Repository navigation
build(deps): bump trufflesecurity/trufflehog from 3.97.9 to 3.99.0 - #274
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.97.9 to 3.99.0. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@4dd8831...b2b0a92) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.99.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
clawsweeper
Bot
added
P3
|
Codex review: needs maintainer review before merge. What this changesThis PR updates the TruffleHog GitHub Action pin from v3.97.9 to v3.99.0. Review scores
ProductKind: Maintenance · Worth it: Yes · Fix scope: Complete Merge readiness✅ Ready for maintainer review Keep this PR open: current main still pins v3.97.9, and this is a valid, narrowly scoped action-reference refresh with no actionable defect found. Priority: P3 Before mergeNone. FindingsNone. Agent review detailsHow this fits togetherThe secret-scanning workflow receives push or pull-request commit ranges and invokes TruffleHog to report verified credentials and fail the security gate when found. flowchart LR
A[Push or pull request] --> B[Repository checkout]
B --> C[Resolve commit range]
C --> D[TruffleHog action]
D --> E[Scanner container]
E --> F[Annotations and gate result]
Technical reviewBest possible solution: Land the verified action-reference refresh with the existing scan configuration. Do we have a high-confidence way to reproduce the issue? This PR reports no application bug; source comparison verifies the reference update and unchanged action execution contract. Is this the best way to solve the issue? The one-line reference refresh follows prior maintenance practice, although the unchanged action still selects the latest scanner container rather than pinning scanner v3.99.0. AGENTS.md: found but not applied because it conflicted with ClawSweeper's review contract. Codex review notes: model internal, reasoning medium; reviewed against ee0683bcfda6. Provenance checked
TestingProof path: shipped entry point. SecurityNone. EvidenceWhat I checked:
Likely related people:
LabelsLabel changes: No label changes. Label justifications:
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment HistoryReviewed October 10, 2026, 10:46 PM ET / October 11, 2026, 02:46 UTC (Revision 3). |
Update setup-node to v7.1.0 and TruffleHog to v3.99.0, consolidating #274 and #275 with their existing workflow inputs and Node versions unchanged. Patch transitive gRPC to v1.83.2 for GHSA-2v4p-qf9q-27wj. Preserve the documented Go minimum, Go 1.27.2 toolchain, and existing publication triggers. Add Unreleased entries for both updates. Validated with independent review through P3, make check on Linux (race tests, coverage floor, analyzers, govulncheck, CLI smoke, and unpublished snapshot builds), documentation tests, and exact-head GitHub Actions. Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
|
Thanks! This update landed in #276 together with the other pending action update and the gRPC security patch. The original pin is preserved, with an Unreleased entry and contributor credit. The combined diff passed independent review, the full Linux gate, and exact-head CI: https://github.com/openclaw/discrawl/actions/runs/38127024605. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps trufflesecurity/trufflehog from 3.97.9 to 3.99.0.
Release notes
Sourced from trufflesecurity/trufflehog's releases.
... (truncated)
Commits
b2b0a92Add OAuth2 (ROPC) auth for verification requests (#5392)ab5ee07Fix Sumo Logic detector ignoring configured verifier endpoints (#5395)4c282f5Add api_timeout_seconds to Gerrit source proto (#5394)c95844eAdd a TruffleHog dectector for Kong Konnect Platform (#5305)cc79781Add postman source documentation (#5389)0186870Add pkg/ssrf shared egress guard; use it for WithNoLocalIP and analyzer clien...bb9ed13docs: point five internal links at files that exist (#5375)c56f0b1Add Jenkins source documentation (#5388)2b2c270Fix NetSuite detector running out of memory on dense input (#5383)59e3b04fix(github): switch back to fetching access token through apiClient, (#5380)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)