whole workspace by themselves (REPOSITORY_TRIVY, REPOSITORY_CHECKOV, REPOSITORY_GRYPE, REPOSITORY_TRUFFLEHOG, REPOSITORY_SEMGREP and 50+ others) used to crawl everything, including build caches and node_modules: a seconds-long CI lint could take hours on a local checkout
      • MegaLinter now automatically passes the excluded directories (defaults, EXCLUDED_DIRECTORIES, ADDITIONAL_EXCLUDED_DIRECTORIES, and directories detected in FILTER_REGEX_EXCLUDE) to each of these linters, through its native exclusion flags or a generated ignore/config file
      • Every forwarded exclusion is logged in the linter's console section, and the ">300 gitignored files" performance warning now names the heaviest directories it found
      • Opt out globally with FORWARD_EXCLUDED_DIRECTORIES: false, or per linter with <LINTER_KEY>_FORWARD_EXCLUDED_DIRECTORIES: false
    • Default excluded directories now also include common build/cache folders: .wireit, .turbo, .nx, .yarn/cache, .pnpm-store, .parcel-cache, .angular, and the Salesforce CLI .sf / .sfdx state folders (#8646)
    • New per-linter timeout: a linter still running after 5 minutes (LINTER_TIMEOUT_SECONDS: 300 by default) is killed along with all its child processes and reported as an error (exit code 124) with an actionable message, while the other linters keep running. Raise the limit globally with LINTER_TIMEOUT_SECONDS, per linter with <LINTER_KEY>_TIMEOUT_SECONDS, or disable it with value 0 (#8665)
    • New prerun analysis mode (mega-linter-runner --prerun, or MEGALINTER_PRERUN=true environment variable): MegaLinter identifies active linters and collects files, then stops before running any linter and suggests configuration improvements, in the console and in megalinter-reports/prerun-report.json (#8653)
      • Suggested exclusions: top-level directories containing only gitignored files (safe: linting scope is unchanged, and project-mode linters stop scanning them), and well-known generated/vendored folder names (site, dist, vendor...) still containing lintable files (to confirm by the user)
      • A lighter matching flavor is also suggested when available
      • The megalinter-check agent skill uses it on the first local run to tune .mega-linter.yml with the user before the real lint
      • Fixed a performance issue where detecting .gitignored files enumerated every individual file inside large ignored folders (node_modules, build output...) instead of stopping at the folder boundary, which could make the file collection step (including prerun) take several minutes on big repositories
    • Much lighter Docker images: the main image download shrinks by 9%, flavors by 9% to 22%, and standalone megalinter-only-* images are 35% to 65% smaller (#8621)
      • If your PRE_COMMANDS compile native code: the compilation toolchain is no longer shipped in the images, install it back with apk add --no-cache gcc make musl-dev

      • Main and flavor images, compressed download size on ghcr.io, linux/amd64 (before = v9.6.0, so deltas also include the linters removed in this version):

        Image Before After Delta
        megalinter (main) 4.55 GB 4.13 GB -9%
        megalinter-c_cpp 1.61 GB 1.35 GB -16%
        megalinter-ci_light 724 MB 657 MB -9%
        megalinter-cupcake 2.52 GB 2.24 GB -11%
        megalinter-documentation 1.47 GB 1.21 GB -18%
        megalinter-dotnet 2.23 GB 1.86 GB -17%
        megalinter-dotnetweb 2.25 GB 1.88 GB -17%
        megalinter-formatters 936 MB 849 MB -9%
        megalinter-go 1.55 GB 1.35 GB -13%
        megalinter-java 1.59 GB 1.32 GB -17%
        megalinter-javascript 1.49 GB 1.23 GB -18%
        megalinter-php 1.51 GB 1.26 GB -17%
        megalinter-python 1.61 GB 1.26 GB -22%
        megalinter-ruby 1.49 GB 1.22 GB -18%
        megalinter-rust 1.99 GB 1.80 GB -10%

... (truncated)

Changelog

Sourced from oxsecurity/megalinter's changelog.

[v10.0.0] - 2026-08-08

  • Breaking changes

    • Removed 14 deprecated or long-disabled linters, and the API, MAKEFILE and PUPPET descriptors, which had no other linter left. MegaLinter does not provide Makefile and Puppet linting anymore. See the new Removed linters page for the full list and suggested replacements. (#8606)
    • REPOSITORY_GITLEAKS has been removed: migrate to REPOSITORY_BETTERLEAKS, which reads your existing .gitleaks.toml and .gitleaksignore files unchanged. (#8606)
    • Existing .mega-linter.yml files keep working: configuration variables of removed linters are simply ignored (a single notice lists any found in your configuration) and remain valid in the JSON schema. (#8606)
    • API Reporter payload v2 replaces the v1 payload: metric series are renamed (linter_run_* becomes megalinter_linter_run_*, plus new run-level megalinter_run_* series), and the old docs/grafana dashboards are superseded. Re-provision the new dashboards with npx mega-linter-runner --upload-dashboards grafana — see the migration notes. Legacy NOTIF_API_* variables remain supported as aliases. (#8661)
    • Linters now time out after 5 minutes by default (LINTER_TIMEOUT_SECONDS: 300): a linter exceeding it is killed and reported as an error (exit code 124) instead of running (or hanging) unbounded. If some of your linters legitimately run longer, raise the limit globally with LINTER_TIMEOUT_SECONDS, per linter with <LINTER_KEY>_TIMEOUT_SECONDS, or restore the previous unbounded behavior with value 0. (#8665)
  • Core

    • Coding agents integration: MegaLinter can now be driven by Claude Code, Cursor CLI, GitHub Copilot CLI, Codex and many other coding agents — see the new Coding Agents documentation page (#8614)
      • Install the MegaLinter agent skills with npx skills add oxsecurity/megalinter
      • Then ask your agent to set up MegaLinter (megalinter-setup), watch CI or local runs (megalinter-check) or fix lint errors (megalinter-fix)
      • Before the first local run, the skills now make sure the user is aware that MegaLinter is Docker-based and needs a good computer configuration and internet connection (the image download can weigh several GB), and suggest watching CI results instead when that is a problem
      • Local runs launched by the skills now cap PARALLEL_PROCESS_NUMBER to 4 on local computers (CI runs keep one parallel linter process per CPU core), so linting does not saturate the machine
      • Local runs launched by the skills now always activate the JSON reporter (not generated by default) to read results reliably, and fall back to the report folder configuration then the console output instead of waiting for report files that a repository configuration may have disabled
    • Excluded directories are now forwarded to project-mode linters, massively speeding up local runs, fixes #8645
      • Linters that scan the whole workspace by themselves (REPOSITORY_TRIVY, REPOSITORY_CHECKOV, REPOSITORY_GRYPE, REPOSITORY_TRUFFLEHOG, REPOSITORY_SEMGREP and 50+ others) used to crawl everything, including build caches and node_modules: a seconds-long CI lint could take hours on a local checkout
      • MegaLinter now automatically passes the excluded directories (defaults, EXCLUDED_DIRECTORIES, ADDITIONAL_EXCLUDED_DIRECTORIES, and directories detected in FILTER_REGEX_EXCLUDE) to each of these linters, through its native exclusion flags or a generated ignore/config file
      • Every forwarded exclusion is logged in the linter's console section, and the ">300 gitignored files" performance warning now names the heaviest directories it found
      • Opt out globally with FORWARD_EXCLUDED_DIRECTORIES: false, or per linter with <LINTER_KEY>_FORWARD_EXCLUDED_DIRECTORIES: false
    • Default excluded directories now also include common build/cache folders: .wireit, .turbo, .nx, .yarn/cache, .pnpm-store, .parcel-cache, .angular, and the Salesforce CLI .sf / .sfdx state folders (#8646)
    • New per-linter timeout: a linter still running after 5 minutes (LINTER_TIMEOUT_SECONDS: 300 by default) is killed along with all its child processes and reported as an error (exit code 124) with an actionable message, while the other linters keep running. Raise the limit globally with LINTER_TIMEOUT_SECONDS, per linter with <LINTER_KEY>_TIMEOUT_SECONDS, or disable it with value 0 (#8665)
    • New prerun analysis mode (mega-linter-runner --prerun, or MEGALINTER_PRERUN=true environment variable): MegaLinter identifies active linters and collects files, then stops before running any linter and suggests configuration improvements, in the console and in megalinter-reports/prerun-report.json (#8653)
      • Suggested exclusions: top-level directories containing only gitignored files (safe: linting scope is unchanged, and project-mode linters stop scanning them), and well-known generated/vendored folder names (site, dist, vendor...) still containing lintable files (to confirm by the user)
      • A lighter matching flavor is also suggested when available
      • The megalinter-check agent skill uses it on the first local run to tune .mega-linter.yml with the user before the real lint
      • Fixed a performance issue where detecting .gitignored files enumerated every individual file inside large ignored folders (node_modules, build output...) instead of stopping at the folder boundary, which could make the file collection step (including prerun) take several minutes on big repositories
    • Much lighter Docker images: the main image download shrinks by 9%, flavors by 9% to 22%, and standalone megalinter-only-* images are 35% to 65% smaller (#8621)
      • If your PRE_COMMANDS compile native code: the compilation toolchain is no longer shipped in the images, install it back with apk add --no-cache gcc make musl-dev

      • Main and flavor images, compressed download size on ghcr.io, linux/amd64 (before = v9.6.0, so deltas also include the linters removed in this version):

        Image Before After Delta
        megalinter (main) 4.55 GB 4.13 GB -9%
        megalinter-c_cpp 1.61 GB 1.35 GB -16%
        megalinter-ci_light 724 MB 657 MB -9%
        megalinter-cupcake 2.52 GB 2.24 GB -11%
        megalinter-documentation 1.47 GB 1.21 GB -18%
        megalinter-dotnet 2.23 GB 1.86 GB -17%
        megalinter-dotnetweb 2.25 GB 1.88 GB -17%
        megalinter-formatters 936 MB 849 MB -9%
        megalinter-go 1.55 GB 1.35 GB -13%
        megalinter-java 1.59 GB 1.32 GB -17%
        megalinter-javascript 1.49 GB 1.23 GB -18%
        megalinter-php 1.51 GB 1.26 GB -17%
        megalinter-python 1.61 GB 1.26 GB -22%
        megalinter-ruby 1.49 GB 1.22 GB -18%
        megalinter-rust 1.99 GB 1.80 GB -10%
        megalinter-salesforce 2.09 GB 1.87 GB -10%

... (truncated)

Commits
  • 15e5b45 Release MegaLinter v10.0.0
  • 861855a megalinter-setup skill: enforce ghcr.io image references in upgrade mode (#8694)
  • 572dc81 [automation] Auto-update linters version, help and documentation (#8695)
  • 2f62977 Refresh OX Security PR comment banner and home page banner (#8692)
  • 3b8c632 chore(deps): update dependency mongodb/kingfisher to v1.112.0 (#8691)
  • 7efac01 chore(deps): update mstruebing/editorconfig-checker docker tag to v3.10.0 (#8...
  • 8cea326 Make custom flavor generator output pass MegaLinter (#8686)
  • a057dcb [automation] Auto-update linters version, help and documentation (#8690)
  • 6dece72 chore(deps): update dependency virtualenv to v21.7.2 (#8683)
  • 08a6d16 docs: highlight impactful contributors in the Special thanks section (#8688)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [oxsecurity/megalinter](https://github.com/oxsecurity/megalinter) from 8 to 10.
- [Release notes](https://github.com/oxsecurity/megalinter/releases)
- [Changelog](https://github.com/oxsecurity/megalinter/blob/main/CHANGELOG.md)
- [Commits](oxsecurity/megalinter@v8...v10)

---
updated-dependencies:
- dependency-name: oxsecurity/megalinter
  dependency-version: '10'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 12, 2026
@github-actions

Copy link
Copy Markdown

⚠️MegaLinter analysis: Success with warnings

Descriptor Linter Files Fixed Errors Max errors Warnings Elapsed time
✅ ACTION actionlint 4 0 0 0.1s
⚠️ ACTION zizmor 4 0 1 0 0.28s
⚠️ COPYPASTE jscpd yes 19 no 0.82s
⚠️ JAVASCRIPT standard 31 28 1 0 7.43s
✅ JSON jsonlint 2 0 0 0.13s
✅ JSON npm-package-json-lint yes no no 0.43s
✅ JSON prettier 2 1 0 0 0.46s
✅ JSON v8r 2 0 0 8.6s
⚠️ MARKDOWN markdownlint 32 32 30 0 1.64s
✅ MARKDOWN markdown-table-formatter 32 32 0 0 0.39s
✅ REPOSITORY betterleaks yes no no 0.99s
✅ REPOSITORY checkov yes no no 26.78s
⚠️ REPOSITORY devskim yes 1 no 2.26s
✅ REPOSITORY dustilock yes no no 0.02s
✅ REPOSITORY git_diff yes no no 0.03s
✅ REPOSITORY grype yes no no 75.61s
✅ REPOSITORY kingfisher yes no no 23.55s
✅ REPOSITORY osv-scanner yes no no 0.15s
✅ REPOSITORY secretlint yes no no 1.64s
✅ REPOSITORY syft yes no no 2.23s
✅ REPOSITORY trivy yes no no 12.58s
✅ REPOSITORY trivy-sbom yes no no 0.18s
✅ REPOSITORY trufflehog yes no no 5.1s
⚠️ SPELL cspell 75 527 0 36.49s
⚠️ SPELL lychee 41 2 0 1.74s
✅ YAML prettier 7 5 0 0 0.49s
✅ YAML v8r 7 0 0 5.93s
✅ YAML yamllint 7 0 0 0.5s

Detailed Issues

⚠️ SPELL / cspell - 527 errors
equires Tampermonkey, Violentmonkey, or Userscript
	 Suggestions: []
scripts/youtube-prev-video-shortcut/README.md:11:24     - Unknown word (Violentmonkey) -- Requires Tampermonkey, Violentmonkey, or Userscripts (Safari
	 Suggestions: []
scripts/youtube-prev-video-shortcut/README.md:11:42     - Unknown word (Userscripts)   -- mpermonkey, Violentmonkey, or Userscripts (Safari).
	 Suggestions: []
scripts/youtube-prev-video-shortcut/youtube-prev-video-shortcut.user.js:6:18      - Unknown word (chirag)     -- // @author       chirag127
	 Suggestions: [chirac, chiral, Chirac, chia, crag]
scripts/youtube-reaction-shortcuts/README.md:3:10      - Unknown word (userscript) -- Combined userscript. Two keys:
	 Suggestions: []
scripts/youtube-reaction-shortcuts/README.md:10:15     - Unknown word (remappable) -- Both keys are remappable via the userscript menu
	 Suggestions: [recappable, reapable, remarkable, reparable, repayable]
scripts/youtube-reaction-shortcuts/README.md:10:34     - Unknown word (userscript) -- are remappable via the userscript menu.
	 Suggestions: []
scripts/youtube-reaction-shortcuts/README.md:16:10     - Unknown word (Tampermonkey) -- Requires Tampermonkey, Violentmonkey, or Userscript
	 Suggestions: []
scripts/youtube-reaction-shortcuts/README.md:16:24     - Unknown word (Violentmonkey) -- Requires Tampermonkey, Violentmonkey, or Userscripts (Safari
	 Suggestions: []
scripts/youtube-reaction-shortcuts/README.md:16:42     - Unknown word (Userscripts)   -- mpermonkey, Violentmonkey, or Userscripts (Safari).
	 Suggestions: []
scripts/youtube-reaction-shortcuts/README.md:20:11     - Unknown word (Tampermonkey)  -- Click the Tampermonkey/Violentmonkey icon
	 Suggestions: []
scripts/youtube-reaction-shortcuts/README.md:20:24     - Unknown word (Violentmonkey) -- Click the Tampermonkey/Violentmonkey icon → open the menu
	 Suggestions: []
scripts/youtube-reaction-shortcuts/README.md:20:68     - Unknown word (userscript)    -- open the menu for this userscript:
	 Suggestions: []
scripts/youtube-reaction-shortcuts/README.md:30:136    - Unknown word (keybinds)      -- listener so YouTube's own keybinds don't swallow it. Ignores
	 Suggestions: [keying, keynes, keloids, kelvins, kerbing]
scripts/youtube-reaction-shortcuts/youtube-reaction-shortcuts.user.js:5:91      - Unknown word (remappable) -- video. Both keys are remappable via the Tampermonkey
	 Suggestions: [recappable, reapable, remarkable, reparable, repayable]
scripts/youtube-reaction-shortcuts/youtube-reaction-shortcuts.user.js:5:110     - Unknown word (Tampermonkey) -- are remappable via the Tampermonkey menu.
	 Suggestions: []
scripts/youtube-reaction-shortcuts/youtube-reaction-shortcuts.user.js:6:18      - Unknown word (chirag)       -- // @author       chirag127
	 Suggestions: [chirac, chiral, Chirac, chia, crag]
CSpell: Files checked: 75, Issues found: 527 in 71 files.


