[dependabot]

Bumps trufflesecurity/trufflehog from 3.97.9 to 3.99.3.

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.99.3

What's Changed

• Add stdin source documentation by @​kashifkhan0771 in trufflesecurity/trufflehog#5397
• Add syslog source documentation by @​kashifkhan0771 in trufflesecurity/trufflehog#5398
• Add travisci source documentation by @​kashifkhan0771 in trufflesecurity/trufflehog#5401
• Changed GithubOauth2 detector to only rotate on particular error message by @​jordanTunstill in trufflesecurity/trufflehog#5396
• Update dependency golangci/golangci-lint to v2.14.0 by @​renovate[bot] in trufflesecurity/trufflehog#5408
• Update alpine Docker tag to v3.24 by @​renovate[bot] in trufflesecurity/trufflehog#5407
• Update github.com/trufflesecurity/ldap-verify digest to 4964a20 by @​renovate[bot] in trufflesecurity/trufflehog#5406
• Update module github.com/rabbitmq/amqp091-go to v1.14.0 [SECURITY] by @​renovate[bot] in trufflesecurity/trufflehog#5410
• Update github-actions (major) by @​renovate[bot] in trufflesecurity/trufflehog#5409
• Update module github.com/moby/go-archive to v0.3.0 [SECURITY] by @​renovate[bot] in trufflesecurity/trufflehog#5423
• Update module go.opentelemetry.io/otel/sdk to v1.45.0 [SECURITY] by @​renovate[bot] in trufflesecurity/trufflehog#5425
• Update module filippo.io/edwards25519 to v1.1.1 [SECURITY] by @​renovate[bot] in trufflesecurity/trufflehog#5421
• Replace deprecated google.CredentialsFromJSON with CredentialsFromJSONWithType by @​bryanbeverly in trufflesecurity/trufflehog#5428
• Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace to v1.45.0 [SECURITY] by @​renovate[bot] in trufflesecurity/trufflehog#5424
• Update module google.golang.org/grpc to v1.83.1 [SECURITY] by @​renovate[bot] in trufflesecurity/trufflehog#5426
• Fix GitHub comment scans stopping early on large repositories by @​unsmith in trufflesecurity/trufflehog#5405
• fix(github): use a single "app client registry" by @​mariduv in trufflesecurity/trufflehog#5427
• Add SonarQube Server token detector by @​kashifkhan0771 in trufflesecurity/trufflehog#5419
• Add per-logger debug level override for source logging by @​kashifkhan0771 in trufflesecurity/trufflehog#5432
• Update module google.golang.org/grpc to v1.83.2 [SECURITY] by @​renovate[bot] in trufflesecurity/trufflehog#5431
• github: name the missing permission when a comment listing is refused by @​unsmith in trufflesecurity/trufflehog#5438

Full Changelog: trufflesecurity/trufflehog@v3.99.2...v3.99.3

v3.99.2

What's Changed

• Copy over dedupe cache size into the engine from the config by @​camgunz in trufflesecurity/trufflehog#5402

Full Changelog: trufflesecurity/trufflehog@v3.99.1...v3.99.2

v3.99.1

What's Changed

• Update github-actions by @​renovate[bot] in trufflesecurity/trufflehog#5363
• [INT-1084] Make the results deduplication cache size configurable by @​camgunz in trufflesecurity/trufflehog#5399

Full Changelog: trufflesecurity/trufflehog@v3.99.0...v3.99.1

v3.99.0

What's Changed

• Fix Sumo Logic detector ignoring configured verifier endpoints by @​unsmith in trufflesecurity/trufflehog#5395
• Add OAuth2 (ROPC) auth for verification requests by @​unsmith in trufflesecurity/trufflehog#5392

Full Changelog: trufflesecurity/trufflehog@v3.98.1...v3.99.0

... (truncated)

Commits

• e63326d github: name the missing permission when a comment listing is refused (#5438)
• 048de9f Update module google.golang.org/grpc to v1.83.2 [SECURITY] (#5431)
• 31d7303 Add per-logger debug level override for source logging (#5432)
• feea7f9 Add SonarQube Server token detector (#5419)
• 27d8ea2 fix(github): use a single "app client registry" to make sure we reuse client ...
• b40e7fe [INT-1051] Fix GitHub comment scans stopping early on large repositories (#5405)
• 9e93a20 Update module google.golang.org/grpc to v1.83.1 [SECURITY] (#5426)
• 4b56723 Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace to v1.45.0 [S...
• 37a6f6e Replace deprecated google.CredentialsFromJSON with CredentialsFromJSONWithTyp...
• 6404b63 Update module filippo.io/edwards25519 to v1.1.1 [SECURITY] (#5421)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ❌ 1 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/secret-scan.yml

Package	Version	License	Issue Type
trufflesecurity/trufflehog	e63326d6545de8f425d93ce24078c6e68d83f70e	AGPL-3.0	Incompatible License

Allowed Licenses:

MIT, ISC, Apache-2.0, BSD-2-Clause, BSD-3-Clause, 0BSD, Unlicense, CC0-1.0, CC-BY-4.0, BlueOak-1.0.0, Python-2.0, MIT-0, Zlib, OFL-1.1

OpenSSF Scorecard

Package	Version	Score	Details
actions/trufflesecurity/trufflehog	e63326d6545de8f425d93ce24078c6e68d83f70e	🟢 7.9	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 9 binaries present in source code Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Signed-Releases 🟢 8 5 out of the last 5 releases have a total of 5 signed artifacts. Packaging 🟢 10 packaging workflow detected SAST 🟢 10 SAST tool is run on all commits

Scanned Files

• .github/workflows/secret-scan.yml

[Musiker15]

@dependabot rebase

[Musiker15]

@dependabot rebase

[Musiker15]

@dependabot recreate

[dependabot]

Looks like this PR has already been merged. If you've moved back to an older version of trufflesecurity/trufflehog a new PR will be created next time Dependabot checks your dependencies.