chore(deps): update trufflesecurity/trufflehog action to v3.97.4

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
trufflesecurity/trufflehog	action	minor	v3.94.1 → v3.97.4

---

Release Notes

trufflesecurity/trufflehog (trufflesecurity/trufflehog)

v3.97.4

Compare Source

What's Changed

• Make Transport Errors indeterminate for Twilio secrets and twilioapikeys by @​jordanTunstill in #​5267
• Improve the json-enumerator source by @​bradlarsen in #​5265
• added tests for twilio detector fixes by @​jordanTunstill in #​5271

Full Changelog: trufflesecurity/trufflehog@v3.97.3...v3.97.4

v3.97.3

Compare Source

What's Changed

• fix(s3): cut a child context per object so key/size log values don't pile up by @​mariduv in #​5236
• Revert "[INT-933] De-base64 SourceUnit.UnitData in the GitHub Source" by @​trufflesteeeve in #​5269

Full Changelog: trufflesecurity/trufflehog@v3.97.2...v3.97.3

v3.97.2

Compare Source

What's Changed

• detectors/github/v2: differentiate token type in ExtraData by @​hartsock in #​5223
• Update dependency trufflesecurity/.github to v1.0.4 by @​renovate[bot] in #​5228
• ci: let Renovate bump the golangci-lint pin in scripts/lint.sh by @​bryanbeverly in #​5231
• Update github.com/trufflesecurity/ldap-verify digest to aa52b46 by @​renovate[bot] in #​5172
• Update github-actions by @​renovate[bot] in #​5197
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​5173
• Update module github.com/aws/smithy-go to v1.27.9 by @​renovate[bot] in #​5174
• [SCAN-18] Add SOURCE_TYPE_AWS_SECRETS_MANAGER source type by @​dipto-truffle in #​5234
• [INS-377] Add V2 for weights and biases detector by @​mustansir14 in #​4951
• Fix PagerDuty detector: treat 403 and 402 as verified credentials by @​unsmith in #​5230
• [INT-933] De-base64 SourceUnit.UnitData in the GitHub Source by @​camgunz in #​5248
• Implement Enumerate for the Jenkins source by @​Ahsan-Sarbaz in #​5229
• Update link to Truffle Security documentation by @​shahzadhaider1 in #​5256
• Retry git clone on secondary rate limit (bare 403/429) by @​kashifkhan0771 in #​5260

New Contributors

• @​hartsock made their first contribution in #​5223

Full Changelog: trufflesecurity/trufflehog@v3.97.1...v3.97.2

v3.97.1

Compare Source

What's Changed

• Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] by @​renovate[bot] in #​5196
• Fix GHEC with Data Residency (*.ghe.com) base URL by @​shahzadhaider1 in #​4777
• docs: add generic config-secret custom detector example by @​pgmpofu in #​5195
• fix(detectors/docker): don't greedy match in keyPat by @​mariduv in #​5214
• [SCAN-1020] neon scram pgx by @​alafiand in #​5217
• Raised MongoDB detector timeout value by @​jordanTunstill in #​5222
• preallocate bindings capacity in dockerhub and groq, with unit tests by @​jordanTunstill in #​5213
• [SCAN-101] S3 Source accept persisted unit envelopes in UnmarshalSourceUnit by @​amanfcp in #​5224
• Refine SECURITY.md by @​bradlarsen in #​5216
• Carry GitHub App installation ID on repo units by @​bill-rich in #​5215