You can skip this misspellings by defining the following .cspell.json file at the root of your repository
Of course, please correct real typos before :)

{
    "version": "0.2",
    "language": "en",
    "ignorePaths": [
        "**/node_modules/**",
        "**/vscode-extension/**",
        "**/.git/**",
        "**/.pnpm-lock.json",
        ".vscode",
        "package-lock.json",
        "megalinter-reports"
    ],
    "words": [
        "AYSW",
        "Autoplay",
        "Aysw",
        "COOLDOWN",
        "Chirag",
        "Chirag's",
        "Consolas",
        "Cookiebot",
        "Cooldown",
        "Cybot",
        "Didomi",
        "Extensi",
        "Greasyfork",
        "Initialisation",
        "Kagi",
        "Klipper",
        "Menlo",
        "Neutralises",
        "Osano",
        "Remappable",
        "Riverton",
        "SERP",
        "Segoe",
        "Singhal",
        "Startpage",
        "Tampermonkey",
        "Tampermonkey's",
        "Textareas",
        "Userscript",
        "Userscripts",
        "Violentmonkey",
        "abruno",
        "adipiscing",
        "aliexpress",
        "amet",
        "autonav",
        "autoplay",
        "aysw",
        "beforeunload",
        "behaviour",
        "bfcache",
        "bicbefnmikccjbindlnjbollkinbnhhp",
        "chirag",
        "cmpid",
        "codehilite",
        "cooldown",
        "cutt",
        "dailymotion",
        "dclid",
        "didomi",
        "dlvr",
        "draggab",
        "dragstart",
        "duckduckgo",
        "elit",
        "endcards",
        "endscreen",
        "fbclid",
        "gaurav",
        "gclid",
        "hrefs",
        "hsctatracking",
        "hsfp",
        "hssc",
        "hstc",
        "hveid",
        "igshid",
        "itemprop",
        "kagi",
        "keybind",
        "keybinds",
        "klipper",
        "listicles",
        "mousedown",
        "mouseup",
        "msclkid",
        "ncid",
        "neutralises",
        "noopener",
        "noreferrer",
        "ocffkcplakjlhbaadfcokiiflaelnaib",
        "onetrust",
        "oriz",
        "osano",
        "pagehide",
        "playhead",
        "popstate",
        "redirector",
        "redirectors",
        "reinjects",
        "remappable",
        "rescan",
        "resum",
        "selectstart",
        "serp",
        "shortlink",
        "shortlinks",
        "shorturl",
        "softprops",
        "startpage",
        "stefanzweifel",
        "subreddits",
        "sunsetted",
        "tinyurl",
        "twclid",
        "tweeks",
        "uddg",
        "unat",
        "userscript",
        "userscript's",
        "userscripts",
        "vero",
        "yclid",
        "youtu",
        "zenid"
    ]
}


You can also copy-paste megalinter-reports/.cspell.json at the root of your repository

