Bump ghcr.io/devcontainers/features/terraform from 1.4.0 to 1.4.2 #15

dependabot · 2025-09-22T04:23:58Z

Bumps ghcr.io/devcontainers/features/terraform from 1.4.0 to 1.4.2.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps ghcr.io/devcontainers/features/terraform from 1.4.0 to 1.4.2. --- updated-dependencies: - dependency-name: ghcr.io/devcontainers/features/terraform dependency-version: 1.4.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>

github-actions · 2025-09-22T04:27:24Z

✅⚠️MegaLinter analysis: Success with warnings

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
⚠️ ACTION	actionlint	1		1	0	0.3s
✅ COPYPASTE	jscpd	yes		no	no	1.49s
⚠️ JSON	jsonlint	4		1	0	0.18s
✅ JSON	prettier	4	1	0	0	0.5s
⚠️ JSON	v8r	4		1	0	3.9s
⚠️ MARKDOWN	markdownlint	2	0	4	0	0.65s
✅ MARKDOWN	markdown-table-formatter	2	0	0	0	0.29s
✅ REPOSITORY	devskim	yes		no	no	1.43s
✅ REPOSITORY	dustilock	yes		no	no	0.01s
✅ REPOSITORY	gitleaks	yes		no	no	0.08s
✅ REPOSITORY	git_diff	yes		no	no	0.0s
✅ REPOSITORY	grype	yes		no	no	25.42s
⚠️ REPOSITORY	kics	yes		3	no	1.51s
✅ REPOSITORY	secretlint	yes		no	no	0.41s
✅ REPOSITORY	syft	yes		no	no	1.06s
✅ REPOSITORY	trivy	yes		no	no	4.76s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.09s
✅ REPOSITORY	trufflehog	yes		no	no	2.18s
⚠️ SPELL	cspell	12		39	0	5.14s
⚠️ SPELL	lychee	9		2	0	0.74s
✅ YAML	prettier	3	0	0	0	0.44s
✅ YAML	v8r	3		0	0	3.25s
✅ YAML	yamllint	3		0	0	0.39s

Detailed Issues

⚠️ ACTION / actionlint - 1 error

.github/workflows/mega-linter.yml:56:13: if: condition "${{ success() }} || ${{ failure() }}" is always evaluated to true because extra characters are around ${{ }} [if-cond]
   |
56 |         if: ${{ success() }} || ${{ failure() }}
   |             ^~~

