chore(deps): major update oxsecurity/megalinter action to v9.0.0

[cheetahbot]

This PR contains the following updates:

Package	Type	Update	Change	Pending
oxsecurity/megalinter	action	major	v8.8.0 -> v9.0.0	v9.0.1

---

Release Notes

oxsecurity/megalinter (oxsecurity/megalinter)

v9.0.0

Compare Source

• Core

  • Create your own Megalinter Custom Flavors to dramatically improve your performances
    • See documentation for usage
    • Use npx mega-linter-runner@beta --custom-flavor-setup to initialize repo
    • Suggest new flavors in reporters with a mega-linter-runner including the list of linters
  • New LLM Advisor: call external LLMs to get hints to solve linter errors, available in:
    • Console Reporter
    • Text Reporter
    • Git platforms PR/MR comments Reporter
  • Use ghcr.io docker images by default because of rate limits on docker.io
  • Use uv to create the venv folder for pip-installed linters
  • Add copilot instructions for GitHub Copilot
  • Update base image to python:3.13-alpine3.21 (also embeds go 1.24)

• Disabled linters

  • puppet-lint: Disabled Until fix is provided for puppetlabs/puppet-lint#251
  • checkov: Disabled until fix is provided for bridgecrewio/checkov#7263

• Removed linters

  • markdown-link-check has been removed because lychee can be used instead, and has much better performances

• Linters enhancements

  • PHP-CS-Fixer is able to run on PHP 8.4 without error (change default configuration) by @​llaville
  • cspell: Filter output lines that do not contain found issues
  • hadolint: Extend DOCKERFILE_HADOLINT_FILE_NAMES_REGEX to include the purpose.Dockerfile convention eg service.Dockerfile.
  • sqlfluff: Handle fixing of issues

• Fixes

  • When linter is docker based, force --platform=linux/amd64 so it works when running locally on Mac
  • Added checking of *.pyi and *.ipynb files to the ruff and ruff-format linters

• Reporters

  • New default display for Pull Request comments, with expandable sections containing the first 1000 lines of the output log. Former display remains available by defining REPORTERS_MARKDOWN_SUMMARY_TYPE=table
  • Markdown summary reporter:
    • Write a file for Github integration if GITHUB_STEP_SUMMARY is set
    • Truncate less linter output lines
  • Text reporter: Change the output file names to put the linter name first, then the status
  • Enhance display of markdown summary

• Doc

  • Update documentation in all megalinter descriptor files to improve accuracy and consistency
  • Fix incorrect information in linters documentation and descriptors
  • Remove dead links
  • Add linter description (linter_text) in all linter descriptor, to generate a more exhaustive documentation.
  • Update contributing guide to explain how to manage python dependencies in the codebase

• Flavors

  • Do not suggest flavors that have more linters than the current one

• CI

  • Update default MegaLinter CI/CD workflows to disable LLM_ADVISOR in case of bot pull requests

• mega-linter-runner

  • Add all CI/CD providers in the --install command
  • Use ghcr.io docker images by default
  • New parameter --container-engine allowing to use podman as runner
  • mega-linter-runner --upgrade: Handle upgrade of github actions to their latest version
  • mega-linter-runner --upgrade: Upgrades MegaLinter actions and images to v9

• Linter versions upgrades (68)

