[dependabot]

Bumps the actions group with 1 update in the / directory: trufflesecurity/trufflehog.

Updates trufflesecurity/trufflehog from 3.97.5 to 3.99.2

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.99.2

What's Changed

• Copy over dedupe cache size into the engine from the config by @​camgunz in trufflesecurity/trufflehog#5402

Full Changelog: trufflesecurity/trufflehog@v3.99.1...v3.99.2

v3.99.1

What's Changed

• Update github-actions by @​renovate[bot] in trufflesecurity/trufflehog#5363
• [INT-1084] Make the results deduplication cache size configurable by @​camgunz in trufflesecurity/trufflehog#5399

Full Changelog: trufflesecurity/trufflehog@v3.99.0...v3.99.1

v3.99.0

What's Changed

• Fix Sumo Logic detector ignoring configured verifier endpoints by @​unsmith in trufflesecurity/trufflehog#5395
• Add OAuth2 (ROPC) auth for verification requests by @​unsmith in trufflesecurity/trufflehog#5392

Full Changelog: trufflesecurity/trufflehog@v3.98.1...v3.99.0

v3.98.1

What's Changed

• Add postman source documentation by @​kashifkhan0771 in trufflesecurity/trufflehog#5389
• Add a TruffleHog dectector for Kong Konnect Platform by @​mrwanny in trufflesecurity/trufflehog#5305
• Add api_timeout_seconds to Gerrit source proto by @​kashifkhan0771 in trufflesecurity/trufflehog#5394

New Contributors

• @​mrwanny made their first contribution in trufflesecurity/trufflehog#5305

Full Changelog: trufflesecurity/trufflehog@v3.98.0...v3.98.1

v3.98.0

What's Changed

• Int 595 verify asymmetry by @​shahzadhaider1 in trufflesecurity/trufflehog#5261
• return error body for fetchBearerToken by @​jordanTunstill in trufflesecurity/trufflehog#5301
• Update module github.com/charmbracelet/bubbletea to v1.3.10 by @​renovate[bot] in trufflesecurity/trufflehog#5281
• Update github.com/trufflesecurity/ldap-verify digest to 3142cc9 by @​renovate[bot] in trufflesecurity/trufflehog#5280
• [INT-1086] Don't reuse maps; editing them afterwards edits them for all results by @​camgunz in trufflesecurity/trufflehog#5351
• [INT-1091] Treat Square 403 as verified on INSUFFICIENT_SCOPES by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#5367
• feat: add --no-ignore-tag to report secrets on trufflehog:ignore lines by @​thiswillnevermatch in trufflesecurity/trufflehog#5293
• Fix failing TestGHCRListImages test in CI by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#5368
• Revert duplicate --no-ignore-tag changes from #5293 by @​shahzadhaider1 in trufflesecurity/trufflehog#5369
• Show progress inside S3 buckets by @​shahzadhaider1 in trufflesecurity/trufflehog#5330
• fix(output): escape special characters in --github-actions output by @​kenanyararbas in trufflesecurity/trufflehog#5353
• fix(detectors): remove stray fmt.Printf in portainertoken by @​Gracy769 in trufflesecurity/trufflehog#5334
• resolve race condition in result deduplication cache by @​kvnphvm in trufflesecurity/trufflehog#5359
• added entropy filter and improved verification for gitlab v2/v3 by @​jordanTunstill in trufflesecurity/trufflehog#5358

... (truncated)

Commits

• e76dff8 Somehow forgot to pull the config value into the engine (#5402)
• 005b692 [INT-1084] Make the results deduplication cache size configurable (#5399)
• f6499ff Update github-actions (#5363)
• b2b0a92 Add OAuth2 (ROPC) auth for verification requests (#5392)
• ab5ee07 Fix Sumo Logic detector ignoring configured verifier endpoints (#5395)
• 4c282f5 Add api_timeout_seconds to Gerrit source proto (#5394)
• c95844e Add a TruffleHog dectector for Kong Konnect Platform (#5305)
• cc79781 Add postman source documentation (#5389)
• 0186870 Add pkg/ssrf shared egress guard; use it for WithNoLocalIP and analyzer clien...
• bb9ed13 docs: point five internal links at files that exist (#5375)
• Additional commits viewable in compare view

[diffsentry]

👀 DiffSentry is reviewing this update... hang tight.

[diffsentry]

📝 Walkthrough

Walkthrough

Updated the pinned TruffleHog GitHub Action from v3.97.5 to v3.99.2 for verified-secret scanning. The workflow continued to use a full commit SHA for immutable action supply-chain pinning.

Changes

Layer / File(s)	Summary
Secret Scan Dependency .github/workflows/secret-scan.yml	Bumped the TruffleHog GitHub Action used by the secret-scanning workflow while preserving immutable SHA pinning and verified-results-only configuration.

Change: Other

Estimated code review effort: 🎯 1 (Trivial) | ⏱️ ~5 minutes

Suggested labels: dependencies, security

Risk factors — 7/100, 🟢 Low

Factor	Weight	Detail
High-risk paths touched	+7	.github/workflows/secret-scan.yml

🏷️ PR title coach

🟡 build(deps): bump trufflesecurity/trufflehog from 3.97.5 to 3.99.2 in the actions group across 1 directory

• Title is 106 characters — keep under 80 for readability in lists and notification subjects.

_{Tip: imperative verb + concrete object, under 80 chars, no trailing period. feat: / fix: prefixes are also fine.}

Suggested reviewers: @mk7luke (owner, owns 1 file(s))

Merge Risk: 🟢 Low · 7/100 · up to 26b58a8

Driven by High-risk paths touched (+7). Full breakdown in the walkthrough.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation
PR Title	⚠️ Warning	The title exceeds the 72-character limit: "build(deps): bump trufflesecurity/trufflehog from 3.97.5 to 3.99.2 in the actions group across 1 directory".

✅ Passed checks (4 passed)

Check name	Status	Explanation
PR Description	✅ Passed	The title and description state what changed: trufflesecurity/trufflehog is bumped from v3.97.5 to v3.99.2 in the GitHub Actions workflow. The reason is dependency maintenance, and the description links the upstream repository, release notes, commits, and compare view.
Schema bump	✅ Passed	Not applicable — the only shown change is the pinned TruffleHog action version in .github/workflows/secret-scan.yml; src/storage/db.ts is not touched.
Provider parity	✅ Passed	Not applicable — this PR only updates the pinned TruffleHog GitHub Action in .github/workflows/secret-scan.yml; it does not touch src/ai/anthropic.ts or any AI provider request/response contract.
Pattern test coverage	✅ Passed	Not applicable — this dependency-update PR only changes .github/workflows/secret-scan.yml and does not add rules to src/safety-scanner.ts or src/pattern-checks.ts.

_{Only error-mode failures turn DiffSentry / Pre-Merge red. Configure checks under reviews.pre_merge_checks in .diffsentry.yaml.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/github_actions/actions-e72aa4717a

📝 Generate docstrings (beta)

• Create stacked PR
• Commit on current branch

🧹 Simplify (beta)

• Create PR with simplified code
• Commit simplified code in branch dependabot/github_actions/actions-e72aa4717a

🪄 Autofix unresolved comments (beta)

• Create stacked PR
• Commit on current branch

---

_{Comment @diffsentry help to get the list of available commands and usage tips.}

[diffsentry]

Actionable comments posted: 0

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: .diffsentry.yaml

Review profile: ASSERTIVE

Run ID: 8d20601d-6197-429c-95b7-268fce29fa53

📥 Commits

Reviewing files at e71a7ae (base SHA unavailable).

📒 Files selected for processing (1)

• .github/workflows/secret-scan.yml

[diffsentry]

📌 Status — last updated 26b58a8

🟢 Approved

Risk score	7/100 (Low) ▁▁
Unresolved threads	0
Failing checks	0
Pending checks	1
Files reviewed	1
Updated	2026-10-13 18:06Z

_{Live-updated by DiffSentry on every push. Use @diffsentry ship for a verdict, @diffsentry timeline for full history.}

[diffsentry]

Release Notes

No user-visible changes. This updates the pinned TruffleHog GitHub Action used by the repository's secret-scanning workflow.

_{Drafted automatically once the review of 59d6143 came back green, every check passed and every review thread was resolved, and rewritten in place on later commits. Re-run by hand with @diffsentry release-notes, or set release_notes.auto: false in .diffsentry.yaml to stop.}

[diffsentry]

Actionable comments posted: 0

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: .diffsentry.yaml

Review profile: ASSERTIVE

Run ID: af1608a6-85cb-4e08-be84-43912f7a8a2b

📥 Commits

Reviewing files that changed from e71a7ae to 26b58a8. Previously-reviewed commits are not re-reviewed.

📒 Files selected for processing (1)

• .github/workflows/secret-scan.yml

[dependabot]

Looks like trufflesecurity/trufflehog is updatable in another way, so this is no longer needed.