[renovate]

This PR contains the following updates:

Package	Type	Update	Change
hadolint/hadolint	repository	minor	v2.12.0 → v2.15.1

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

hadolint/hadolint

v2.15.1

Compare Source

What's Changed

• CI: Fix Macos Cache and image name by @​m-ildefons in #​1225
• DL3066: Fix false positive when UID is an argument by @​m-ildefons in #​1226

Full Changelog: hadolint/hadolint@v2.15.0...v2.15.1

v2.15.0

Compare Source

What's Changed

• build(deps): bump actions/cache from 4.2.4 to 4.3.0 by @​dependabot[bot] in #​1135
• Check if clean is after install package by @​matmarczak in #​962
• Enable file-path-in-report flag for codeclimate formatters by @​bpfoster in #​1018
• SonarQube Formatter: Support --file-path-in-report by @​m-ildefons in #​1151
• (doc) Add missing steps for developing this software by @​ghoneycutt in #​1021
• Toil: bump GitHub action versions by @​m-ildefons in #​1153
• Automatically update Third party licenses by @​m-ildefons in #​1154
• Bump upload/download artifacts action by @​m-ildefons in #​1161
• Added SonarQube format test by @​304NotModified in #​1157
• Update README: tell about comments on ignore rules by @​304NotModified in #​1162
• Fix DL3018 for apk ~ pins by @​nothankyouzzz in #​1168
• Online Linter: Revive the online linter by @​m-ildefons in #​1178
• Update Readme by @​m-ildefons in #​1181
• Fix: propagating shell options across build stages by @​m-ildefons in #​1180
• Ignore dnf group install from DL3041 by @​kpumuk in #​1148
• build(deps): bump actions/upload-artifact from 6 to 7 by @​dependabot[bot] in #​1170
• build(deps): bump actions/download-artifact from 7 to 8 by @​dependabot[bot] in #​1169
• build(deps): bump docker/setup-buildx-action from 3 to 4 by @​dependabot[bot] in #​1173
• build(deps): bump docker/login-action from 3 to 4 by @​dependabot[bot] in #​1172
• build(deps): bump docker/build-push-action from 6 to 7 by @​dependabot[bot] in #​1171
• DL3062: relax DL3062, fix readme by @​m-ildefons in #​1131
• DL3040: Match different install command variations by @​m-ildefons in #​1182
• DL3063: New rule, stage name reserved word by @​m-ildefons in #​1183
• readme: fixup readme by @​m-ildefons in #​1184
• build(deps): bump EndBug/add-and-commit from 9 to 10 by @​dependabot[bot] in #​1186
• build(deps): bump softprops/action-gh-release from 2 to 3 by @​dependabot[bot] in #​1187
• fix: fix hlint warnings by @​m-ildefons in #​1189
• Shellcheck: fix false-positives with exec notation by @​m-ildefons in #​1194
• DL3065: New Rule: No FROM with $TARGETPLATFORM by @​m-ildefons in #​1190
• Ignore Pragma: Add stage ignore pragma by @​m-ildefons in #​1195
• Fix DL3013 false positive on pipx --python flag by @​eyupcanakman in #​1196
• Add JUnit output formatter by @​m-ildefons in #​1192
• Fix DL3013 false positive on pip --root-user-action flag by @​eyupcanakman in #​1198
• Update to Alpine 3.24 by @​jnoordsij in #​1206
• Fix DL3016 false positive on npm --registry flag by @​eyupcanakman in #​1210
• New Rule: DL3066 Non-numeric user-id by @​m-ildefons in #​1212
• build(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​1211
• DL3025: Trigger on HEALTHCHECK instructions too by @​m-ildefons in #​1209
• DL3018: Allow fuzzy version matching by @​m-ildefons in #​1201
• Checkstyle: Output file node on empty result by @​m-ildefons in #​1204
• build(deps): bump actions/cache from 5 to 6 by @​dependabot[bot] in #​1213
• Add rule against copying root from another stage by @​Develop-KIM in #​1215
• DL3026: Warn on COPY --from untrusted registry by @​m-ildefons in #​1205
• DL3026: Disallow mounting from untrusted registies by @​m-ildefons in #​1216
• DL3041: Accept package versions in environment variables by @​m-ildefons in #​1185
• Add output to file/multiple files by @​m-ildefons in #​1197
• Dependencies: Bump language-docker to v16.0.0 by @​m-ildefons in #​1218
• New Rule: DL3064 ARG or ENV with sensitive data by @​m-ildefons in #​1188
• Hadolint Embedded: Fix output interface by @​m-ildefons in #​1219
• CI: Improve Release Workflow by @​m-ildefons in #​1220
• Release v2.15.0 by @​m-ildefons in #​1221

New Contributors

• @​matmarczak made their first contribution in #​962
• @​bpfoster made their first contribution in #​1018
• @​304NotModified made their first contribution in #​1157
• @​nothankyouzzz made their first contribution in #​1168
• @​kpumuk made their first contribution in #​1148
• @​eyupcanakman made their first contribution in #​1196
• @​jnoordsij made their first contribution in #​1206
• @​Develop-KIM made their first contribution in #​1215

Full Changelog: hadolint/hadolint@v2.14.0...v2.15.0

v2.14.0

Compare Source

What's Changed

• Enhance INTEGRATION.md with a toc and ordering by @​jammsen in #​1118
• DL3041, DL3033: Handle RPM package epoch by @​m-ildefons in #​1121
• DL3009: Allow either cache or tmpfs mounts by @​m-ildefons in #​1123
• added new rule DL3062 to check go install by @​Danil42Russia in #​1111
• DL3041, DL3033: Handle RPM package with plus sign by @​samcranford in #​1125
• relax dependencies by @​m-ildefons in #​1128
• fixup release workflow by @​m-ildefons in #​1129

New Contributors

• @​jammsen made their first contribution in #​1118
• @​Danil42Russia made their first contribution in #​1111
• @​samcranford made their first contribution in #​1125

Full Changelog: hadolint/hadolint@v2.13.1...v2.14.0

v2.13.1

Compare Source

What's Changed

• build(deps): bump actions/cache from 3.0.4 to 3.0.11 by @​dependabot[bot] in #​888
• build(deps): bump cachix/install-nix-action from 17 to 18 by @​dependabot[bot] in #​890
• build(deps): bump cachix/cachix-action from 10 to 12 by @​dependabot[bot] in #​894
• docs: use cabal instead of stack in readme by @​m-ildefons in #​903
• DL3011: fixup changes in AST by @​m-ildefons in #​902
• fix: false positive in DL3022 by @​swarnimarun in #​900
• Correct documentation example for failure-threshold by @​ericcornelissen in #​901
• update hadolint's config json schema to support latest properties by @​omissis in #​910
• Update INTEGRATION.md steps for pre-commit by @​tangyfruits in #​908
• chore: fix typos in rule descriptions by @​AndreyBozhko in #​912
• Add LABEL org.opencontainers.image.source="https://github.com/hadolin… by @​marwin1991 in #​927
• DL3014: Fix false positive on double quiet by @​m-ildefons in #​913
• Update README.md by @​ding-ma in #​918
• Spelling by @​jsoref in #​936
• fix: misidentification of pipenv (#​366) by @​kthy in #​940
• build(deps): bump cachix/install-nix-action from 18 to 20 by @​dependabot[bot] in #​944
• build(deps): bump actions/cache from 3.0.11 to 3.3.1 by @​dependabot[bot] in #​946
• build(deps): bump docker/build-push-action from 3 to 4 by @​dependabot[bot] in #​931
• build(deps): bump svenstaro/upx-action from 2.0.1 to 2.2.0 by @​dependabot[bot] in #​922
• delete rule DL3005 by @​deronnax in #​964
• docs: Add new section for Ignoring Rules in README by @​tanmay-pnaik in #​1008
• docs: Add Table of Contents for README by @​tanmay-pnaik in #​1007
• DL3060 should be suppressed if cache mounts are used by @​slimslenderslacks in #​1003
• Improve parsing of gem install flag patterns to reduce false positives by @​mkusaka in #​954
• fix: fp in DL3006 by @​swarnimarun in #​942
• docs: Update TOC with Ignoring Rules section by @​tanmay-pnaik in #​1013
• build(deps): bump svenstaro/upx-action from 2.2.0 to 2.3.0 by @​dependabot[bot] in #​959
• Pragma: Allow comments following inline by @​m-ildefons in #​1059
• build(deps): bump actions/cache from 3.3.1 to 4.2.0 by @​dependabot[bot] in #​1063
• Ignore unsatisfiable shellcheck error 1091 by @​ghoneycutt in #​1020
• build(deps): bump cachix/install-nix-action from 26 to 30 by @​dependabot[bot] in #​1045
• build(deps): bump actions/checkout from 3 to 4 by @​dependabot[bot] in #​1046
• build(deps): bump cachix/cachix-action from 14 to 15 by @​dependabot[bot] in #​1047
• build(deps): bump docker/setup-buildx-action from 2 to 3 by @​dependabot[bot] in #​1048
• Fix casing in Dockerfile by @​JEnglandOhalo in #​1093
• fix: replace actor with repository_owner in ghcr login by @​aweiher in #​1086
• Fix GitHub Actions badge in README.md by @​PeterDaveHello in #​1072
• Add SC1091 to yaml Schema by @​psmey in #​1088
• DL3048 accepting LABEL keys that contain underscore(s) or slash(es) by @​mschmeitz in #​1034
• Improve DL3009 rule to properly handle all apt-based package managers by @​PeterDaveHello in #​1074
• Replace cryptonite with cryptohash-sha1 by @​anuraaga in #​1090
• build(deps): bump actions/cache from 4.2.0 to 4.2.3 by @​dependabot[bot] in #​1082
• fix(DL3041): Prevent false negatives for packages which include a dash in their package name by @​egfx-notifications in #​1098
• fix character escaping in checkstyle formatter by @​m-ildefons in #​1104
• build(deps): bump actions/cache from 4.2.3 to 4.2.4 by @​dependabot[bot] in #​1115
• build(deps): bump actions/checkout from 4 to 5 by @​dependabot[bot] in #​1113
• build(deps): bump actions/download-artifact from 4 to 5 by @​dependabot[bot] in #​1114
• Added CI integration instructions for Azure Devops by @​joelbourbon in #​1112
• Release v2.13.1 by @​m-ildefons in #​1116

New Contributors

• @​swarnimarun made their first contribution in #​900
• @​ericcornelissen made their first contribution in #​901
• @​omissis made their first contribution in #​910
• @​tangyfruits made their first contribution in #​908
• @​AndreyBozhko made their first contribution in #​912
• @​marwin1991 made their first contribution in #​927
• @​ding-ma made their first contribution in #​918
• @​jsoref made their first contribution in #​936
• @​kthy made their first contribution in #​940
• @​deronnax made their first contribution in #​964
• @​tanmay-pnaik made their first contribution in #​1008
• @​slimslenderslacks made their first contribution in #​1003
• @​mkusaka made their first contribution in #​954
• @​ghoneycutt made their first contribution in #​1020
• @​JEnglandOhalo made their first contribution in #​1093
• @​aweiher made their first contribution in #​1086
• @​psmey made their first contribution in #​1088
• @​mschmeitz made their first contribution in #​1034
• @​anuraaga made their first contribution in #​1090
• @​egfx-notifications made their first contribution in #​1098
• @​joelbourbon made their first contribution in #​1112

Full Changelog: hadolint/hadolint@v2.12.0...v2.13.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0958d496-3dfb-4ae3-9e86-0f3c01b0dab0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}