New Contributors

• @​pgmpofu made their first contribution in #​5195

Full Changelog: trufflesecurity/trufflehog@v3.97.0...v3.97.1

v3.97.0

Compare Source

What's Changed

• fix(detectors/privatekey): report encrypted keys with uncrackable passphrases by @​genisis0x in #​5127
• Update module go.mongodb.org/mongo-driver to v1.17.7 [SECURITY] by @​renovate[bot] in #​5058
• Remove url tag from common HTTP client metrics by @​mcastorina in #​5158
• Update github.com/avast/apkparser digest to 7fcaee4 by @​renovate[bot] in #​5037
• [INS-318] Add New Relic License Key Detector by @​mustansir14 in #​4760
• [INS-348] Add New Relic Browser Key detector by @​mustansir14 in #​4769
• [INS-339] Add New Relic User Key detector by @​mustansir14 in #​4794
• [INS-345] Add New Relic Insights Query Key detector by @​mustansir14 in #​4781
• fix(sources): stop UnitHook Close racing in-flight Finish sends by @​bill-rich in #​5154
• There are now 3 CircleCI projects by @​trufflesteeeve in #​5166
• Update github.com/shurcooL/githubv4 digest to 2402fdf by @​renovate[bot] in #​5038
• Update github-actions by @​renovate[bot] in #​5036
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​4890
• [INS-344] Add New Relic Mobile App Token Detector by @​mustansir14 in #​4810
• Give each clone its own directory under --clone-path by @​shahzadhaider1 in #​5175
• feat(output): add SARIF output format for GitHub code scanning by @​kashifkhan0771 in #​5165
• [SCAN-1018] Treat SlackWebhook invalid_token (HTTP 400) as determinate not-live by @​alafiand in #​5177
• make cwd-changing normalization tests non-parallel to fix flaky clone failures by @​jordanTunstill in #​5178
• [INS-456] Add Microsoft Teams Webhook V2 detector by @​mustansir14 in #​4902
• surface git clone errors at v(0) by @​jordanTunstill in #​5162
• Add Figma Personal Access Token v3 Detector by @​shahzadhaider1 in #​4790
• fix(github): fallback resource Name to avoid empty-string proto validation failure by @​kashifkhan0771 in #​5182
• [INT-643] Update Protos definition to cater bitbucket Api token authentication by @​MuneebUllahKhan222 in #​5171
• Update regex pattern and 403 handling in the Lob detector to fix false positives by @​MachiavelliII in #​5188
• Deprecate AppOptics detector by @​Ahsan-Sarbaz in #​5198
• Anthropic detector: surface API error detail on non-2xx verification by @​Ahsan-Sarbaz in #​5180
• Deprecated bingsubscriptionkey detector by @​Ahsan-Sarbaz in #​5179
• Add SolarWinds Observability detector by @​Ahsan-Sarbaz in #​5199
• fix(jiratoken): stop 202 reverification retry loop by @​Ahsan-Sarbaz in #​5200
• Add custom endpoint support to the S3 source by @​shahzadhaider1 in #​5202
• fix(blogger): anchor regex to AIzaSy prefix to eliminate false positives by @​unsmith in #​5203
• fix(huggingface): move unscoped fine-grained models to UnboundedResources by @​unsmith in #​5204
• Add AWS Secrets Manager metadata type by @​rosecodym in #​5210
• fix(detectors/harness): allow underscore in PAT account segment by @​mattbrady-1 in #​5153

New Contributors

• @​MachiavelliII made their first contribution in #​5188
• @​Ahsan-Sarbaz made their first contribution in #​5198
• @​unsmith made their first contribution in #​5203

Full Changelog: trufflesecurity/trufflehog@v3.96.0...v3.97.0

v3.96.0

Compare Source

What's Changed

• [INS-355] Added Hashicorp vault token detector by @​MuneebUllahKhan222 in #​4819
• Tighten JiraToken v1 verification by @​shahzadhaider1 in #​5122
• [INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @​bill-rich in #​5123
• Fix GitLab project metadata cache and switch to LRU by @​kashifkhan0771 in #​4727
• Log analyze errors for Anthropic Analyzer by @​kashifkhan0771 in #​5120
• Add metrics for chunks and results by @​mcastorina in #​5128
• Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @​kashifkhan0771 in #​5111
• [INS-312] Duo API Secret Key Detector by @​MuneebUllahKhan222 in #​4771
• [Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by @​nabeelalam in #​4739
• [INS-255] Updated datadog detector to set verificationError in case of a verification error by @​MuneebUllahKhan222 in #​4661
• Log analyze errors for Postgres analyzer by @​kashifkhan0771 in #​5131
• Log analyze errors for HuggingFace analyzer by @​kashifkhan0771 in #​5130
• Engine - Config.SourceManager doc by @​amanfcp in #​5002
• Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @​renovate[bot] in #​5034
• Retry git clone on transient network errors by @​shahzadhaider1 in #​5132
• Fix scan_all_installations Rejecting Org Member Personal Repos by @​shahzadhaider1 in #​5142
• updated detector to include underscore char by @​mattbrady-1 in #​5121
• [chore] Change job_id in metric to source_type by @​mcastorina in #​5149
• Posthog regex update by @​mattbrady-1 in #​5133
• fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @​johannestaas-trufflesec in #​5151