⚠️ SPELL / cspell - 39 errors

.devcontainer/devcontainer.json:23:14     - Unknown word (rchaganti)  -- "ghcr.io/rchaganti/vsc-devcontainer-features
	 Suggestions: []
.devcontainer/devcontainer.json:23:50     - Unknown word (azurebicep) -- devcontainer-features/azurebicep:latest": {},
	 Suggestions: []
.devcontainer/devcontainer.json:27:14     - Unknown word (prulloac)   -- "ghcr.io/prulloac/devcontainer-features
	 Suggestions: [preload, Preload, pullman, pullout, pullback]
.devcontainer/devcontainer.json:31:8      - Unknown word (tflint)     -- "tflint": "latest", // Specifies
	 Suggestions: [tslint, flint, Flint, tint, taint]
.devcontainer/devcontainer.json:36:8      - Unknown word (moby)       -- "moby": true,
	 Suggestions: [mobs, mobx, moly, mony, mopy]
.devcontainer/devcontainer.json:38:21     - Unknown word (Buildx)     -- "installDockerBuildx": true,
	 Suggestions: [Build, Builds, Built, Build's, Builded]
.devcontainer/devcontainer.json:57:31     - Unknown word (azurecontainerapps) -- ms-azuretools.vscode-azurecontainerapps",
	 Suggestions: []
.devcontainer/devcontainer.json:58:31     - Unknown word (azureresourcegroups) -- ms-azuretools.vscode-azureresourcegroups",
	 Suggestions: []
.devcontainer/devcontainer.json:61:18     - Unknown word (Benais)              -- "BenjaminBenais.copilot-theme",
	 Suggestions: [Beans, bean's, Bean's, Beanie, Beanos]
.devcontainer/devcontainer.json:68:10     - Unknown word (formulahendry)       -- "formulahendry.docker-explorer",
	 Suggestions: []
.devcontainer/devcontainer.json:69:13     - Unknown word (dotnettools)         -- "ms-dotnettools.csdevkit",
	 Suggestions: []
.devcontainer/devcontainer.json:69:25     - Unknown word (csdevkit)            -- "ms-dotnettools.csdevkit",
	 Suggestions: [devkit]
.github/copilot-instructions.md:9:4       - Unknown word (newzealandnorth) -- * "newzealandnorth"
	 Suggestions: []
.github/copilot-instructions.md:10:4      - Unknown word (australiaeast)   -- * "australiaeast"
	 Suggestions: [australia's, australians, australian's]
.github/workflows/mega-linter.yml:86:15     - Unknown word (stefanzweifel) -- uses: stefanzweifel/git-auto-commit-action
	 Suggestions: []
.gitignore:6:4       - Unknown word (tfstate)    -- # .tfstate files
	 Suggestions: [testate, testates, state, testnet, Testnet]
.gitignore:7:3       - Unknown word (tfstate)    -- *.tfstate
	 Suggestions: [testate, testates, state, testnet, Testnet]
.gitignore:8:3       - Unknown word (tfstate)    -- *.tfstate.*
	 Suggestions: [testate, testates, state, testnet, Testnet]
.gitignore:14:16     - Unknown word (tfvars)     -- # Exclude all .tfvars files, which are likely
	 Suggestions: [tars, tears, tsars, tzars, tatars]
.gitignore:18:3      - Unknown word (tfvars)     -- *.tfvars
	 Suggestions: [tars, tears, tsars, tzars, tatars]
.gitignore:19:3      - Unknown word (tfvars)     -- *.tfvars.json
	 Suggestions: [tars, tears, tsars, tzars, tatars]
.gitignore:38:2      - Unknown word (terraformrc) -- .terraformrc
	 Suggestions: [terraform, terraformed, Terraform]
.gitignore:40:1      - Unknown word (avmmakefile) -- avmmakefile
	 Suggestions: [makefile]
.gitignore:42:5      - Unknown word (tflint)      -- avm.tflint.hcl
	 Suggestions: [tslint, flint, Flint, tint, taint]
.gitignore:43:5      - Unknown word (tflint)      -- avm.tflint_example.hcl
	 Suggestions: [tslint, flint, Flint, tint, taint]
.gitignore:44:5      - Unknown word (tflint)      -- avm.tflint_module.hcl
	 Suggestions: [tslint, flint, Flint, tint, taint]
.gitignore:45:5      - Unknown word (tflint)      -- avm.tflint.merged.hcl
	 Suggestions: [tslint, flint, Flint, tint, taint]
.gitignore:46:5      - Unknown word (tflint)      -- avm.tflint_example.merged.hcl
	 Suggestions: [tslint, flint, Flint, tint, taint]
.pre-commit-config.yaml:20:23     - Unknown word (tflint)     -- - id: terraform_tflint
	 Suggestions: [tslint, flint, Flint, tint, taint]
.pre-commit-config.yaml:27:13     - Unknown word (tfupdate)   -- - id: tfupdate
	 Suggestions: [update, tubate, template, tinplate, toeplate]
.vscode/launch.json:6:16      - Unknown word (coreclr)    -- "type": "coreclr",
	 Suggestions: [coercer, corer, coracle, corelli, Corelli]
.vscode/launch.json:18:10     - Unknown word (ASPNETCORE) -- "ASPNETCORE_ENVIRONMENT": "Development
	 Suggestions: []
.vscode/launch.json:26:16     - Unknown word (coreclr)    -- "type": "coreclr",
	 Suggestions: [coercer, corer, coracle, corelli, Corelli]
.vscode/settings.json:3:6       - Unknown word (chatmodes)  -- "chatmodes": true
	 Suggestions: [cathodes, camoes, cathode, chamade, chamois]
.vscode/settings.json:22:11     - Unknown word (chatmode)   -- // "*.chatmode.md": "markdown",
	 Suggestions: [cathode, chamade, champed, charmed, chasmed]
.vscode/tasks.json:12:11     - Unknown word (consoleloggerparameters) -- "/consoleloggerparameters:NoSummary;ForceNoAlign
	 Suggestions: []
.vscode/tasks.json:24:11     - Unknown word (consoleloggerparameters) -- "/consoleloggerparameters:NoSummary;ForceNoAlign
	 Suggestions: []
.vscode/tasks.json:40:17     - Unknown word (codespaceiaccoding)      -- "tag": "codespaceiaccoding:dev",
	 Suggestions: []
.vscode/tasks.json:55:17     - Unknown word (codespaceiaccoding)      -- "tag": "codespaceiaccoding:latest",
	 Suggestions: []
CSpell: Files checked: 12, Issues found: 39 in 8 files.


You can skip this misspellings by defining the following .cspell.json file at the root of your repository
Of course, please correct real typos before :)

{
    "version": "0.2",
    "language": "en",
    "ignorePaths": [
        "**/node_modules/**",
        "**/vscode-extension/**",
        "**/.git/**",
        "**/.pnpm-lock.json",
        ".vscode",
        "package-lock.json",
        "megalinter-rep

(Truncated to 5714 characters out of 6426)

⚠️ JSON / jsonlint - 1 error

File: .devcontainer/devcontainer.json
Parse error on line 2, column 3:
{  // "name" specifies ...
---^
Unexpected token "/"

⚠️ REPOSITORY / kics - 3 errors

MLLLLLM             MLLLLLLLLL   LLLLLLL             KLLLLLLLLLLLLLLLL       LLLLLLLLLLLLLLLLLLLLLLL 
   MMMMMMM           MMMMMMMMMML    MMMMMMMK       LMMMMMMMMMMMMMMMMMMMML   KLMMMMMMMMMMMMMMMMMMMMMMMMM 
   MMMMMMM         MMMMMMMMML       MMMMMMMK     LMMMMMMMMMMMMMMMMMMMMMML  LMMMMMMMMMMMMMMMMMMMMMMMMMMM 
   MMMMMMM      MMMMMMMMMML         MMMMMMMK   LMMMMMMMMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMMMMM 
   MMMMMMM    LMMMMMMMMML           MMMMMMMK  LMMMMMMMMMLLMLLLLLLLLLLLLLL LMMMMMMMLLLLLLLLLLLLLLLLLLLLM 
   MMMMMMM  MMMMMMMMMLM             MMMMMMMK LMMMMMMMM                    LMMMMMML                      
   MMMMMMMLMMMMMMMML                MMMMMMMK MMMMMMML                     LMMMMMMMMLLLLLLLLLLLLLMLL     
   MMMMMMMMMMMMMMMM                 MMMMMMMK MMMMMML                       LMMMMMMMMMMMMMMMMMMMMMMMMML  
   MMMMMMMMMMMMMMMMMM               MMMMMMMK MMMMMMM                         LMMMMMMMMMMMMMMMMMMMMMMMML 
   MMMMMMM KLMMMMMMMMML             MMMMMMMK LMMMMMMM                                          MMMMMMMML
   MMMMMMM    LMMMMMMMMMM           MMMMMMMK LMMMMMMMMLL                                        MMMMMMML
   MMMMMMM      LMMMMMMMMMLL        MMMMMMMK  LMMMMMMMMMMMMMMMMMMMMMMMMML LLLLLLLLLLLLLLLLLLLLMMMMMMMMMM
   MMMMMMM        MMMMMMMMMMML      MMMMMMMK   MMMMMMMMMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMMMMM 
   MMMMMMM          LLMMMMMMMMML    MMMMMMMK     LLMMMMMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMMML  
   MMMMMMM             MMMMMMMMMML  MMMMMMMK         KLMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMLK    
                                                                                                            
                                                                                                                                                                                                                                                                                                                        


Scanning with Keeping Infrastructure as Code Secure v2.1.13





Unpinned Actions Full Length Commit SHA, Severity: LOW, Results: 3
Description: Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
Platform: CICD
CWE: 829
Learn more about this vulnerability: https://docs.kics.io/latest/queries/cicd-queries/555ab8f9-2001-455e-a077-f2d0f41e2fb9

	[1]: .github/workflows/mega-linter.yml:86

		085:         if: steps.ml.outputs.has_updated_sources == 1 && (env.APPLY_FIXES_EVENT == 'all' || env.APPLY_FIXES_EVENT == github.event_name) && env.APPLY_FIXES_MODE == 'commit' && github.ref != 'refs/heads/main' && (github.event_name == 'push' || github.event.
		086:         uses: stefanzweifel/git-auto-commit-action@v6
		087:         with:


	[2]: .github/workflows/mega-linter.yml:44

		043:         # More info at https://megalinter.io/flavors/
		044:         uses: oxsecurity/megalinter@beta
		045:         env:


	[3]: .github/workflows/mega-linter.yml:68

		067:         if: steps.ml.outputs.has_updated_sources == 1 && (env.APPLY_FIXES_EVENT == 'all' || env.APPLY_FIXES_EVENT == github.event_name) && env.APPLY_FIXES_MODE == 'pull_request' && (github.event_name == 'push' || github.event.pull_request.head.repo.full_n
		068:         uses: peter-evans/create-pull-request@v7
		069:         with:



Results Summary:
CRITICAL: 0
HIGH: 0
MEDIUM: 0
LOW: 3
INFO: 0
TOTAL: 3

⚠️ SPELL / lychee - 2 errors

[404] https://megalinter.io/configuration/ | Network error: Not Found
[404] https://megalinter.io/flavors/ | Network error: Not Found
📝 Summary
---------------------
🔍 Total...........12
✅ Successful.......9
⏳ Timeouts.........0
🔀 Redirected.......0
👻 Excluded.........1
❓ Unknown..........0
🚫 Errors...........2

Errors in .github/workflows/mega-linter.yml
[404] https://megalinter.io/configuration/ | Network error: Not Found
[404] https://megalinter.io/flavors/ | Network error: Not Found

⚠️ MARKDOWN / markdownlint - 4 errors

.github/copilot-instructions.md:1:401 MD013/line-length Line length [Expected: 400; Actual: 623]
.github/copilot-instructions.md:1 MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "Provide comprehensive guidance..."]
.github/copilot-instructions.md:3:401 MD013/line-length Line length [Expected: 400; Actual: 534]
.github/copilot-instructions.md:12:401 MD013/line-length Line length [Expected: 400; Actual: 477]

⚠️ JSON / v8r - 1 error

ℹ No config file found
ℹ Pre-warming the cache
ℹ Processing .devcontainer/devcontainer.json
ℹ Found schema in https://www.schemastore.org/api/json/catalog.json ...
ℹ Validating .devcontainer/devcontainer.json against schema from https://raw.githubusercontent.com/devcontainers/spec/main/schemas/devContainer.schema.json ...
✖ Expected property name or '}' in JSON at position 4 (line 2 column 3)

ℹ Processing .vscode/launch.json
✖ Could not find a schema to validate .vscode/launch.json

ℹ Processing .vscode/settings.json
✖ Could not find a schema to validate .vscode/settings.json

ℹ Processing .vscode/tasks.json
ℹ Found schema in https://www.schemastore.org/api/json/catalog.json ...
ℹ Validating .vscode/tasks.json against schema from https://www.schemastore.org/task.json ...
✖ .vscode/tasks.json is invalid

.vscode/tasks.json#/tasks/3/type must be equal to one of the allowed values
.vscode/tasks.json#/tasks/4/type must be equal to one of the allowed values
.vscode/tasks.json#/tasks/5/type must be equal to one of the allowed values
.vscode/tasks.json#/tasks/6/type must be equal to one of the allowed values

See detailed reports in MegaLinter artifacts

You could have the same capabilities but better runtime performances if you use a MegaLinter flavor:

oxsecurity/megalinter/flavors/terraform@beta (53 linters)
oxsecurity/megalinter/flavors/cupcake@beta (86 linters)

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

Documentation: Custom Flavors
Command: npx mega-linter-runner@beta --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,COPYPASTE_JSCPD,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_DEVSKIM,REPOSITORY_DUSTILOCK,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_KICS,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_CSPELL,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

dependabot bot added dependencies Pull requests that update a dependency file devcontainers_package_manager Pull requests that update devcontainers_package_manager code labels Sep 22, 2025

dependabot bot mentioned this pull request Sep 22, 2025

Bump ghcr.io/devcontainers/features/terraform from 1.4.0 to 1.4.1 #11

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump ghcr.io/devcontainers/features/terraform from 1.4.0 to 1.4.2 #15

Bump ghcr.io/devcontainers/features/terraform from 1.4.0 to 1.4.2 #15

Uh oh!

dependabot bot commented on behalf of github Sep 22, 2025

Uh oh!

github-actions bot commented Sep 22, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Bump ghcr.io/devcontainers/features/terraform from 1.4.0 to 1.4.2 #15

Are you sure you want to change the base?

Bump ghcr.io/devcontainers/features/terraform from 1.4.0 to 1.4.2 #15

Uh oh!

Conversation

dependabot bot commented on behalf of github Sep 22, 2025

Uh oh!

github-actions bot commented Sep 22, 2025

✅⚠️MegaLinter analysis: Success with warnings

Detailed Issues

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants