From 80aba8783c19131a7a174b464d9a4e7ebe8f13e7 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Sat, 10 Oct 2026 03:11:58 -0700
Subject: [PATCH] build(deps): update TruffleHog to v3.98.0

Refresh the pinned secret-scanning action and record the update in Unreleased.

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/secret-scan.yml | 2 +-
 CHANGELOG.md                      | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index d39fad2d..de3a611c 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -49,7 +49,7 @@ jobs:
 
       - name: TruffleHog OSS
         id: trufflehog
-        uses: trufflesecurity/trufflehog@4dd8831c5f12599465d4d45c3c447b4018a34c85 # v3.97.9
+        uses: trufflesecurity/trufflehog@0186870afd2c4a90def791d80260923ba583d076 # v3.98.0
         with:
           path: ./
           base: ${{ steps.scan_range.outputs.base }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 218cfc0f..0ad31149 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+- Update the TruffleHog secret-scanning action to v3.98.0. Thanks @dependabot.
+
 - Update the indirect `go-strftime` dependency to v1.1.0, retaining the existing Go runtime floor.
 
 - Load the analytics discovery receipt beside the resolved config, including `GITCRAWL_CONFIG`, instead of the working directory. Thanks @SebTardif.