build(deps): bump the all-dependencies group with 2 updates

[dependabot]

Bumps the all-dependencies group with 2 updates: actions/setup-node and oxsecurity/megalinter.

Updates actions/setup-node from 6 to 7

Release notes

Sourced from actions/setup-node's releases.

v7.0.0

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in actions/setup-node#1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in actions/setup-node#1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in actions/setup-node#1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in actions/setup-node#1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in actions/setup-node#1536
• docs: Update restore-only cache documentation by @​priya-kinthali in actions/setup-node#1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in actions/setup-node#1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in actions/setup-node#1569

New Contributors

• @​chiranjib-swain made their first contribution in actions/setup-node#1536
• @​deiga made their first contribution in actions/setup-node#1548
• @​jasongin made their first contribution in actions/setup-node#1569

Full Changelog: actions/setup-node@v6...v7.0.0

v6.5.0

What's Changed

• Update @​actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @​HarithaVattikuti in actions/setup-node#1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

v6.4.0

What's Changed

Dependency updates:

• Upgrade @​actions dependencies by @​Copilot in actions/setup-node#1525
• Update Node.js versions in versions.yml and bump package to v6.4.0 by @​priya-kinthali in actions/setup-node#1533

New Contributors

• @​Copilot made their first contribution in actions/setup-node#1525

Full Changelog: actions/setup-node@v6...v6.4.0

v6.3.0

What's Changed

Enhancements:

• Support parsing devEngines field by @​susnux in actions/setup-node#1283

... (truncated)

Commits

• 8207627 Migrate to ESM and upgrade dependencies (#1574)
• 04be95c Add cache-primary-key and cache-matched-key as outputs (#1577)
• 7c2c68d docs: Update caching recommendations to mitigate cache poisoning risks (#1567)
• 6a61c03 Merge pull request #1569 from jasongin/update-actions-cache-5.1.0
• 30eb73b Resolve high-severity audit issues
• 4e1a87a Update dist
• 360237f Strict equality
• 4f8aac5 Bump @​actions/cache to 5.1.0, log cache write denied
• f4a67bb Only use mirrorToken in getManifest if it's provided (#1548)
• 0355742 Remove dummy NODE_AUTH_TOKEN export (#1558)
• Additional commits viewable in compare view

Updates oxsecurity/megalinter from 9.6.0 to 10.0.0

Release notes

Sourced from oxsecurity/megalinter's releases.

v10.0.0

What's Changed

• Breaking changes

  • Removed 14 deprecated or long-disabled linters, and the API, MAKEFILE and PUPPET descriptors, which had no other linter left. MegaLinter does not provide Makefile and Puppet linting anymore. See the new Removed linters page for the full list and suggested replacements. (#8606)
  • REPOSITORY_GITLEAKS has been removed: migrate to REPOSITORY_BETTERLEAKS, which reads your existing .gitleaks.toml and .gitleaksignore files unchanged. (#8606)
  • Existing .mega-linter.yml files keep working: configuration variables of removed linters are simply ignored (a single notice lists any found in your configuration) and remain valid in the JSON schema. (#8606)
  • API Reporter payload v2 replaces the v1 payload: metric series are renamed (linter_run_* becomes megalinter_linter_run_*, plus new run-level megalinter_run_* series), and the old docs/grafana dashboards are superseded. Re-provision the new dashboards with npx mega-linter-runner --upload-dashboards grafana — see the migration notes. Legacy NOTIF_API_* variables remain supported as aliases. (#8661)
  • Linters now time out after 5 minutes by default (LINTER_TIMEOUT_SECONDS: 300): a linter exceeding it is killed and reported as an error (exit code 124) instead of running (or hanging) unbounded. If some of your linters legitimately run longer, raise the limit globally with LINTER_TIMEOUT_SECONDS, per linter with <LINTER_KEY>_TIMEOUT_SECONDS, or restore the previous unbounded behavior with value 0. (#8665)

• Core

  • Coding agents integration: MegaLinter can now be driven by Claude Code, Cursor CLI, GitHub Copilot CLI, Codex and many other coding agents — see the new Coding Agents documentation page (#8614)
    • Install the MegaLinter agent skills with npx skills add oxsecurity/megalinter
    • Then ask your agent to set up MegaLinter (megalinter-setup), watch CI or local runs (megalinter-check) or fix lint errors (megalinter-fix)
    • Before the first local run, the skills now make sure the user is aware that MegaLinter is Docker-based and needs a good computer configuration and internet connection (the image download can weigh several GB), and suggest watching CI results instead when that is a problem
    • Local runs launched by the skills now cap PARALLEL_PROCESS_NUMBER to 4 on local computers (CI runs keep one parallel linter process per CPU core), so linting does not saturate the machine
    • Local runs launched by the skills now always activate the JSON reporter (not generated by default) to read results reliably, and fall back to the report folder configuration then the console output instead of waiting for report files that a repository configuration may have disabled
  • Excluded directories are now forwarded to project-mode linters, massively speeding up local runs, fixes #8645
    • Linters that scan the whole workspace by themselves (REPOSITORY_TRIVY, REPOSITORY_CHECKOV, REPOSITORY_GRYPE, REPOSITORY_TRUFFLEHOG, REPOSITORY_SEMGREP and 50+ others) used to crawl everything, including build caches and node_modules: a seconds-long CI lint could take hours on a local checkout
    • MegaLinter now automatically passes the excluded directories (defaults, EXCLUDED_DIRECTORIES, ADDITIONAL_EXCLUDED_DIRECTORIES, and directories detected in FILTER_REGEX_EXCLUDE) to each of these linters, through its native exclusion flags or a generated ignore/config file
    • Every forwarded exclusion is logged in the linter's console section, and the ">300 gitignored files" performance warning now names the heaviest directories it found
    • Opt out globally with FORWARD_EXCLUDED_DIRECTORIES: false, or per linter with <LINTER_KEY>_FORWARD_EXCLUDED_DIRECTORIES: false
  • Default excluded directories now also include common build/cache folders: .wireit, .turbo, .nx, .yarn/cache, .pnpm-store, .parcel-cache, .angular, and the Salesforce CLI .sf / .sfdx state folders (#8646)
  • New per-linter timeout: a linter still running after 5 minutes (LINTER_TIMEOUT_SECONDS: 300 by default) is killed along with all its child processes and reported as an error (exit code 124) with an actionable message, while the other linters keep running. Raise the limit globally with LINTER_TIMEOUT_SECONDS, per linter with <LINTER_KEY>_TIMEOUT_SECONDS, or disable it with value 0 (#8665)
  • New prerun analysis mode (mega-linter-runner --prerun, or MEGALINTER_PRERUN=true environment variable): MegaLinter identifies active linters and collects files, then stops before running any linter and suggests configuration improvements, in the console and in megalinter-reports/prerun-report.json (#8653)
    • Suggested exclusions: top-level directories containing only gitignored files (safe: linting scope is unchanged, and project-mode linters stop scanning them), and well-known generated/vendored folder names (site, dist, vendor...) still containing lintable files (to confirm by the user)
    • A lighter matching flavor is also suggested when available
    • The megalinter-check agent skill uses it on the first local run to tune .mega-linter.yml with the user before the real lint
    • Fixed a performance issue where detecting .gitignored files enumerated every individual file inside large ignored folders (node_modules, build output...) instead of stopping at the folder boundary, which could make the file collection step (including prerun) take several minutes on big repositories
  • Much lighter Docker images: the main image download shrinks by 9%, flavors by 9% to 22%, and standalone megalinter-only-* images are 35% to 65% smaller (#8621)

    • If your PRE_COMMANDS compile native code: the compilation toolchain is no longer shipped in the images, install it back with apk add --no-cache gcc make musl-dev

    • Main and flavor images, compressed download size on ghcr.io, linux/amd64 (before = v9.6.0, so deltas also include the linters removed in this version):

      Image	Before	After	Delta
      megalinter (main)	4.55 GB	4.13 GB	-9%
      megalinter-c_cpp	1.61 GB	1.35 GB	-16%
      megalinter-ci_light	724 MB	657 MB	-9%
      megalinter-cupcake	2.52 GB	2.24 GB	-11%
      megalinter-documentation	1.47 GB	1.21 GB	-18%
      megalinter-dotnet	2.23 GB	1.86 GB	-17%
      megalinter-dotnetweb	2.25 GB	1.88 GB	-17%
      megalinter-formatters	936 MB	849 MB	-9%
      megalinter-go	1.55 GB	1.35 GB	-13%
      megalinter-java	1.59 GB	1.32 GB	-17%
      megalinter-javascript	1.49 GB	1.23 GB	-18%
      megalinter-php	1.51 GB	1.26 GB	-17%
      megalinter-python	1.61 GB	1.26 GB	-22%
      megalinter-ruby	1.49 GB	1.22 GB	-18%
      megalinter-rust	1.99 GB	1.80 GB	-10%

... (truncated)

Changelog

Sourced from oxsecurity/megalinter's changelog.

[v10.0.0] - 2026-08-08

• Breaking changes

  • Removed 14 deprecated or long-disabled linters, and the API, MAKEFILE and PUPPET descriptors, which had no other linter left. MegaLinter does not provide Makefile and Puppet linting anymore. See the new Removed linters page for the full list and suggested replacements. (#8606)
  • REPOSITORY_GITLEAKS has been removed: migrate to REPOSITORY_BETTERLEAKS, which reads your existing .gitleaks.toml and .gitleaksignore files unchanged. (#8606)
  • Existing .mega-linter.yml files keep working: configuration variables of removed linters are simply ignored (a single notice lists any found in your configuration) and remain valid in the JSON schema. (#8606)
  • API Reporter payload v2 replaces the v1 payload: metric series are renamed (linter_run_* becomes megalinter_linter_run_*, plus new run-level megalinter_run_* series), and the old docs/grafana dashboards are superseded. Re-provision the new dashboards with npx mega-linter-runner --upload-dashboards grafana — see the migration notes. Legacy NOTIF_API_* variables remain supported as aliases. (#8661)
  • Linters now time out after 5 minutes by default (LINTER_TIMEOUT_SECONDS: 300): a linter exceeding it is killed and reported as an error (exit code 124) instead of running (or hanging) unbounded. If some of your linters legitimately run longer, raise the limit globally with LINTER_TIMEOUT_SECONDS, per linter with <LINTER_KEY>_TIMEOUT_SECONDS, or restore the previous unbounded behavior with value 0. (#8665)

• Core

  • Coding agents integration: MegaLinter can now be driven by Claude Code, Cursor CLI, GitHub Copilot CLI, Codex and many other coding agents — see the new Coding Agents documentation page (#8614)
    • Install the MegaLinter agent skills with npx skills add oxsecurity/megalinter
    • Then ask your agent to set up MegaLinter (megalinter-setup), watch CI or local runs (megalinter-check) or fix lint errors (megalinter-fix)
    • Before the first local run, the skills now make sure the user is aware that MegaLinter is Docker-based and needs a good computer configuration and internet connection (the image download can weigh several GB), and suggest watching CI results instead when that is a problem
    • Local runs launched by the skills now cap PARALLEL_PROCESS_NUMBER to 4 on local computers (CI runs keep one parallel linter process per CPU core), so linting does not saturate the machine
    • Local runs launched by the skills now always activate the JSON reporter (not generated by default) to read results reliably, and fall back to the report folder configuration then the console output instead of waiting for report files that a repository configuration may have disabled
  • Excluded directories are now forwarded to project-mode linters, massively speeding up local runs, fixes #8645
    • Linters that scan the whole workspace by themselves (REPOSITORY_TRIVY, REPOSITORY_CHECKOV, REPOSITORY_GRYPE, REPOSITORY_TRUFFLEHOG, REPOSITORY_SEMGREP and 50+ others) used to crawl everything, including build caches and node_modules: a seconds-long CI lint could take hours on a local checkout
    • MegaLinter now automatically passes the excluded directories (defaults, EXCLUDED_DIRECTORIES, ADDITIONAL_EXCLUDED_DIRECTORIES, and directories detected in FILTER_REGEX_EXCLUDE) to each of these linters, through its native exclusion flags or a generated ignore/config file
    • Every forwarded exclusion is logged in the linter's console section, and the ">300 gitignored files" performance warning now names the heaviest directories it found
    • Opt out globally with FORWARD_EXCLUDED_DIRECTORIES: false, or per linter with <LINTER_KEY>_FORWARD_EXCLUDED_DIRECTORIES: false
  • Default excluded directories now also include common build/cache folders: .wireit, .turbo, .nx, .yarn/cache, .pnpm-store, .parcel-cache, .angular, and the Salesforce CLI .sf / .sfdx state folders (#8646)
  • New per-linter timeout: a linter still running after 5 minutes (LINTER_TIMEOUT_SECONDS: 300 by default) is killed along with all its child processes and reported as an error (exit code 124) with an actionable message, while the other linters keep running. Raise the limit globally with LINTER_TIMEOUT_SECONDS, per linter with <LINTER_KEY>_TIMEOUT_SECONDS, or disable it with value 0 (#8665)
  • New prerun analysis mode (mega-linter-runner --prerun, or MEGALINTER_PRERUN=true environment variable): MegaLinter identifies active linters and collects files, then stops before running any linter and suggests configuration improvements, in the console and in megalinter-reports/prerun-report.json (#8653)
    • Suggested exclusions: top-level directories containing only gitignored files (safe: linting scope is unchanged, and project-mode linters stop scanning them), and well-known generated/vendored folder names (site, dist, vendor...) still containing lintable files (to confirm by the user)
    • A lighter matching flavor is also suggested when available
    • The megalinter-check agent skill uses it on the first local run to tune .mega-linter.yml with the user before the real lint
    • Fixed a performance issue where detecting .gitignored files enumerated every individual file inside large ignored folders (node_modules, build output...) instead of stopping at the folder boundary, which could make the file collection step (including prerun) take several minutes on big repositories
  • Much lighter Docker images: the main image download shrinks by 9%, flavors by 9% to 22%, and standalone megalinter-only-* images are 35% to 65% smaller (#8621)

    • If your PRE_COMMANDS compile native code: the compilation toolchain is no longer shipped in the images, install it back with apk add --no-cache gcc make musl-dev

    • Main and flavor images, compressed download size on ghcr.io, linux/amd64 (before = v9.6.0, so deltas also include the linters removed in this version):

      Image	Before	After	Delta
      megalinter (main)	4.55 GB	4.13 GB	-9%
      megalinter-c_cpp	1.61 GB	1.35 GB	-16%
      megalinter-ci_light	724 MB	657 MB	-9%
      megalinter-cupcake	2.52 GB	2.24 GB	-11%
      megalinter-documentation	1.47 GB	1.21 GB	-18%
      megalinter-dotnet	2.23 GB	1.86 GB	-17%
      megalinter-dotnetweb	2.25 GB	1.88 GB	-17%
      megalinter-formatters	936 MB	849 MB	-9%
      megalinter-go	1.55 GB	1.35 GB	-13%
      megalinter-java	1.59 GB	1.32 GB	-17%
      megalinter-javascript	1.49 GB	1.23 GB	-18%
      megalinter-php	1.51 GB	1.26 GB	-17%
      megalinter-python	1.61 GB	1.26 GB	-22%
      megalinter-ruby	1.49 GB	1.22 GB	-18%
      megalinter-rust	1.99 GB	1.80 GB	-10%
      megalinter-salesforce	2.09 GB	1.87 GB	-10%

... (truncated)

Commits

• 15e5b45 Release MegaLinter v10.0.0
• 861855a megalinter-setup skill: enforce ghcr.io image references in upgrade mode (#8694)
• 572dc81 [automation] Auto-update linters version, help and documentation (#8695)
• 2f62977 Refresh OX Security PR comment banner and home page banner (#8692)
• 3b8c632 chore(deps): update dependency mongodb/kingfisher to v1.112.0 (#8691)
• 7efac01 chore(deps): update mstruebing/editorconfig-checker docker tag to v3.10.0 (#8...
• 8cea326 Make custom flavor generator output pass MegaLinter (#8686)
• a057dcb [automation] Auto-update linters version, help and documentation (#8690)
• 6dece72 chore(deps): update dependency virtualenv to v21.7.2 (#8683)
• 08a6d16 docs: highlight impactful contributors in the Special thanks section (#8688)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[cursor]

PR Summary

Medium Risk
MegaLinter v10 is a major upgrade with removed linters and new default timeouts; setup-node v7 is a routine CI action bump with limited blast radius.

Overview
Bumps two GitHub Actions dependencies in CI workflows only.

In .github/workflows/ci.yml, the asc-contracts compile step switches actions/setup-node from v6 to v7 (still Node 24, same HAS_CONTRACTS_TOKEN gating).

In .github/workflows/mega-linter.yml, the Rust flavor image moves from oxsecurity/megalinter/flavors/rust@v9.6.0 to @v10.0.0. Workflow env is unchanged, including REPOSITORY_GITLEAKS_ARGUMENTS; .mega-linter.yml already disables REPOSITORY_GITLEAKS, so secret scanning behavior should not change unless other v10 defaults (e.g. 5-minute linter timeouts) affect the run.

^{Reviewed by Cursor Bugbot for commit b35279c. Bugbot is set up for automated code reviews on this repo. Configure here.}