(Truncated to last 5714 characters out of 91099)
⚠️ REPOSITORY / devskim - 1 error
statement it can allow an attacker to inject their own code."},"help":{"text":"Edit the setTimeout so that no untrusted data is included. If untrusted data is absolutely necessary a great deal of care should be taken to ensure it is properly escaped so that it cannot be executed. This is not as simple as just escaping quotes.","markdown":"Edit the setTimeout so that no untrusted data is included. If untrusted data is absolutely necessary a great deal of care should be taken to ensure it is properly escaped so that it cannot be executed. This is not as simple as just escaping quotes. Visit [https://github.com/Microsoft/DevSkim/blob/main/guidance/DS172411.md](https://github.com/Microsoft/DevSkim/blob/main/guidance/DS172411.md) for additional guidance on this issue."},"shortDescription":{"text":"If untrusted data (data from HTTP requests, user submitted files, etc.) is included in an setTimeout statement it can allow an attacker to inject their own code."},"defaultConfiguration":{"level":"note"},"helpUri":"https://github.com/Microsoft/DevSkim/blob/main/guidance/DS172411.md","properties":{"precision":"high","problem.severity":"recommendation","DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}}]}},"versionControlProvenance":[{"repositoryUri":"https://github.com/chirag127/userscripts","revisionId":"fd6976a6f1061585d548ddd4d912c2fe52cf1132","branch":"(no branch)"}],"results":[{"ruleId":"DS172411","level":"note","message":{"text":"Review setTimeout for untrusted data"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/copy-highlighted-links/copy-highlighted-links.user.js"},"region":{"startLine":131,"startColumn":4,"endLine":133,"endColumn":34,"charOffset":5229,"charLength":82,"snippet":{"text":"setTimeout(() => {\n      el.style.opacity = '0'\n      setTimeout(() => el.remove()","rendered":{"text":"setTimeout(() => {\n      el.style.opacity = '0'\n      setTimeout(() => el.remove()","markdown":"`setTimeout(() => {\n      el.style.opacity = '0'\n      setTimeout(() => el.remove()`"}},"sourceLanguage":"javascript"}}}],"properties":{"tags":["JavaScript.DangerousFunctionCall","TypeScript.DangerousFunctionCall"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS172411","level":"note","message":{"text":"Review setTimeout for untrusted data"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/copy-email-links/copy-email-links.user.js"},"region":{"startLine":135,"startColumn":21,"endLine":135,"endColumn":34,"charOffset":5326,"charLength":13,"snippet":{"text":"setTimeout(()","rendered":{"text":"setTimeout(()","markdown":"`setTimeout(()`"}},"sourceLanguage":"javascript"}}}],"properties":{"tags":["JavaScript.DangerousFunctionCall","TypeScript.DangerousFunctionCall"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS172411","level":"note","message":{"text":"Review setTimeout for untrusted data"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/link-klipper/link-klipper.user.js"},"region":{"startLine":217,"startColumn":4,"endLine":219,"endColumn":34,"charOffset":7840,"charLength":82,"snippet":{"text":"setTimeout(() => {\n      el.style.opacity = '0'\n      setTimeout(() => el.remove()","rendered":{"text":"setTimeout(() => {\n      el.style.opacity = '0'\n      setTimeout(() => el.remove()","markdown":"`setTimeout(() => {\n      el.style.opacity = '0'\n      setTimeout(() => el.remove()`"}},"sourceLanguage":"javascript"}}}],"properties":{"tags":["JavaScript.DangerousFunctionCall","TypeScript.DangerousFunctionCall"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS172411","level":"note","message":{"text":"Review setTimeout for untrusted data"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/link-klipper/link-klipper.user.js"},"region":{"startLine":164,"startColumn":4,"endLine":166,"endColumn":30,"charOffset":6226,"charLength":66,"snippet":{"text":"setTimeout(() => {\n      a.remove()\n      URL.revokeObjectURL(url)","rendered":{"text":"setTimeout(() => {\n      a.remove()\n      URL.revokeObjectURL(url)","markdown":"`setTimeout(() => {\n      a.remove()\n      URL.revokeObjectURL(url)`"}},"sourceLanguage":"javascript"}}}],"properties":{"tags":["JavaScript.DangerousFunctionCall","TypeScript.DangerousFunctionCall"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS172411","level":"note","message":{"text":"Review setTimeout for untrusted data"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/fake-filler/fake-filler.user.js"},"region":{"startLine":236,"startColumn":2,"endLine":236,"endColumn":29,"charOffset":7051,"charLength":27,"snippet":{"text":"setTimeout(() => d.remove()","rendered":{"text":"setTimeout(() => d.remove()","markdown":"`setTimeout(() => d.remove()`"}},"sourceLanguage":"javascript"}}}],"properties":{"tags":["JavaScript.DangerousFunctionCall","TypeScript.DangerousFunctionCall"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}},{"ruleId":"DS172411","level":"note","message":{"text":"Review setTimeout for untrusted data"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/youtube-copy-context/youtube-copy-context.user.js"},"region":{"startLine":119,"startColumn":4,"endLine":119,"endColumn":32,"charOffset":4510,"charLength":28,"snippet":{"text":"setTimeout(() => el.remove()","rendered":{"text":"setTimeout(() => el.remove()","markdown":"`setTimeout(() => el.remove()`"}},"sourceLanguage":"javascript"}}}],"properties":{"tags":["JavaScript.DangerousFunctionCall","TypeScript.DangerousFunctionCall"],"DevSkimSeverity":"ManualReview","DevSkimConfidence":"High"}}],"columnKind":"utf16CodeUnits"}]}

(Truncated to last 5714 characters out of 6238)
⚠️ COPYPASTE / jscpd - 19 errors
Using config from megalinter-reports/jscpd-config.json
Clone found (javascript)
 - scripts/copy-email-links/copy-email-links.user.js [67:5 - 83:4] (17 lines, 84 tokens)
   scripts/copy-highlighted-links/copy-highlighted-links.user.js [89:5 - 105:4]
Clone found (javascript)
 - scripts/copy-highlighted-links/copy-highlighted-links.user.js [24:3 - 81:4] (58 lines, 337 tokens)
   scripts/open-links-in-selection/open-links-in-selection.user.js [24:3 - 82:4]
Clone found (javascript)
 - scripts/copy-highlighted-links/copy-highlighted-links.user.js [83:32 - 108:25] (26 lines, 116 tokens)
   scripts/link-klipper/link-klipper.user.js [171:26 - 193:25]
Clone found (javascript)
 - scripts/copy-highlighted-links/copy-highlighted-links.user.js [108:25 - 118:23] (11 lines, 50 tokens)
   scripts/link-klipper/link-klipper.user.js [193:42 - 203:23]
Clone found (javascript)
 - scripts/copy-highlighted-links/copy-highlighted-links.user.js [126:19 - 134:7] (9 lines, 59 tokens)
   scripts/link-klipper/link-klipper.user.js [212:23 - 220:7]
Clone found (javascript)
 - scripts/fake-filler/fake-filler.user.js [218:2 - 237:3] (20 lines, 99 tokens)
   scripts/pip-hotkey/pip-hotkey.user.js [55:2 - 74:3]
Clone found (javascript)
 - scripts/pip-hotkey/pip-hotkey.user.js [53:50 - 86:8] (34 lines, 142 tokens)
   scripts/read-aloud/read-aloud.user.js [153:30 - 186:8]
Clone found (javascript)
 - scripts/youtube-dislike-and-next-shortcut/youtube-dislike-and-next-shortcut.user.js [28:3 - 47:26] (20 lines, 99 tokens)
   scripts/youtube-like-and-next-shortcut/youtube-like-and-next-shortcut.user.js [28:3 - 47:26]
Clone found (javascript)
 - scripts/youtube-dislike-and-next-shortcut/youtube-dislike-and-next-shortcut.user.js [47:69 - 59:28] (13 lines, 60 tokens)
   scripts/youtube-like-and-next-shortcut/youtube-like-and-next-shortcut.user.js [47:66 - 59:28]
Clone found (javascript)
 - scripts/youtube-dislike-and-next-shortcut/youtube-dislike-and-next-shortcut.user.js [47:69 - 56:4] (10 lines, 50 tokens)
   scripts/youtube-nav-shortcuts/youtube-nav-shortcuts.user.js [43:67 - 52:4]
Clone found (javascript)
 - scripts/youtube-dislike-and-next-shortcut/youtube-dislike-and-next-shortcut.user.js [92:40 - 119:11] (28 lines, 92 tokens)
   scripts/youtube-like-and-next-shortcut/youtube-like-and-next-shortcut.user.js [92:37 - 118:11]
Clone found (javascript)
 - scripts/youtube-dislike-and-next-shortcut/youtube-dislike-and-next-shortcut.user.js [128:90 - 138:24] (11 lines, 70 tokens)
   scripts/youtube-like-and-next-shortcut/youtube-like-and-next-shortcut.user.js [127:84 - 137:24]
Clone found (javascript)
 - scripts/youtube-dislike-shortcut/youtube-dislike-shortcut.user.js [39:5 - 51:9] (13 lines, 66 tokens)
   scripts/youtube-reaction-shortcuts/youtube-reaction-shortcuts.user.js [100:5 - 112:9]
Clone found (javascript)
 - scripts/youtube-dislike-shortcut/youtube-dislike-shortcut.user.js [45:5 - 53:9] (9 lines, 59 tokens)
   scripts/youtube-next-video-shortcut/youtube-next-video-shortcut.user.js [37:5 - 45:9]
Clone found (javascript)
 - scripts/youtube-like-and-next-shortcut/youtube-like-and-next-shortcut.user.js [71:37 - 89:4] (19 lines, 61 tokens)
   scripts/youtube-reaction-shortcuts/youtube-reaction-shortcuts.user.js [71:39 - 89:4]
Clone found (javascript)
 - scripts/youtube-nav-shortcuts/youtube-nav-shortcuts.user.js [24:75 - 39:15] (16 lines, 101 tokens)
   scripts/youtube-reaction-shortcuts/youtube-reaction-shortcuts.user.js [24:91 - 39:15]
Clone found (javascript)
 - scripts/youtube-nav-shortcuts/youtube-nav-shortcuts.user.js [39:59 - 64:28] (26 lines, 126 tokens)
   scripts/youtube-reaction-shortcuts/youtube-reaction-shortcuts.user.js [39:65 - 64:28]
Clone found (javascript)
 - scripts/youtube-nav-shortcuts/youtube-nav-shortcuts.user.js [90:3 - 96:20] (7 lines, 57 tokens)
   scripts/youtube-reaction-shortcuts/youtube-reaction-shortcuts.user.js [108:3 - 114:20]
Clone found (javascript)
 - scripts/youtube-next-video-shortcut/youtube-next-video-shortcut.user.js [33:58 - 45:9] (13 lines, 86 tokens)
   scripts/youtube-prev-video-shortcut/youtube-prev-video-shortcut.user.js [34:58 - 46:9]
┌────────────┬────────────────┬─────────────┬──────────────┬──────────────┬──────────────────┬───────────────────┐
│ Format     │ Files analyzed │ Total lines │ Total tokens │ Clones found │ Duplicated lines │ Duplicated tokens │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ javascript │ 33             │ 4553        │ 21398        │ 19           │ 341 (7.49%)      │ 1814 (8.48%)      │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ txt        │ 1              │ 74          │ 437          │ 0            │ 0 (0.00%)        │ 0 (0.00%)         │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ Total:     │ 34             │ 4627        │ 21835        │ 19           │ 341 (7.37%)      │ 1814 (8.31%)      │
└────────────┴────────────────┴─────────────┴──────────────┴──────────────┴──────────────────┴───────────────────┘
Found 19 clones.
HTML report saved to megalinter-reports/copy-paste/jscpd-report.html
ERROR: jscpd found too many duplicates (7.4%) over threshold (0.0%)
time: 58.992ms
⚠️ SPELL / lychee - 2 errors
📝 Summary
---------------------
🔍 Total..........184
🔗 Unique..........88
✅ Successful.....181
⏳ Timeouts.........0
🔀 Redirected.......6
👻 Excluded.........1
❓ Unknown..........0
🚫 Errors...........2
⛔ Unsupported......2

Errors in .github/workflows/deploy.yml
[400] https://api.cloudflare.com/client/v4/accounts/$%7BCF_ACCOUNT_ID%7D/pages/projects/userscripts/domains (at 54:14) | Rejected status code: 400 Bad Request

Errors in README.md
[403] https://chatgpt.com/ (at 19:89) | Rejected status code: 403 Forbidden

Hint: Followed 6 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
⚠️ MARKDOWN / markdownlint - 30 errors
README.md:26:184 error MD045/no-alt-text Images should have alternate text (alt text)
scripts/add-code-copy-buttons/README.md:25:5 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/add-code-copy-buttons/README.md:25:9 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/add-code-copy-buttons/README.md:26:26 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/add-code-copy-buttons/README.md:26:97 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/ai-chat-auto-continue/README.md:36 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Install"]
scripts/anti-hijack-guard/README.md:22:5 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/anti-hijack-guard/README.md:22:9 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/anti-hijack-guard/README.md:23:53 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/anti-hijack-guard/README.md:23:175 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/expand-shortlinks/README.md:33:5 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/expand-shortlinks/README.md:34:29 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/expand-shortlinks/README.md:34:63 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/link-klipper/README.md:64:401 error MD013/line-length Line length [Expected: 400; Actual: 467]
scripts/open-links-in-selection/README.md:33 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Install"]
scripts/reddit-force-old/README.md:30 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Install"]
scripts/search-reddit-button/README.md:34 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Install"]
scripts/serp-open-articles/README.md:43:5 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/serp-open-articles/README.md:43:9 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/serp-open-articles/README.md:43:13 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/serp-open-articles/README.md:44:13 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/serp-open-articles/README.md:44:20 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/serp-open-articles/README.md:44:71 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/serp-open-articles/README.md:56:401 error MD013/line-length Line length [Expected: 400; Actual: 405]
scripts/serp-open-articles/README.md:66 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Install"]
scripts/serp-oriz-highlight/README.md:7:3 error MD042/no-empty-links No empty links [Context: "[Greasyfork](#)"]
scripts/serp-oriz-highlight/README.md:8:3 error MD042/no-empty-links No empty links [Context: "[OpenUserJS](#)"]
scripts/serp-oriz-highlight/README.md:50 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Install"]
scripts/stereo-to-mono/README.md:29 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Install"]
scripts/youtube-copy-context/README.md:5 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
⚠️ JAVASCRIPT / standard - 1 error
xt-shortcut/youtube-like-and-next-shortcut.user.js:30:24: Identifier 'GM_getValue' is not in camel case. (camelcase)
  scripts/youtube-like-and-next-shortcut/youtube-like-and-next-shortcut.user.js:30:61: Identifier 'GM_setValue' is not in camel case. (camelcase)
  scripts/youtube-like-and-next-shortcut/youtube-like-and-next-shortcut.user.js:34:15: 'GM_getValue' is not defined. (no-undef)
  scripts/youtube-like-and-next-shortcut/youtube-like-and-next-shortcut.user.js:40:5: 'GM_setValue' is not defined. (no-undef)
  scripts/youtube-like-and-next-shortcut/youtube-like-and-next-shortcut.user.js:47:19: 'prompt' is not defined. (no-undef)
  scripts/youtube-like-and-next-shortcut/youtube-like-and-next-shortcut.user.js:52:7: 'alert' is not defined. (no-undef)
  scripts/youtube-like-and-next-shortcut/youtube-like-and-next-shortcut.user.js:58:14: Identifier 'GM_registerMenuCommand' is not in camel case. (camelcase)
  scripts/youtube-like-and-next-shortcut/youtube-like-and-next-shortcut.user.js:59:5: 'GM_registerMenuCommand' is not defined. (no-undef)
  scripts/youtube-like-and-next-shortcut/youtube-like-and-next-shortcut.user.js:65:7: 'alert' is not defined. (no-undef)
  scripts/youtube-like-and-next-shortcut/youtube-like-and-next-shortcut.user.js:67:5: 'GM_registerMenuCommand' is not defined. (no-undef)
  scripts/youtube-like-and-next-shortcut/youtube-like-and-next-shortcut.user.js:71:7: 'alert' is not defined. (no-undef)
  scripts/youtube-nav-shortcuts/youtube-nav-shortcuts.user.js:26:24: Identifier 'GM_getValue' is not in camel case. (camelcase)
  scripts/youtube-nav-shortcuts/youtube-nav-shortcuts.user.js:26:61: Identifier 'GM_setValue' is not in camel case. (camelcase)
  scripts/youtube-nav-shortcuts/youtube-nav-shortcuts.user.js:30:15: 'GM_getValue' is not defined. (no-undef)
  scripts/youtube-nav-shortcuts/youtube-nav-shortcuts.user.js:36:5: 'GM_setValue' is not defined. (no-undef)
