Skip to content

feat!: update default configurations #7174

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Draft
ferrarimarco wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

feat!: update default configurations #7174

ferrarimarco wants to merge 1 commit into from

Conversation

@ferrarimarco
Copy link
Collaborator

@ferrarimarco ferrarimarco commented Oct 22, 2025

Refactor default linter configuration to avoid disabling or enabling arbitrary rules, when possible.

Prefer using the default configuration, when linters provide one.

Readiness checklist

In order to have this pull request merged, complete the following tasks.

Pull request author tasks

  • I checked that all workflows return a success.
  • I included all the needed documentation for this change.
  • I provided the necessary tests.
  • I squashed all the commits into a single commit.
  • I followed the
    Conventional Commit v1.0.0 spec.
  • I wrote the necessary upgrade instructions in the
    upgrade guide.
  • If this pull request is about and existing issue, I added the
    Fix #ISSUE_NUMBER or Close #ISSUE_NUMBER text to the description of
    the pull request.

Super-linter maintainer tasks

  • Label as breaking if this change breaks compatibility with the previous
    released version.
  • Label as either: automation, bug, documentation, enhancement,
    infrastructure.
  • Add the pull request to a milestone, eventually creating one, that matches
    with the version that release-please proposes in the
    preview-release-notes CI job.

@github-actions
Copy link
Contributor

github-actions bot commented Nov 22, 2025

This pull request has been automatically marked as stale because it has not had recent activity.
It will be closed in 14 days if no further activity occurs.
Thank you for your contributions.

If you think this pull request should stay open, please remove the O: stale 🤖 label or comment on the pull request.

If you're a maintainer, you can stop the bot to mark this issue as stale in the future by adding the O: backlog 🤖 label`.

@github-actions github-actions bot added the O: stale 🤖 Stale issue/pr label Nov 22, 2025
@ferrarimarco ferrarimarco added O: backlog 🤖 Backlog, stale ignores this label and removed O: stale 🤖 Stale issue/pr labels Nov 25, 2025
@ferrarimarco
feat!: update default configurations
e2c0af4 
Refactor default linter configuration to avoid disabling or enabling
arbitrary rules, when possible.

Prefer using the default configuration, when linters provide one.
@github-actions
Copy link
Contributor

github-actions bot commented Jan 22, 2026

Super-linter summary

Language Validation result
BIOME_FORMAT Pass ✅
BIOME_LINT Pass ✅
CHECKOV Pass ✅
EDITORCONFIG Pass ✅
GITLEAKS Pass ✅
GIT_COMMITLINT Pass ✅
GIT_MERGE_CONFLICT_MARKERS Pass ✅
JSCPD Pass ✅
PRE_COMMIT Pass ✅
SPELL_CODESPELL Pass ✅
TRIVY Fail ❌
YAML Fail ❌
YAML_PRETTIER Pass ✅

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY 

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │        4        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dev-dependencies/package-lock.json  │    npm     │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dev-dependencies/Dockerfile         │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.68/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 4, CRITICAL: 0)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                         Title                         │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────┤
│ tar     │ CVE-2026-23745 │ HIGH     │ fixed  │ 6.2.1             │ 7.5.3         │ node-tar: tar: node-tar: Arbitrary file overwrite and │
│         │                │          │        │                   │               │ symlink poisoning via unsanitized linkpaths...        │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-23745            │
│         ├────────────────┤          │        │                   ├───────────────┼───────────────────────────────────────────────────────┤
│         │ CVE-2026-23950 │          │        │                   │ 7.5.4         │ node-tar: tar: node-tar: Arbitrary file overwrite via │
│         │                │          │        │                   │               │ Unicode path collision race condition...              │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-23950            │
│         ├────────────────┤          │        ├───────────────────┼───────────────┼───────────────────────────────────────────────────────┤
│         │ CVE-2026-23745 │          │        │ 7.5.2             │ 7.5.3         │ node-tar: tar: node-tar: Arbitrary file overwrite and │
│         │                │          │        │                   │               │ symlink poisoning via unsanitized linkpaths...        │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-23745            │
│         ├────────────────┤          │        │                   ├───────────────┼───────────────────────────────────────────────────────┤
│         │ CVE-2026-23950 │          │        │                   │ 7.5.4         │ node-tar: tar: node-tar: Arbitrary file overwrite via │
│         │                │          │        │                   │               │ Unicode path collision race condition...              │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-23950            │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────┘
YAML 
/github/workspace/TEMPLATES/.ansible-lint.yml:3:12: [warning] too few spaces before comment: expected 2 (comments)
/github/workspace/TEMPLATES/.markdown-lint.yml:3:81: [error] line too long (85 > 80 characters) (line-length)

@github-actions
Copy link
Contributor

github-actions bot commented Jan 22, 2026

Super-linter summary

Language Validation result
BIOME_FORMAT Pass ✅
BIOME_LINT Pass ✅
CHECKOV Pass ✅
EDITORCONFIG Pass ✅
GITLEAKS Pass ✅
GIT_COMMITLINT Pass ✅
GIT_MERGE_CONFLICT_MARKERS Pass ✅
JSCPD Pass ✅
POWERSHELL Pass ✅
PRE_COMMIT Pass ✅
SPELL_CODESPELL Pass ✅
TRIVY Fail ❌
YAML Fail ❌
YAML_PRETTIER Pass ✅

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY 

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │        4        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dev-dependencies/package-lock.json  │    npm     │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dev-dependencies/Dockerfile         │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.68/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/package-lock.json (npm)
====================================
Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 4, CRITICAL: 0)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                         Title                         │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────┤
│ tar     │ CVE-2026-23745 │ HIGH     │ fixed  │ 6.2.1             │ 7.5.3         │ node-tar: tar: node-tar: Arbitrary file overwrite and │
│         │                │          │        │                   │               │ symlink poisoning via unsanitized linkpaths...        │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-23745            │
│         ├────────────────┤          │        │                   ├───────────────┼───────────────────────────────────────────────────────┤
│         │ CVE-2026-23950 │          │        │                   │ 7.5.4         │ node-tar: tar: node-tar: Arbitrary file overwrite via │
│         │                │          │        │                   │               │ Unicode path collision race condition...              │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-23950            │
│         ├────────────────┤          │        ├───────────────────┼───────────────┼───────────────────────────────────────────────────────┤
│         │ CVE-2026-23745 │          │        │ 7.5.2             │ 7.5.3         │ node-tar: tar: node-tar: Arbitrary file overwrite and │
│         │                │          │        │                   │               │ symlink poisoning via unsanitized linkpaths...        │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-23745            │
│         ├────────────────┤          │        │                   ├───────────────┼───────────────────────────────────────────────────────┤
│         │ CVE-2026-23950 │          │        │                   │ 7.5.4         │ node-tar: tar: node-tar: Arbitrary file overwrite via │
│         │                │          │        │                   │               │ Unicode path collision race condition...              │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-23950            │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────┘
YAML 
/github/workspace/TEMPLATES/.ansible-lint.yml:3:12: [warning] too few spaces before comment: expected 2 (comments)
/github/workspace/TEMPLATES/.markdown-lint.yml:3:81: [error] line too long (85 > 80 characters) (line-length)

@ferrarimarco ferrarimarco added this to the v9.0.0 milestone Jan 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zkoppert zkoppert Awaiting requested review from zkoppert zkoppert will be requested when the pull request is marked ready for review zkoppert is a code owner

@Hanse00 Hanse00 Awaiting requested review from Hanse00 Hanse00 will be requested when the pull request is marked ready for review Hanse00 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

O: backlog 🤖 Backlog, stale ignores this label

Projects

None yet

Milestone

v9.0.0

Development

Successfully merging this pull request may close these issues.

1 participant

@ferrarimarco