Repository navigation
build(deps): bump trufflesecurity/trufflehog from 3.98.0 to 3.99.2 - #250
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.98.0 to 3.99.2. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@0186870...e76dff8) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.99.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
clawsweeper
Bot
added
P3
|
Codex review: needs maintainer review before merge. What this changesThis PR updates the TruffleHog GitHub Action pin from v3.98.0 to v3.99.2. Example: A pull request triggers the secret-scanning workflow.
Review scores
ProductKind: Maintenance · Worth it: Yes · Fix scope: Complete Merge readiness✅ Ready for maintainer review Keep this PR open: main still has the older action pin, and the update preserves the existing execution contract with no actionable defect found. Priority: P3 Before mergeNone. FindingsNone. Agent review detailsHow this fits togetherGitHub Actions supplies the checked-out repository and commit range to TruffleHog, which reports verified credentials and fails the security gate when appropriate. flowchart LR
A[Push or pull request] --> B[Checkout repository]
B --> C[Resolve commit range]
C --> D[Pinned TruffleHog action]
D --> E[Latest scanner image]
E --> F[Security gate result]
Technical reviewBest possible solution: Retain the focused action-pin refresh under the existing workflow ownership. Do we have a high-confidence way to reproduce the issue? No bug is claimed; source inspection verifies the pin update and unchanged action wrapper. Is this the best way to solve the issue? The single-line update follows established maintenance practice, although it does not pin the scanner binary because both wrappers use the latest image. AGENTS.md: found but not applied because it conflicted with ClawSweeper's review contract. Codex review notes: model internal, reasoning medium; reviewed against 0b0b979b3cd6. Provenance checked
TestingProof path: shipped entry point. SecurityNone. EvidenceWhat I checked:
Likely related people:
LabelsLabel changes:
Label justifications:
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment Reviewed October 15, 2026, 2:56 PM ET / 18:56 UTC. |
Consolidate Dependabot #246, #247, #248, #249, #250, and #251. Update CrawlKit to 0.17.0, ANSI helpers to 0.11.9, transitive modules, and the Node setup, GoReleaser, app-token, and secret-scanning actions. Retain the Go 1.27.2 minimum. Thanks @dependabot. Expose an explicit release dry run, forwarding the typed input to the shared workflow so the current version can be built, signed, and verified without publication. Document the command. Validation: full make check passed on AWS, including 85.1% coverage, govulncheck with no vulnerabilities, docs, release-script tests, and six-platform snapshot builds. actionlint and independent Codex autoreview through P3 passed. Exact-head CI was required before merge.
|
Included TruffleHog 3.99.2 in #252, now merged. The consolidated update passed the full make check gate, including govulncheck, 85.1% coverage, six-platform snapshot builds, and exact-head Linux/macOS/Windows/Docker CI. Closing this superseded dependency PR. Thanks! |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps trufflesecurity/trufflehog from 3.98.0 to 3.99.2.
Release notes
Sourced from trufflesecurity/trufflehog's releases.
Commits
e76dff8Somehow forgot to pull the config value into the engine (#5402)005b692[INT-1084] Make the results deduplication cache size configurable (#5399)f6499ffUpdate github-actions (#5363)b2b0a92Add OAuth2 (ROPC) auth for verification requests (#5392)ab5ee07Fix Sumo Logic detector ignoring configured verifier endpoints (#5395)4c282f5Add api_timeout_seconds to Gerrit source proto (#5394)c95844eAdd a TruffleHog dectector for Kong Konnect Platform (#5305)cc79781Add postman source documentation (#5389)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)