  scripts/youtube-nav-shortcuts/youtube-nav-shortcuts.user.js:43:19: 'prompt' is not defined. (no-undef)
  scripts/youtube-nav-shortcuts/youtube-nav-shortcuts.user.js:48:7: 'alert' is not defined. (no-undef)
  scripts/youtube-nav-shortcuts/youtube-nav-shortcuts.user.js:60:5: 'alert' is not defined. (no-undef)
  scripts/youtube-nav-shortcuts/youtube-nav-shortcuts.user.js:63:14: Identifier 'GM_registerMenuCommand' is not in camel case. (camelcase)
  scripts/youtube-nav-shortcuts/youtube-nav-shortcuts.user.js:64:5: 'GM_registerMenuCommand' is not defined. (no-undef)
  scripts/youtube-nav-shortcuts/youtube-nav-shortcuts.user.js:65:5: 'GM_registerMenuCommand' is not defined. (no-undef)
  scripts/youtube-nav-shortcuts/youtube-nav-shortcuts.user.js:66:5: 'GM_registerMenuCommand' is not defined. (no-undef)
  scripts/youtube-nav-shortcuts/youtube-nav-shortcuts.user.js:71:7: 'alert' is not defined. (no-undef)
  scripts/youtube-no-autoplay/youtube-no-autoplay.user.js:29:24: Identifier 'GM_getValue' is not in camel case. (camelcase)
  scripts/youtube-no-autoplay/youtube-no-autoplay.user.js:29:61: Identifier 'GM_setValue' is not in camel case. (camelcase)
  scripts/youtube-no-autoplay/youtube-no-autoplay.user.js:30:33: 'GM_getValue' is not defined. (no-undef)
  scripts/youtube-no-autoplay/youtube-no-autoplay.user.js:31:38: 'GM_setValue' is not defined. (no-undef)
  scripts/youtube-no-autoplay/youtube-no-autoplay.user.js:39:34: Identifier 'GM_addStyle' is not in camel case. (camelcase)
  scripts/youtube-no-autoplay/youtube-no-autoplay.user.js:40:5: 'GM_addStyle' is not defined. (no-undef)
  scripts/youtube-no-autoplay/youtube-no-autoplay.user.js:47:5: 'alert' is not defined. (no-undef)
  scripts/youtube-no-autoplay/youtube-no-autoplay.user.js:50:14: Identifier 'GM_registerMenuCommand' is not in camel case. (camelcase)
  scripts/youtube-no-autoplay/youtube-no-autoplay.user.js:51:5: 'GM_registerMenuCommand' is not defined. (no-undef)
  scripts/youtube-no-autoplay/youtube-no-autoplay.user.js:52:5: 'GM_registerMenuCommand' is not defined. (no-undef)
  scripts/youtube-no-autoplay/youtube-no-autoplay.user.js:53:5: 'GM_registerMenuCommand' is not defined. (no-undef)
  scripts/youtube-no-autoplay/youtube-no-autoplay.user.js:88:18: 'MutationObserver' is not defined. (no-undef)
  scripts/youtube-reaction-shortcuts/youtube-reaction-shortcuts.user.js:26:24: Identifier 'GM_getValue' is not in camel case. (camelcase)
  scripts/youtube-reaction-shortcuts/youtube-reaction-shortcuts.user.js:26:61: Identifier 'GM_setValue' is not in camel case. (camelcase)
  scripts/youtube-reaction-shortcuts/youtube-reaction-shortcuts.user.js:30:15: 'GM_getValue' is not defined. (no-undef)
  scripts/youtube-reaction-shortcuts/youtube-reaction-shortcuts.user.js:36:5: 'GM_setValue' is not defined. (no-undef)
  scripts/youtube-reaction-shortcuts/youtube-reaction-shortcuts.user.js:43:19: 'prompt' is not defined. (no-undef)
  scripts/youtube-reaction-shortcuts/youtube-reaction-shortcuts.user.js:48:7: 'alert' is not defined. (no-undef)
  scripts/youtube-reaction-shortcuts/youtube-reaction-shortcuts.user.js:60:5: 'alert' is not defined. (no-undef)
  scripts/youtube-reaction-shortcuts/youtube-reaction-shortcuts.user.js:63:14: Identifier 'GM_registerMenuCommand' is not in camel case. (camelcase)
  scripts/youtube-reaction-shortcuts/youtube-reaction-shortcuts.user.js:64:5: 'GM_registerMenuCommand' is not defined. (no-undef)
  scripts/youtube-reaction-shortcuts/youtube-reaction-shortcuts.user.js:65:5: 'GM_registerMenuCommand' is not defined. (no-undef)
  scripts/youtube-reaction-shortcuts/youtube-reaction-shortcuts.user.js:66:5: 'GM_registerMenuCommand' is not defined. (no-undef)
  scripts/youtube-reaction-shortcuts/youtube-reaction-shortcuts.user.js:71:7: 'alert' is not defined. (no-undef)

(Truncated to last 5714 characters out of 35387)
⚠️ ACTION / zizmor - 1 error
INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'ref-confusion' audit failed on file://.github/workflows/deploy.yml

Caused by:
    0: error in 'ref-confusion' audit
    1: couldn't list branches for actions/checkout
    2: request error while accessing GitHub API
    3: HTTP status client error (401 Unauthorized) for url (https://github.com/actions/checkout.git/git-upload-pack)


[ACTION_ZIZMOR_ERROR_GITHUB_API_UNREACHABLE] Zizmor could not access a repository referenced by a `uses:` clause via the GitHub API (missing token, insufficient scope, or cross-repo private access).
To allow zizmor to authenticate with GITHUB_TOKEN (or a PAT with `Contents: read-only`), whitelist the variable in your .mega-linter.yml:
ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
  - GITHUB_TOKEN
If the referenced workflow is in a private repo outside the current one, provide a PAT with cross-repo access instead of the default GITHUB_TOKEN, or run zizmor in offline mode.

See detailed reports in MegaLinter artifacts

MegaLinter is provided by OX Security
Show us your support by starring ⭐ the repository

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code size/XS

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants