Update Dependencies for pre-commit

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
betterleaks/betterleaks	repository	minor	v1.7.3 → v1.8.0	v1.8.1
zizmorcore/zizmor-pre-commit	repository	minor	v1.28.0 → v1.29.0

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

betterleaks/betterleaks (betterleaks/betterleaks)

v1.8.0

Compare Source

What's New

More Generic Rules

Previously, generic-api-key also handled password-like identifiers. In v1.8.0, generic credential detection is separated into focused rules:

Rule	Detects	Confidence behavior
generic-api-key	API keys, tokens, and other opaque machine secrets without a known provider	Starts at low and can move to medium when stronger context is present
generic-password	Hardcoded password assignments and passwords passed to authentication calls	Starts at low and can move to medium when nearby identity or authentication context strengthens the finding
generic-credential-uri	Passwords embedded in HTTP, database, messaging, directory, mail, FTP, and SSH URIs	Starts at medium and drops to low for test, documentation, or example-like contexts

The password rule uses nearby authentication, connection, and username fields as supporting evidence. A hidden generic-username component supplies that context without producing standalone username findings.

The credential URI rule reports the embedded password rather than the entire URI. Provider-specific rules continue to take precedence when a more precise match is available.

Filter findings by confidence

Every bundled rule now assigns a low, medium, or high confidence level based on how strongly its pattern indicates a real secret.

Use the new --confidence flag to set the minimum level included in a scan:

betterleaks dir . --confidence medium

Suppressed findings are removed before live validation, so they do not generate validation requests or affect reports, finding counts, or exit codes.

Customize confidence

Custom rules can assign a static confidence level:

[[rules]]
id = "internal-api-key"
confidence = "low"
regex = '''...'''

Rule filters can also change confidence based on context using filter.setConfidence:

let level = hasStrongContext ? "medium" : "low";
let _ = filter.setConfidence(level);
false

It's a bit hacky and should be used sparingly, but it's better than not being able to update confidence in config.

Rules without an assigned confidence remain included when a confidence threshold is used, preserving compatibility with existing custom configurations.

More control over individual rules

This release also adds dedicated flags for disabling or isolating rules:

# Disable a noisy rule
betterleaks dir . --disable-rule generic-password

# Run only the generic rules
betterleaks dir . \
  --isolate-rule generic-api-key \
  --isolate-rule generic-password \
  --isolate-rule generic-credential-uri

Both flags are repeatable and also support -dr and -ir aliases. The existing --enable-rule flag remains available as a compatibility alias for --isolate-rule.

Other improvements

• Added detection for GitLab incoming-mail address tokens.
• Fixed incorrect finding column positions in file scans.
• Improved handling of malformed compressed files.
• Filtered a known deactivated Flickr token from the generic API-key rule.
• Updated rule confidence classifications across the bundled rule set.
• Updated the Go toolchain and dependencies.

Full changelog: v1.7.4...v1.8.0

Changelog

• 706dbe2 Chore/demote linkedin (#​299)
• ecea1f6 Fix incorrect column value being returned for files (#​258)
• c4a792a Ignore deactivated Flickr token in Dojo Toolkit (#​296)
• f3c0490 Rule/generic uri (#​304)
• 23b73e4 Rules/new username pw (#​289)
• 6cf4f1a Rules/update w confidence (#​297)
• d4fe93b additional gitlab incoming mail token detection (#​288)
• 3601d77 chore: Bumping Go to 1.25.10 and update x/text library (#​294)
• 5e8ec7f disable and isolate rules (#​303)
• c8a3750 fix (#​306)
• 6ed638a fix path to CONTRIBUTING.md (#​292)
• 49f3292 rule confidence + attribute (#​293)
• 6fa83dd updating confidence for a few rules (#​298)

v1.7.4

Compare Source

What's New

Added a components field in the [[rules]] table. The introduction of components moves Betterleaks toward a canonical rule model. Each rule in [[rules]] should describe how secrets get detected, which nearby values belong (via components) to it, how it is filtered, and how it is validated. Adding components keeps multipart relationships with the rule they belong to instead of introducing a separate configuration shape (or expanding [[rules.required]].

A rule can reference other rules as required or optional components. The
top-level rule regex remains the reported secret and proximity anchor:

[[rules]]
id = "credential"
regex = '''credential[=: ]+([A-Za-z0-9_-]+)'''
components = [
  { id = "account-id", within = "5L" },
  { id = "session-token", optional = true, within = "-2L,+4C" },
]

Components are required (as in optional=false, not as in "each rule requires components) by default. Set optional = true to attach a component when present without making it gate the primary finding; optional = false is equivalent to omitting the field. within is optional and uses the same grammar as --match-context: 5L allows the primary match line plus up to four lines before and after, 100C allows 100 characters on either side, and signs make a boundary directional (for example, -2L,+4C). When within is omitted, the component only needs to occur in the same fragment.

You can reference components in the validate Expr like:

components["account-id"]?.secret ?? ""

Components are keyed by the referenced component rule ID. Each has secret and captures fields.

Changelog

• ed69eef captures was overloaded (#​285)
• fabb0c2 introduce components field, start deprecating rules.required (#​282)
• e8c8ab9 validator for algolia (#​278)

zizmorcore/zizmor-pre-commit (zizmorcore/zizmor-pre-commit)

v1.29.0

Compare Source

New Features 🌈🔗

• zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#​2209)

• New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#​2228)

• zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#​2248)

Changes ⚠️🔗

• The unpinned-uses and unpinned-images audits have been separated more cleanly: unpinned-uses is now principally responsible for Git-style uses: clauses, whereas unpinned-images is now responsible for docker://-style uses: clauses (in addition to already checking other image references) (#​2222)

Removals 🌅🔗

• --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#​2242)

Bug Fixes 🐛🔗

• Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#​2220)

• Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#​2227)

• Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#​2234)

---

Configuration

📅 Schedule: (in timezone Europe/Copenhagen)

• Branch creation
  • Between 12:00 AM and 05:59 AM, on day 1 of the month (* 0-5 1 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Fixed	Errors	Max errors	Warnings	Elapsed time
✅ ACTION	actionlint	1		0		0	0.05s
✅ ACTION	zizmor	1		0		0	2.06s
✅ ANSIBLE	ansible-lint	yes		no		no	14.8s
✅ COPYPASTE	jscpd	yes		no		no	0.69s
✅ MARKDOWN	markdownlint	1		0		0	0.54s
✅ MARKDOWN	markdown-table-formatter	2		0		0	0.23s
✅ REPOSITORY	betterleaks	yes		no		no	0.59s
✅ REPOSITORY	checkov	yes		no		no	19.88s
✅ REPOSITORY	git_diff	yes		no		no	0.01s
✅ REPOSITORY	grype	yes		no		no	65.13s
✅ REPOSITORY	osv-scanner	yes		no		no	0.45s
✅ REPOSITORY	secretlint	yes		no		no	1.19s
✅ REPOSITORY	syft	yes		no		no	2.34s
✅ REPOSITORY	trivy	yes		no		no	9.96s
✅ REPOSITORY	trivy-sbom	yes		no		no	0.38s
✅ REPOSITORY	trufflehog	yes		no		no	3.98s
✅ YAML	prettier	25		0		0	0.73s
✅ YAML	v8r	25		0		0	10.87s
✅ YAML	yamllint	25		0		0	0.38s

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_KICS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository