[renovate]

This PR contains the following updates:

Package	Type	Update	Change
trufflesecurity/trufflehog	action	minor	v3.97.1 → v3.99.7

---

Release Notes

trufflesecurity/trufflehog

v3.99.7

Compare Source

What's Changed

• Fix --include-wikis help typo and huggingface README description by @​protonnegativo in #​5471
• fix(detectors/anypointoauth2): stop treating HTTP 422 as verified by @​jamesgol in #​5386
• Add xAI analyzer by @​serval-frenchie in #​5456
• ci(lint): pin the semgrep container image by digest by @​Portll in #​5245
• feat(detectors): add Fireworks AI API key detector by @​sudo-a-man in #​5447
• feat(detectors): add Infisical service token detector by @​Varshith-Kali in #​5445
• Fix 7z and rar panics in the archive handler and log recovered panic stacks by @​dustin-decker in #​5474

New Contributors

• @​protonnegativo made their first contribution in #​5471
• @​serval-frenchie made their first contribution in #​5456
• @​Portll made their first contribution in #​5245
• @​sudo-a-man made their first contribution in #​5447
• @​Varshith-Kali made their first contribution in #​5445

Full Changelog: trufflesecurity/trufflehog@v3.99.6...v3.99.7

v3.99.6

Compare Source

v3.99.5 was tagged but never published because its release build failed. v3.99.6 supersedes it and includes all of the changes below.

What's Changed

• Update github-actions by @​renovate[bot] in #​5414
• Prefer nearest client/tenant IDs for Azure SP secrets by @​kashifkhan0771 in #​5449
• Clean up Filesystem source logging for per-source debug by @​kashifkhan0771 in #​5465
• security: bump andybalholm/brotli to v1.2.7 (CVE-2026-111497) by @​dustin-decker in #​5472
• Keep GoReleaser temp files off the tmpfs /tmp in releases by @​dustin-decker in #​5473

Full Changelog: trufflesecurity/trufflehog@v3.99.4...v3.99.6

v3.99.5

Compare Source

v3.99.4

Compare Source

What's Changed

• Add per-source debug option and hide sensitive data in debug logs by @​kashifkhan0771 in #​5446
• Mark results whose verification was skipped by @​unsmith in #​5448
• Clean up Git source logging for per-source debug by @​kashifkhan0771 in #​5451
• Add Lambda Cloud API key detector by @​lukem-ts in #​5435
• Update github.com/trufflesecurity/ldap-verify digest to 4a15faf by @​renovate[bot] in #​5441
• Update dependency trufflesecurity/.github to v1.0.5 by @​renovate[bot] in #​5442
• Update module golang.org/x/crypto to v0.56.0 [SECURITY] by @​renovate[bot] in #​5462
• Update module golang.org/x/net to v0.60.0 [SECURITY] by @​renovate[bot] in #​5464
• Update module github.com/yuin/goldmark to v1.7.17 [SECURITY] by @​renovate[bot] in #​5460
• github: check App installation grants before listing comments by @​unsmith in #​5454

Full Changelog: trufflesecurity/trufflehog@v3.99.3...v3.99.4

v3.99.3

Compare Source

What's Changed

• Add stdin source documentation by @​kashifkhan0771 in #​5397
• Add syslog source documentation by @​kashifkhan0771 in #​5398
• Add travisci source documentation by @​kashifkhan0771 in #​5401
• Changed GithubOauth2 detector to only rotate on particular error message by @​jordanTunstill in #​5396
• Update dependency golangci/golangci-lint to v2.14.0 by @​renovate[bot] in #​5408
• Update alpine Docker tag to v3.24 by @​renovate[bot] in #​5407
• Update github.com/trufflesecurity/ldap-verify digest to 4964a20 by @​renovate[bot] in #​5406
• Update module github.com/rabbitmq/amqp091-go to v1.14.0 [SECURITY] by @​renovate[bot] in #​5410
• Update github-actions (major) by @​renovate[bot] in #​5409
• Update module github.com/moby/go-archive to v0.3.0 [SECURITY] by @​renovate[bot] in #​5423
• Update module go.opentelemetry.io/otel/sdk to v1.45.0 [SECURITY] by @​renovate[bot] in #​5425
• Update module filippo.io/edwards25519 to v1.1.1 [SECURITY] by @​renovate[bot] in #​5421
• Replace deprecated google.CredentialsFromJSON with CredentialsFromJSONWithType by @​bryanbeverly in #​5428
• Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace to v1.45.0 [SECURITY] by @​renovate[bot] in #​5424
• Update module google.golang.org/grpc to v1.83.1 [SECURITY] by @​renovate[bot] in #​5426
• Fix GitHub comment scans stopping early on large repositories by @​unsmith in #​5405
• fix(github): use a single "app client registry" by @​mariduv in #​5427
• Add SonarQube Server token detector by @​kashifkhan0771 in #​5419
• Add per-logger debug level override for source logging by @​kashifkhan0771 in #​5432
• Update module google.golang.org/grpc to v1.83.2 [SECURITY] by @​renovate[bot] in #​5431
• github: name the missing permission when a comment listing is refused by @​unsmith in #​5438

Full Changelog: trufflesecurity/trufflehog@v3.99.2...v3.99.3

v3.99.2

Compare Source

What's Changed

• Copy over dedupe cache size into the engine from the config by @​camgunz in #​5402

Full Changelog: trufflesecurity/trufflehog@v3.99.1...v3.99.2

v3.99.1

Compare Source

What's Changed

• Update github-actions by @​renovate[bot] in #​5363
• [INT-1084] Make the results deduplication cache size configurable by @​camgunz in #​5399

Full Changelog: trufflesecurity/trufflehog@v3.99.0...v3.99.1

v3.99.0

Compare Source

What's Changed

• Fix Sumo Logic detector ignoring configured verifier endpoints by @​unsmith in #​5395
• Add OAuth2 (ROPC) auth for verification requests by @​unsmith in #​5392

Full Changelog: trufflesecurity/trufflehog@v3.98.1...v3.99.0

v3.98.1

Compare Source

What's Changed

• Add postman source documentation by @​kashifkhan0771 in #​5389
• Add a TruffleHog dectector for Kong Konnect Platform by @​mrwanny in #​5305
• Add api_timeout_seconds to Gerrit source proto by @​kashifkhan0771 in #​5394

New Contributors

• @​mrwanny made their first contribution in #​5305

Full Changelog: trufflesecurity/trufflehog@v3.98.0...v3.98.1

v3.98.0

Compare Source

What's Changed

• Int 595 verify asymmetry by @​shahzadhaider1 in #​5261
• return error body for fetchBearerToken by @​jordanTunstill in #​5301
• Update module github.com/charmbracelet/bubbletea to v1.3.10 by @​renovate[bot] in #​5281
• Update github.com/trufflesecurity/ldap-verify digest to 3142cc9 by @​renovate[bot] in #​5280
• [INT-1086] Don't reuse maps; editing them afterwards edits them for all results by @​camgunz in #​5351
• [INT-1091] Treat Square 403 as verified on INSUFFICIENT_SCOPES by @​MuneebUllahKhan222 in #​5367
• feat: add --no-ignore-tag to report secrets on trufflehog:ignore lines by @​thiswillnevermatch in #​5293
• Fix failing TestGHCRListImages test in CI by @​MuneebUllahKhan222 in #​5368
• Revert duplicate --no-ignore-tag changes from #​5293 by @​shahzadhaider1 in #​5369
• Show progress inside S3 buckets by @​shahzadhaider1 in #​5330
• fix(output): escape special characters in --github-actions output by @​kenanyararbas in #​5353
• fix(detectors): remove stray fmt.Printf in portainertoken by @​Gracy769 in #​5334
• resolve race condition in result deduplication cache by @​kvnphvm in #​5359
• added entropy filter and improved verification for gitlab v2/v3 by @​jordanTunstill in #​5358
• Update Okta domain pat to account for mil and fedramp by @​kvnphvm in #​5355
• Corpora bench reports clean when a detector produces zero matches on both sides by @​kvnphvm in #​5357
• Add huggingface source documentation by @​kashifkhan0771 in #​5373
• Add Gitlab source documentation by @​kashifkhan0771 in #​5371
• Add Github source documentation by @​kashifkhan0771 in #​5370
• fix(detectors/auth0oauth): match Auth0 Private Cloud auth0app.com domains by @​saghaulor in #​5354
• List only the include prefixes in S3 scans by @​shahzadhaider1 in #​5377
• fix(github): switch back to fetching access token through apiClient, by @​mariduv in #​5380
• Fix NetSuite detector running out of memory on dense input by @​shahzadhaider1 in #​5383
• Add Jenkins source documentation by @​kashifkhan0771 in #​5388
• docs: point five internal links at files that exist by @​CalvinTjoaquinn in #​5375
• Add pkg/ssrf shared egress guard; use it for WithNoLocalIP and analyzer clients by @​bill-rich in #​5288

New Contributors

• @​thiswillnevermatch made their first contribution in #​5293
• @​kenanyararbas made their first contribution in #​5353
• @​Gracy769 made their first contribution in #​5334
• @​CalvinTjoaquinn made their first contribution in #​5375

Full Changelog: trufflesecurity/trufflehog@v3.97.9...v3.98.0

v3.97.9

Compare Source

What's Changed

• [SCAN-162] Add Err() to JobProgress and JobProgressRef by @​dipto-truffle in #​5346
• ci: scope Smoke timeouts to trufflehog runs, not the build by @​bryanbeverly in #​5317
• Update module github.com/aymanbagabas/go-osc52 to v1.2.2 by @​renovate[bot] in #​5252
• Update module github.com/gabriel-vasile/mimetype to v1.4.15 by @​renovate[bot] in #​5283
• make 401s for Basic auth verified false. by @​jordanTunstill in #​5290
• [INT-1088] Add version and comment_number lines to SharePoint source metadata by @​camgunz in #​5348
• Int 595 auth errors by @​shahzadhaider1 in #​5259
• Spruce up Makefile a little by @​camgunz in #​5347

Full Changelog: trufflesecurity/trufflehog@v3.97.8...v3.97.9

v3.97.8

Compare Source

What's Changed

• Add Okta OAuth support in Okta detector by @​shreyas-sriram in #​5323
• Add per detector verification timing to verification cache by @​kvnphvm in #​5341
• Set all verification errors in detectors by @​shahzadhaider1 in #​5253

Full Changelog: trufflesecurity/trufflehog@v3.97.7...v3.97.8

v3.97.7

Compare Source

What's Changed

• Recognize a missing Postgres database by SQLSTATE by @​gaborbernat in #​5312
• Improve Github App installation access token caching by @​mariduv in #​5324
• give git the real base..head range for diff scans by @​kvnphvm in #​5325
• Add GCS source documentation by @​kashifkhan0771 in #​5319
• [PERF] Remove \b anchor from escaped-unicode codePointPat by @​Ahsan-Sarbaz in #​5320
• 🐛 fix(engine): map decoded results to source lines by @​gaborbernat in #​5219

New Contributors

• @​gaborbernat made their first contribution in #​5312

Full Changelog: trufflesecurity/trufflehog@v3.97.6...v3.97.7

v3.97.6

Compare Source

What's Changed

• Clarify security policy by @​bradlarsen in #​5295
• Add git source documentation by @​kashifkhan0771 in #​5326
• fix(gitparse): cheaper low-memory git scan, stop losing trailing commits by @​kashifkhan0771 in #​5331
• analyzer/github: include is_fine_grained metadata and make gist enumeration non-fatal by @​unsmith in #​5332

Full Changelog: trufflesecurity/trufflehog@v3.97.5...v3.97.6

v3.97.5

Compare Source

What's Changed

• Update module github.com/rabbitmq/amqp091-go to v1.13.0 [SECURITY] by @​renovate[bot] in #​5274
• Update github-actions by @​renovate[bot] in #​5250
• Update dependency golangci/golangci-lint to v2.13.2 by @​renovate[bot] in #​5251
• Make GitHub App installationId optional when scanning all installations by @​kashifkhan0771 in #​5275
• [INT-942] Add HumioAPIToken detector by @​unsmith in #​5258
• Object filtering in S3 by @​shahzadhaider1 in #​5286
• feat(detectors): add Resend detector by @​mwoss in #​5103
• Clean up use of wasilibs/go-re2 by @​bradlarsen in #​5273
• Low-memory Git Scanning by @​mariduv in #​5257
• Adding no-ignore flag to allow reporting of "ignored" secrets by @​jordanTunstill in #​5297
• Postgres: drop non-connection URI params before verifying by @​jordanTunstill in #​5296
• fix(detectors/ngrok): broaden valid bearer tokens matching by @​mattbrady-1 in #​5152
• ci: avoid Node 20 BuildPulse action by @​dustin-decker in #​5266
• Introduce a new optional detector interface that will allow us to verify credentials not in the cache by @​kvnphvm in #​5298
• perf(engine): lowercase prefilter chunks as ASCII in a pooled buffer by @​kashifkhan0771 in #​5291
• Add documentation for CircleCI source by @​kashifkhan0771 in #​5268
• Add filesystem source documentation by @​kashifkhan0771 in #​5285
• Add elasticsearch source documentation by @​kashifkhan0771 in #​5284
• [SCAN-177] Purge secret parts from verification cache by @​casey-tran in #​5318

New Contributors

• @​mwoss made their first contribution in #​5103
• @​kvnphvm made their first contribution in #​5298

Full Changelog: trufflesecurity/trufflehog@v3.97.4...v3.97.5

v3.97.4

Compare Source

What's Changed

• Make Transport Errors indeterminate for Twilio secrets and twilioapikeys by @​jordanTunstill in #​5267
• Improve the json-enumerator source by @​bradlarsen in #​5265
• added tests for twilio detector fixes by @​jordanTunstill in #​5271

Full Changelog: trufflesecurity/trufflehog@v3.97.3...v3.97.4

v3.97.3

Compare Source

What's Changed

• fix(s3): cut a child context per object so key/size log values don't pile up by @​mariduv in #​5236
• Revert "[INT-933] De-base64 SourceUnit.UnitData in the GitHub Source" by @​trufflesteeeve in #​5269

Full Changelog: trufflesecurity/trufflehog@v3.97.2...v3.97.3

v3.97.2

Compare Source

What's Changed

• detectors/github/v2: differentiate token type in ExtraData by @​hartsock in #​5223
• Update dependency trufflesecurity/.github to v1.0.4 by @​renovate[bot] in #​5228
• ci: let Renovate bump the golangci-lint pin in scripts/lint.sh by @​bryanbeverly in #​5231
• Update github.com/trufflesecurity/ldap-verify digest to aa52b46 by @​renovate[bot] in #​5172
• Update github-actions by @​renovate[bot] in #​5197
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​5173
• Update module github.com/aws/smithy-go to v1.27.9 by @​renovate[bot] in #​5174
• [SCAN-18] Add SOURCE_TYPE_AWS_SECRETS_MANAGER source type by @​dipto-truffle in #​5234
• [INS-377] Add V2 for weights and biases detector by @​mustansir14 in #​4951
• Fix PagerDuty detector: treat 403 and 402 as verified credentials by @​unsmith in #​5230
• [INT-933] De-base64 SourceUnit.UnitData in the GitHub Source by @​camgunz in #​5248
• Implement Enumerate for the Jenkins source by @​Ahsan-Sarbaz in #​5229
• Update link to Truffle Security documentation by @​shahzadhaider1 in #​5256
• Retry git clone on secondary rate limit (bare 403/429) by @​kashifkhan0771 in #​5260

New Contributors

• @​hartsock made their first contribution in #​5223

Full Changelog: trufflesecurity/trufflehog@v3.97.1...v3.97.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.