  • ansible-lint from 25.5.0 to 25.9.0
  • bandit from 1.8.3 to 1.8.6
  • bicep_linter from 0.36.1 to 0.37.4
  • black from 25.1.0 to 25.9.0
  • cfn-lint from 1.36.0 to 1.39.1
  • checkstyle from 10.25.0 to 11.0.1
  • clang-format from 19.1.4 to 20.1.8
  • clippy from 0.1.87 to 0.1.90
  • clj-kondo from 2025.06.05 to 2025.09.19
  • csharpier from 1.0.2 to 1.1.2
  • cspell from 9.1.1 to 9.2.1
  • dartanalyzer from 3.8.1 to 3.8.3
  • devskim from 1.0.59 to 1.0.67
  • dotnet-format from 9.0.106 to 9.0.110
  • editorconfig-checker from 3.3.0 to 3.4.0
  • flake8 from 7.2.0 to 7.3.0
  • git_diff from 2.47.2 to 2.49.1
  • gitleaks from 8.27.2 to 8.28.0
  • golangci-lint from 2.1.6 to 2.4.0
  • grype from 0.94.0 to 0.100.0
  • hadolint from 2.12.0 to 2.13.1
  • helm from 3.16.3 to 3.18.4
  • htmlhint from 1.5.1 to 1.7.1
  • kics from 2.1.10 to 2.1.13
  • ktlint from 1.6.0 to 1.7.1
  • kubescape from 3.0.34 to 3.0.41
  • lightning-flow-scanner from 3.23.0 to 3.29.0
  • mypy from 1.16.0 to 1.18.2
  • npm-groovy-lint from 15.2.0 to 15.2.1
  • npm-package-json-lint from 8.0.0 to 9.0.0
  • php-cs-fixer from 3.75.0 to 3.87.2
  • phpcs from 3.13.1 to 4.0.0
  • phpstan from 2.1.17 to 2.1.28
  • pmd from 7.14.0 to 7.17.0
  • powershell from 7.5.1 to 7.5.3
  • powershell_formatter from 7.5.1 to 7.5.3
  • prettier from 3.5.3 to 3.6.2
  • protolint from 0.55.6 to 0.56.4
  • psalm from Psalm.6.12.0@​ to Psalm.6.13.1@​
  • pylint from 3.3.7 to 3.3.8
  • pyright from 1.1.402 to 1.1.405
  • revive from 1.10.0 to 1.12.0
  • roslynator from 0.10.1.0 to 0.10.2.0
  • rubocop from 1.76.1 to 1.80.2
  • ruff-format from 0.11.13 to 0.13.1
  • ruff from 0.11.13 to 0.13.1
  • secretlint from 10.1.0 to 11.2.4
  • selene from 0.28.0 to 0.29.0
  • shellcheck from 0.10.0 to 0.11.0
  • shfmt from 3.11.0 to 3.12.0
  • snakefmt from 0.11.0 to 0.11.2
  • snakemake from 9.5.1 to 9.11.4
  • sqlfluff from 3.4.1 to 3.4.2
  • stylelint from 16.20.0 to 16.24.0
  • swiftlint from 0.59.1 to 0.61.0
  • syft from 1.27.1 to 1.33.0
  • terraform-fmt from 1.12.2 to 1.13.2
  • terragrunt from 0.81.6 to 0.87.2
  • tflint from 0.58.0 to 0.59.1
  • trivy-sbom from 0.63.0 to 0.66.0
  • trivy from 0.63.0 to 0.66.0
  • trufflehog from 3.89.1 to 3.90.8
  • v8r from 5.0.0 to 5.1.0
  • vale from 3.11.2 to 3.12.0
  • xmllint from 21304 to 21308

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - "after 12pm and before 4pm every weekday" in timezone Europe/Copenhagen.

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[github-actions]

✅⚠️MegaLinter analysis: Success with warnings

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ DOCKERFILE	hadolint	1		0	0	0.32s
⚠️ MARKDOWN	markdownlint	1	0	2	0	0.66s
✅ MARKDOWN	markdown-table-formatter	1	0	0	0	0.22s
✅ REPOSITORY	gitleaks	yes		no	no	0.27s
✅ REPOSITORY	git_diff	yes		no	no	0.01s
✅ REPOSITORY	grype	yes		no	no	25.13s
✅ REPOSITORY	secretlint	yes		no	no	0.45s
✅ REPOSITORY	syft	yes		no	no	1.16s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.71s
✅ XML	xmllint	2	0	0	0	0.4s
✅ YAML	prettier	1	0	0	0	0.32s
✅ YAML	v8r	1		0	0	1.98s
✅ YAML	yamllint	1		0	0	0.29s

Detailed Issues

⚠️ MARKDOWN / markdownlint - 2 errors

README.md:114:1 MD045/no-alt-text Images should have alternate text (alt text)
README.md:116 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Deployment"]

See detailed reports in MegaLinter artifacts

You could have the same capabilities but better runtime performances if you use a MegaLinter flavor:

• oxsecurity/megalinter/flavors/[email protected] (48 linters)
• oxsecurity/megalinter/flavors/[email protected] (49 linters)
• oxsecurity/megalinter/flavors/[email protected] (49 linters)

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx [email protected] --custom-flavor-setup --custom-flavor-linters DOCKERFILE_HADOLINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY_SBOM,XML_XMLLINT,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R