You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Run started:2025-07-17 11:22:56.284934
Test results:
>> Issue: [B404:blacklist] Consider possible security implications associated with the subprocess module.
Severity: Low Confidence: High
CWE: CWE-78 (https://cwe.mitre.org/data/definitions/78.html)
More Info: https://bandit.readthedocs.io/en/1.8.6/blacklists/blacklist_imports.html#b404-import-subprocess
Location: ./.automation/build.py:11:0
10 import shutil
11 import subprocess
12 import sys
--------------------------------------------------
>> Issue: [B105:hardcoded_password_string] Possible hardcoded password: ''
Severity: Low Confidence: Medium
CWE: CWE-259 (https://cwe.mitre.org/data/definitions/259.html)
More Info: https://bandit.readthedocs.io/en/1.8.6/plugins/b105_hardcoded_password_string.html
Location: ./.automation/build.py:2994:35
2993 api_github_headers = {"content-type": "application/json"}
2994 use_github_token = ""
2995 if "GITHUB_TOKEN" in os.environ:
--------------------------------------------------
>> Issue: [B105:hardcoded_password_string] Possible hardcoded password: ' (with GITHUB_TOKEN)'
Severity: Low Confidence: Medium
CWE: CWE-259 (https://cwe.mitre.org/data/definitions/259.html)
More Info: https://bandit.readthedocs.io/en/1.8.6/plugins/b105_hardcoded_password_string.html
Location: ./.automation/build.py:2998:39
2997 api_github_headers["authorization"] = f"Bearer {github_token}"
2998 use_github_token = " (with GITHUB_TOKEN)"
2999 logging.info(
--------------------------------------------------
>> Issue: [B602:subprocess_popen_with_shell_equals_true] subprocess call with shell=True identified, security issue.
Severity: High Confidence: High
CWE: CWE-78 (https://cwe.mitre.org/data/definitions/78.html)
More Info: https://bandit.readthedocs.io/en/1.8.6/plugins/b602_subprocess_popen_with_shell_equals_true.html
Location: ./.automation/build.py:3375:14
3374 cwd=cwd,
3375 shell=True,
3376 executable=None if sys.platform == "win32" else which("bash"),
3377 )
3378 stdout = utils.clean_string(process.stdout)
3379 logging.info(f"Format table results: ({process.returncode})\n" + stdout)
3380
3381
3382 def generate_version():
3383 # npm version
3384 logging.info("Updating npm package version…")
--------------------------------------------------
>> Issue: [B607:start_process_with_partial_path] Starting a process with a partial executable path
Severity: Low Confidence: High
CWE: CWE-78 (https://cwe.mitre.org/data/definitions/78.html)
More Info: https://bandit.readthedocs.io/en/1.8.6/plugins/b607_start_process_with_partial_path.html
Location: ./.automation/build.py:3386:14
3385 cwd_to_use = os.getcwd() + "/mega-linter-runner"
3386 process = subprocess.run(
3387 [
3388 "npm",
3389 "version",
3390 "--newversion",
3391 RELEASE_TAG,
3392 "-no-git-tag-version",
3393 "--no-commit-hooks",
3394 ],
3395 stdout=subprocess.PIPE,
3396 universal_newlines=True,
3397 cwd=cwd_to_use,
3398 shell=True,
3399 )
3400 print(process.stdout)
--------------------------------------------------
>> Issue: [B602:subprocess_popen_with_shell_equals_true] subprocess call with shell=True identified, security issue.
Severity: High Confidence: High
CWE: CWE-78 (https://cwe.mitre.org/data/definitions/78.html)
More Info: https://bandit.readthedocs.io/en/1.8.6/plugins/b602_subprocess_popen_with_shell_equals_true.html
Location: ./.automation/build.py:3398:14
3397 cwd=cwd_to_use,
3398 shell=True,
3399 )
3400 print(process.stdout)
3401 print(process.stderr)
3402 # Update python project version:
3403 process = subprocess.run(
3404 ["hatch", "version", RELEASE_TAG],
3405 stdout=subprocess.PIPE,
3406 text=True,
3407 shell=True,
3408 check=True,
3409 )
3410 # Update changelog
3411 if UPDATE_CHANGELOG is True:
3412 changelog_file = f"{REPO_HOME}/CHANGELOG.md"
--------------------------------------------------
>> Issue: [B607:start_process_with_partial_path] Starting a process with a partial executable path
Severity: Low Confidence: High
CWE: CWE-78 (https://cwe.mitre.org/data/definitions/78.html)
More Info: https://bandit.readthedocs.io/en/1.8.6/plugins/b607_start_process_with_partial_path.html
Location: ./.automation/build.py:3403:14
3402 # Update python project version:
3403 process = subprocess.run(
3404 ["hatch", "version", RELEASE_TAG],
3405 stdout=subprocess.PIPE,
3406 text=True,
3407 shell=True,
3408 check=True,
3409 )
3410 # Update changelog
--------------------------------------------------
>> Issue: [B602:subprocess_popen_with_shell_equals_true] subprocess call with shell=True identified, security issue.
Severity: High Confidence: High
CWE: CWE-78 (https://cwe.mitre.org/data/definitions/78.html)
More Info: https://bandit.readthedocs.io/en/1.8.6/plugins/b602_subprocess_popen_with_shell_equals_true.html
Location: ./.automation/build.py:3407:14
3406 text=True,
3407 shell=True,
3408 check=True,
3409 )
3410 # Update changelog
3411 if UPDATE_CHANGELOG is True:
3412 changelog_file = f"{REPO_HOME}/CHANGELOG.md"
3413 with open(changelog_file, "r", encoding="utf-8") as md_file:
3414 changelog_content = md_file.read()
--------------------------------------------------
>> Issue: [B605:start_process_with_a_shell] Starting a process with a shell, possible injection detected, security issue.
Severity: High Confidence: High
CWE: CWE-78 (https://cwe.mitre.org/data/definitions/78.html)
More Info: https://bandit.readthedocs.io/en/1.8.6/plugins/b605_start_process_with_a_shell.html
Location: ./.automation/build.py:3455:4
3454 logging.info("Running command: " + " ".join(command))
3455 os.system(" ".join(command))
3456
--------------------------------------------------
>> Issue: [B404:blacklist] Consider possible security implications associated with the subprocess module.
Severity: Low Confidence: High
CWE: CWE-78 (https://cwe.mitre.org/data/definitions/78.html)
More Info: https://bandit.readthedocs.io/en/1.8.6/blacklists/blacklist_imports.html#b404-import-subprocess
Location: ./megalinter/Linter.py:28:0
27 import shutil
28 import subprocess
29 import sys
--------------------------------------------------
>> Issue: [B310:blacklist] Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
Severity: Medium Confidence: High
CWE: CWE-22 (https://cwe.mitre.org/data/definitions/22.html)
More Info: https://bandit.readthedocs.io/en/1.8.6/blacklists/blacklist_calls.html#b310-urllib-urlopen
Location: ./megalinter/Linter.py:567:24
566 with (
567 urllib.request.urlopen(remote_config_file) as response,
568 open(local_config_file, "wb") as out_file,
--------------------------------------------------
>> Issue: [B310:blacklist] Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
Severity: Medium Confidence: High
CWE: CWE-22 (https://cwe.mitre.org/data/definitions/22.html)
More Info: https://bandit.readthedocs.io/en/1.8.6/blacklists/blacklist_calls.html#b310-urllib-urlopen
Location: ./megalinter/Linter.py:646:24
645 with (
646 urllib.request.urlopen(remote_ignore_file) as response,
647 open(local_ignore_file, "wb") as out_file,
--------------------------------------------------
>> Issue: [B602:subprocess_popen_with_shell_equals_true] subprocess call with shell=
(Truncated to 8000 characters out of 42362)
⚠️ BASH / bash-exec - 1 error
Results of bash-exec linter (version 5.2.37)
See documentation on https://megalinter.io/beta/descriptors/bash_bash_exec/
-----------------------------------------------
✅ [SUCCESS] .automation/build_schemas_doc.sh
✅ [SUCCESS] .automation/format-tables.sh
✅ [SUCCESS] .vscode/testlinter.sh
✅ [SUCCESS] build.sh
✅ [SUCCESS] entrypoint.sh
❌ [ERROR] sh/megalinter_exec
Error: File:[sh/megalinter_exec] is not executable
⚠️ REPOSITORY / grype - 30 errors
[0000] WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal)
NAME INSTALLED FIXED IN TYPE VULNERABILITY SEVERITY EPSS RISK
ejs 3.1.6 3.1.7 npm GHSA-phwq-j96m-2c2q Critical 93.5% (99th) 87.9
tar 6.0.1 6.1.1 npm GHSA-3jfq-g458-7qm9 High 86.8% (99th) 68.2
requests 2.24.0 2.31.0 python GHSA-j8r2-6x86-q33q Medium 6.3% (90th) 3.5
ip 1.1.5 npm GHSA-2p57-rm9w-gvfp High 2.6% (84th) 2.0
minimist 1.2.5 1.2.6 npm GHSA-xvch-5gv4-984h Critical 1.1% (77th) 1.1
tar 6.0.1 6.1.9 npm GHSA-5955-9wpr-37jh High 0.9% (75th) 0.7
ejs 3.1.6 3.1.10 npm GHSA-ghr5-ch3p-vcr6 Medium 1.3% (78th) 0.6
node-fetch 2.6.6 2.6.7 npm GHSA-r683-j2x4-v87g High 0.6% (67th) 0.5
minimatch 3.0.4 3.0.5 npm GHSA-f8q6-p94x-37v3 High 0.4% (61st) 0.3
semver 7.3.5 7.5.2 npm GHSA-c2qf-rxjj-qqgw High 0.4% (60th) 0.3
tar 6.0.1 6.1.2 npm GHSA-r628-mhmh-qjhw High 0.2% (43rd) 0.2
ansi-regex 3.0.0 3.0.1 npm GHSA-93q8-gq69-wqmw High 0.2% (42nd) 0.1
cross-spawn 7.0.3 7.0.5 npm GHSA-3xgq-45jj-v275 High 0.2% (42nd) 0.1
http-cache-semantics 4.1.0 4.1.1 npm GHSA-rc47-6667-2j5j High 0.2% (37th) 0.1
ip 1.1.5 1.1.9 npm GHSA-78xj-cgh5-2h22 Low 0.4% (59th) 0.1
tar 6.0.1 6.2.1 npm GHSA-f5x3-32g6-xq36 Medium 0.2% (42nd) 0.1
tar 6.1.11 6.2.1 npm GHSA-f5x3-32g6-xq36 Medium 0.2% (42nd) 0.1
braces 3.0.2 3.0.3 npm GHSA-grv7-fg5c-xmjg High 0.1% (35th) 0.1
@octokit/request-error 2.1.0 5.1.1 npm GHSA-xx4v-prfh-6cgc Medium 0.2% (42nd) 0.1
micromatch 4.0.4 4.0.8 npm GHSA-952p-6rrq-rcjv Medium 0.2% (41st) < 0.1
@octokit/request 5.6.2 8.4.1 npm GHSA-rmvr-2pp2-xj38 Medium 0.2% (40th) < 0.1
@octokit/plugin-paginate-rest 2.17.0 9.2.2 npm GHSA-h5c3-5r3r-rr8q Medium < 0.1% (26th) < 0.1
debug 4.2.0 4.3.1 npm GHSA-gxpj-cx7g-858c Low < 0.1% (27th) < 0.1
requests 2.24.0 2.32.0 python GHSA-9wx4-h78v-vm56 Medium < 0.1% (13th) < 0.1
tar 6.0.1 6.1.9 npm GHSA-qq89-hq3f-393p High < 0.1% (3rd) < 0.1
tar 6.0.1 6.1.7 npm GHSA-9r2w-394v-53qc High < 0.1% (3rd) < 0.1
word-wrap 1.2.3 1.2.4 npm GHSA-j8xg-fqg3-53r7 Medium < 0.1% (5th) < 0.1
requests 2.24.0 2.32.4 python GHSA-9hjg-9r4m-mvj7 Medium < 0.1% (4th) < 0.1
brace-expansion 1.1.11 1.1.12 npm GHSA-v6h2-p8h4-qcjw Low < 0.1% (3rd) < 0.1
brace-expansion 2.0.1 2.0.2 npm GHSA-v6h2-p8h4-qcjw Low < 0.1% (3rd) < 0.1
[0031] ERROR discovered vulnerabilities at or above the severity threshold
⚠️ SPELL / lychee - 5 errors
[WARN ] WARNING: `--exclude-mail` is deprecated and will soon be removed; E-Mail is no longer checked by default. Use `--include-mail` to enable E-Mail checking.
[403] https://htmlhint.com/integrations/task-runner/ | Network error: Forbidden
[403] https://htmlhint.com/integrations/task-runner/ | Error (cached)
[403] https://htmlhint.com/docs/user-guide/list-rules | Network error: Forbidden
[403] https://htmlhint.com/ | Network error: Forbidden
[403] https://htmlhint.com/configuration/ | Network error: Forbidden
📝 Summary
---------------------
🔍 Total.........2349
✅ Successful....1892
⏳ Timeouts.........0
🔀 Redirected.......0
👻 Excluded.......452
❓ Unknown..........0
🚫 Errors...........5
Errors in megalinter/descriptors/html.megalinter-descriptor.yml
[403] https://htmlhint.com/ | Network error: Forbidden
[403] https://htmlhint.com/integrations/task-runner/ | Error (cached)
[403] https://htmlhint.com/configuration/ | Network error: Forbidden
[403] https://htmlhint.com/docs/user-guide/list-rules | Network error: Forbidden
Errors in README.md
[403] https://htmlhint.com/integrations/task-runner/ | Network error: Forbidden
⚠️ MARKDOWN / markdownlint - 307 errors
.github/copilot-instructions.md:9 MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
.github/copilot-instructions.md:156 MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
.github/linters/valestyles/proselint/README.md:12:601 MD013/line-length Line length [Expected: 600; Actual: 755]
CHANGELOG.md:1997:87 MD059/descriptive-link-text Link text should be descriptive [Context: "[here]"]
docs/badge.md:9 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Badge"]
docs/config-activation.md:9 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Activation and deactivation"]
docs/config-apply-fixes.md:9 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Apply fixes"]
docs/config-cli-lint-mode.md:9 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "CLI lint mode"]
docs/config-file.md:9 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: ".mega-linter.yml file"]
docs/config-filtering.md:9 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Filter linted files"]
docs/config-linters.md:9 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Linter specific variables"]
docs/config-postcommands.md:9 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Post-commands"]
docs/config-precommands.md:9 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Pre-commands"]
docs/config-variables-security.md:9 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Environment variables security"]
docs/config-variables.md:9 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Common variables"]
docs/configuration.md:9 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Configuration"]
docs/descriptors/action_actionlint.md:7 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "actionlint"]
docs/descriptors/action.md:8 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "ACTION"]
docs/descriptors/ansible_ansible_lint.md:7 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "ansible-lint"]
docs/descriptors/ansible_ansible_lint.md:8:601 MD013/line-length Line length [Expected: 600; Actual: 795]
docs/descriptors/ansible.md:8 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "ANSIBLE"]
docs/descriptors/api_spectral.md:14:601 MD013/line-length Line length [Expected: 600; Actual: 746]
docs/descriptors/api.md:8 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "API"]
docs/descriptors/arm_arm_ttk.md:7 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "arm-ttk"]
docs/descriptors/arm.md:8 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "ARM"]
docs/descriptors/bash_bash_exec.md:7 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "bash-exec"]
docs/descriptors/bash_shellcheck.md:7 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "shellcheck"]
docs/descriptors/bash_shellcheck.md:8:601 MD013/line-length Line length [Expected: 600; Actual: 785]
docs/descriptors/bash_shfmt.md:7 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "shfmt"]
docs/descriptors/bash.md:8 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "BASH"]
docs/descriptors/bicep_bicep_linter.md:7 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "bicep_linter"]
docs/descriptors/bicep.md:8 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "BICEP"]
docs/descriptors/c_clang_format.md:7 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "clang-format"]
docs/descriptors/c_clang_format.md:8:601 MD013/line-length Line length [Expected: 600; Actual: 768]
docs/descriptors/c_cppcheck.md:7 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "cppcheck"]
docs/descriptors/c_cpplint.md:7 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "cpplint"]
docs/descriptors/c.md:8 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "C"]
docs/descriptors/clojure_cljstyle.md:7 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "cljstyle"]
docs/descriptors/clojure_cljstyle.md:8:601 MD013/line-length Line length [Expected: 600; Actual: 768]
docs/descriptors/clojure.md:8 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "CLOJURE"]
docs/descriptors/cloudformation_cfn_lint.md:14:601 MD013/line-length Line length [Expected: 600; Actual: 865]
docs/descriptors/cloudformation.md:8 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "CLOUDFORMATION"]
docs/descriptors/coffee_coffeelint.md:7 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "coffeelint"]
docs/descriptors/coffee_coffeelint.md:8:601 MD013/line-length Line length [Expected: 600; Actual: 746]
docs/descriptors/coffee.md:8 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "COFFEE"]
docs/descriptors/copypaste.md:8 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "COPYPASTE"]
docs/descriptors/cpp_clang_format.md:7 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "clang-format"]
docs/descriptors/cpp_clang_format.md:8:601 MD013/line-length Line length [Expected: 600; Actual: 768]
docs/descriptors/cpp_cppcheck.md:7 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "cppcheck"]
docs/descriptors/cpp_cpplint.md:7 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "cpplint"]
docs/descriptors/cpp.md:8 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "C++"]
docs/descriptors/csharp_csharpier.md:7 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "csharpier"]
docs/descriptors/csharp_csharpier.md:8:601 MD013/line-length Line length [Expected: 600; Actual: 750]
docs/descriptors/csharp_dotnet_format.md:7 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "dotnet-format"]
docs/descriptors/csharp_roslynator.md:7 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "roslynator"]
docs/descriptors/csharp_roslynator.md:8:601 MD013/line-length Line length [Expected: 600; Actual: 770]
docs/descriptors/csharp.md:8 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "C\#"]
docs/descriptors/css_stylelint.md:14:601 MD013/line-length Line length [Expected: 600; Actual: 788]
docs/descriptors/css.md:8 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "CSS"]
docs/descriptors/dart_dartanalyzer.md:7 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "dartanalyzer"]
docs/descriptors/dart.md:8 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "DART"]
docs/descriptors/dockerfile_hadolint.md:7 MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "hadolint"]
docs/descriptors/dockerfile_hadolint.md:8:601 MD013/line-length Line length [Expected: 600;
(Truncated to 8000 characters out of 38125)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #
Proposed Changes
Readiness Checklist
Author/Contributor
Reviewing Maintainer
breakingif this is a large fundamental changeautomation,bug,documentation,enhancement,infrastructure, orperformance