New Contributors

• @​mattbrady-1 made their first contribution in #​5121

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

v3.95.9

Compare Source

What's Changed

• feat: add OpenRouter detector by @​McPatate in #​4500
• Integrations fully codeowns detectors by @​trufflesteeeve in #​5104
• [INS-332] Add New Relic Insights Insert key detector by @​mustansir14 in #​4778
• [INS-351] Added Duffel Token Detector by @​MuneebUllahKhan222 in #​4795
• [INS-341] Added Shippo detector by @​MuneebUllahKhan222 in #​4820
• [INS-467] Add IPinfo detector to default detectors list by @​mustansir14 in #​4970
• fix: reject --include-repos/--exclude-repos with --repo in github scan by @​kashifkhan0771 in #​5112
• [INS-468] Add improved lob detector to defaults.go by @​mustansir14 in #​4971
• feat(action): add image input to allow registry mirror overrides by @​eightseventhreethree in #​4965
• feat: Support archived repo exclusion from GH org scans by @​hibare in #​4875
• [INT-715] Retry transient failures when verifying OpenAI keys by @​bill-rich in #​5117
• [INS-410] Added batch token detector by @​MuneebUllahKhan222 in #​4824
• [INT-650] Don't log as error when git diff is too long by @​bill-rich in #​5113

New Contributors

• @​McPatate made their first contribution in #​4500
• @​eightseventhreethree made their first contribution in #​4965

Full Changelog: trufflesecurity/trufflehog@v3.95.8...v3.95.9

v3.95.8

Compare Source

What's Changed

• removed "unauthorized" as exception for rotated graphana secrets by @​jordanTunstill in #​5068
• fix(azuresastoken): match SAS tokens regardless of parameter order by @​genisis0x in #​5043
• Add prometheus metrics for engine channels and workers by @​mcastorina in #​5095
• [INS-465] Skip unverified JWT Detector results when feature flag is enabled by @​MuneebUllahKhan222 in #​5072
• [INS-334] Octopus Deploy detector by @​MuneebUllahKhan222 in #​4787
• Fix Syntax error in feature.go by @​MuneebUllahKhan222 in #​5109
• Include encoded resume info instead of clobbering it by @​bill-rich in #​5110

Full Changelog: trufflesecurity/trufflehog@v3.95.7...v3.95.8

v3.95.7

Compare Source

What's Changed

• fix(sources/filesystem): order resume comparison by path component by @​genisis0x in #​5041
• test(handlers): point APK test fixture at trufflehog-test-assets by @​amanfcp in #​5053
• fixed regex typo that was causing conf uuid's to be surfaced as non-live atlassian secrets. by @​jordanTunstill in #​5029
• Fix GitHub App cross-org member enumeration using per-installation tokens by @​dustin-decker in #​4774
• fix: add git worktree support in PrepareRepo by @​andoniaf in #​4690
• [INS-406] Braintrust detector by @​MuneebUllahKhan222 in #​4826
• huggingface: add bucket scanning by @​julien-c in #​5017
• Skip reverification results during deduplication by @​mcastorina in #​5069
• chore(renovate): bump shared config to v1.0.3 by @​bryanbeverly in #​5044
• Add scan_all_installations option for multi-org GitHub App scanning by @​dustin-decker in #​4775
• Expose SecretParts in the JSON output by @​bradlarsen in #​5073
• [INS-497] Add Pganalyze Read Key Detector by @​MuneebUllahKhan222 in #​4993
• [INS-197] Add redhatpyxis api key detector by @​MuneebUllahKhan222 in #​4995
• [INS-407] Fixed AWS detector producing non deterministic output by @​MuneebUllahKhan222 in #​4836

New Contributors

• @​genisis0x made their first contribution in #​5041
• @​andoniaf made their first contribution in #​4690
• @​julien-c made their first contribution in #​5017

Full Changelog: trufflesecurity/trufflehog@v3.95.6...v3.95.7

v3.95.6

Compare Source

What's Changed

• Enigma detector enhance verification to prevent false verified findings by @​shahzadhaider1 in #​5011
• fix: scan files with lines exceeding bufio's default 64 KB token limit by @​MuneebUllahKhan222 in #​5022
• fix(postgres): honor ignore tags for default port URLs by @​Dawn-Fighter in #​4968
• Move to github.com/moby/moby/client from docker/docker by @​trufflesteeeve in #​4987
• fix: avoid terminal probes before CLI output by @​Hackerchen716 in #​4994
• Update test containers dependency by @​trufflesteeeve in #​4978
• Re-host pkg/handlers JSON test fixtures under the org by @​amanfcp in #​5023
• [INS-465] Add datadogapikey detector to defaults.go by @​mustansir14 in #​4969
• [INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic by @​MuneebUllahKhan222 in #​5006
• [INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic by @​MuneebUllahKhan222 in #​5008
• Updating Klaviyo PK new format by @​breetan in #​5009
• Restructure Klaviyo detector pattern tests by @​martinlocklear in #​5026
• Replace Renovate config with shared preset (high-risk tier) by @​bryanbeverly in #​4992
• set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it by @​jordanTunstill in #​5027
• GitHub finegrained analyzer was improperly handling errors by @​dustin-decker in #​4498
• [INS-469] Added Rev detectors to defaults.go and gated it behind feature flag by @​MuneebUllahKhan222 in #​5005
• Fix Renovate lookup: update setup-captain version comment by @​bryanbeverly in #​4999
• [INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration by @​MuneebUllahKhan222 in #​5007
• Fix: Resolve known dedup issues in notifierWorker by @​MuneebUllahKhan222 in #​5028
• fix(dropbox): prevent long sl.u. tokens from being truncated by @​lukem-ts in #​5012
• fix: add filetype=sdist param to pypi detector by @​lukem-ts in #​4988
• Handlers - Embed small HTTP test fixtures by @​amanfcp in #​5001
• S3: surface bucket listing failures and fix multi-role object count by @​shahzadhaider1 in #​5035

New Contributors

• @​Dawn-Fighter made their first contribution in #​4968
• @​Hackerchen716 made their first contribution in #​4994
• @​breetan made their first contribution in #​5009
• @​lukem-ts made their first contribution in #​5012

Full Changelog: trufflesecurity/trufflehog@v3.95.4...v3.95.6

v3.95.5

Compare Source

What's Changed

• [INS-461] Add test to ensure new detectors are registered in defaults.go by @​mustansir14 in #​4915
• [INS-455] Unify common logic in Atlassian Data Center detectors by @​mustansir14 in #​4907
• fix(github): cache repo info under original URL on redirect by @​kashifkhan0771 in #​4958
• Added GitLab OAuth Detector by @​shahzadhaider1 in #​4729
• Box Detector: Extract Subject ID for Analyzer Integration by @​shahzadhaider1 in #​4761
• [INS-346] SpectralOps Personal API Key Detector by @​MuneebUllahKhan222 in #​4770
• [INS-335] Added AWS Appsync Detector by @​MuneebUllahKhan222 in #​4803
• fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @​kashifkhan0771 in #​4954
• Automate corpora testing in CI by @​mustansir14 in #​4927
• Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @​amanfcp in #​4924
• feat: add host, db and username to ExtraData for database detectors by @​mariocj89 in #​4849
• Remove over speculation from Corpora CI workflow by @​mustansir14 in #​4974
• Fix line numbers for duplicate secrets within a chunk by @​amanfcp in #​4910
• Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @​camgunz in #​4961
• Update Go security dependencies by @​cursor[bot] in #​4986
• Pin GitHub Actions to SHA digests by @​bryanbeverly in #​4985
• Update CODEOWNERS: replace 5 slugs with scanning + integrations by @​bryanbeverly in #​4983
• Added source config flags to sharepoint proto by @​MuneebUllahKhan222 in #​4972
• [SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @​mustansir14 in #​4981
• adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @​johannestaas-trufflesec in #​4991

New Contributors

• @​mariocj89 made their first contribution in #​4849
• @​cursor[bot] made their first contribution in #​4986
• @​johannestaas-trufflesec made their first contribution in #​4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.5

v3.95.4

Compare Source

What's Changed

• [INS-461] Add test to ensure new detectors are registered in defaults.go by @​mustansir14 in #​4915
• [INS-455] Unify common logic in Atlassian Data Center detectors by @​mustansir14 in #​4907
• fix(github): cache repo info under original URL on redirect by @​kashifkhan0771 in #​4958
• Added GitLab OAuth Detector by @​shahzadhaider1 in #​4729
• Box Detector: Extract Subject ID for Analyzer Integration by @​shahzadhaider1 in #​4761
• [INS-346] SpectralOps Personal API Key Detector by @​MuneebUllahKhan222 in #​4770
• [INS-335] Added AWS Appsync Detector by @​MuneebUllahKhan222 in #​4803
• fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @​kashifkhan0771 in #​4954
• Automate corpora testing in CI by @​mustansir14 in #​4927
• Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @​amanfcp in #​4924
• feat: add host, db and username to ExtraData for database detectors by @​mariocj89 in #​4849
• Remove over speculation from Corpora CI workflow by @​mustansir14 in #​4974
• Fix line numbers for duplicate secrets within a chunk by @​amanfcp in #​4910
• Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @​camgunz in #​4961
• Update Go security dependencies by @​cursor[bot] in #​4986
• Pin GitHub Actions to SHA digests by @​bryanbeverly in #​4985
• Update CODEOWNERS: replace 5 slugs with scanning + integrations by @​bryanbeverly in #​4983
• Added source config flags to sharepoint proto by @​MuneebUllahKhan222 in #​4972
• [SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @​mustansir14 in #​4981
• adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @​johannestaas-trufflesec in #​4991

New Contributors

• @​mariocj89 made their first contribution in #​4849
• @​cursor[bot] made their first contribution in #​4986
• @​johannestaas-trufflesec made their first contribution in #​4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.4

v3.95.3

Compare Source

What's Changed

• Renamed AnypointOAuth2 detector's AnalysisInfo keys to make it consistent with its Analyzer by @​MuneebUllahKhan222 in #​4906
• Rename AnalysisInfo field to SecretParts on detectors.Result by @​mcastorina in #​4911
• Document SecretParts contract in detector-authoring docs by @​mcastorina in #​4912
• Add a static check for detectors that don't set SecretParts by @​mcastorina in #​4913
• Populate SecretParts on all detectors by @​mcastorina in #​4919
• Make checksecretparts required in CI by @​mcastorina in #​4921
• Deduplicate concurrent credential verification requests via singleflight by @​kashifkhan0771 in #​4314
• log non-critical chunk errors at V(2).Info instead of Error by @​johnelliott in #​4928
• [INS-320] Cloudinary detector by @​MuneebUllahKhan222 in #​4747
• ci: bump JS actions to Node 24 majors (incl. CodeQL v4 + WIF auth v3) by @​bryanbeverly in #​4933
• chore: bump golangci-lint-action v7 → v9 (Node 24) by @​bryanbeverly in #​4936
• Add default Content-Type: application/json header for custom detector verification request by @​MuneebUllahKhan222 in #​4947
• Make detector Result.SecretParts initialization stricter by @​mcastorina in #​4948
• Add Pinecone API key detector by @​dylanTruffle in #​4917
• adding customizable successRanges and rotatedRanges to customDetector by @​jordanTunstill in #​4892

Full Changelog: trufflesecurity/trufflehog@v3.95.2...v3.95.3

v3.95.2

Compare Source

What's Changed

• Revert "[INS-397] Fix git version parser panic on non-numeric patch versions" by @​trufflesteeeve in #​4903

Full Changelog: trufflesecurity/trufflehog@v3.95.1...v3.95.2

v3.95.1

Compare Source

What's Changed

• [INS-444] Fix verification logic in Mesibo detector by @​mustansir14 in #​4884

Full Changelog: trufflesecurity/trufflehog@v3.95.0...v3.95.1

v3.95.0

Compare Source

What's Changed

• Upgrade golangci-lint in CI runner and Makefile by @​amanfcp in #​4861
• Deprecate SquareUp Detector by @​nabeelalam in #​4855
• [INS-397] Fix git version parser panic on non-numeric patch versions by @​shahzadhaider1 in #​4882
• Fix Bitbucket line highlighting URLs by @​shahzadhaider1 in #​4854
• [INS-403] Support Custom endpoint config in hashicorpvaultauth Detector by @​MuneebUllahKhan222 in #​4825
• [INS-398] Added tests to ensure that custom endpoint configuration works in artifactory detectors by @​MuneebUllahKhan222 in #​4832
• Host ldap-verify library in trufflesecurity by @​trufflesteeeve in #​4859
• Add AnalysisError type and wrap all analyzer error paths by @​johnelliott in #​4779
• dep-updates: Go 1.25 and dependency refreshes by @​dustin-decker in #​4888
• Fix nil pointer panics in GitHub analyzer gist/repo binding functions by @​shahzadhaider1 in #​4864
• [INS-399] Added Bitbucket data center(on prem) PAT detector by @​MuneebUllahKhan222 in #​4883
• [INS-402] Add Jira Data Center PAT Detector by @​mustansir14 in #​4872
• Add man page generation for trufflehog by @​bryanbeverly in #​4894
• Add Confluence Data Center PAT detector by @​amanfcp in #​4886

Full Changelog: trufflesecurity/trufflehog@v3.94.3...v3.95.0

v3.94.3

Compare Source

What's Changed

• Add release bot workflow by @​bryanbeverly in #​4835
• handle AADSTS50173 as explicit revocation signal for azure refresh tokens by @​jordanTunstill in #​4842
• Add AnalysisInfo to verified results by @​hxnyk in #​4862
• Add nil check and error context to GitHub analyzer by @​johnelliott in #​4858
• [CSM-1857] Fix expired Azure secrets being silently dropped by @​dipto-truffle in #​4845
• Add HTML decoder for secret detection in HTML-formatted sources by @​alafiand in #​4840
• Split out detector types into separate proto file in order to narrow CODEOWNERS scope by @​casey-tran in #​4871

New Contributors

• @​johnelliott made their first contribution in #​4858
• @​dipto-truffle made their first contribution in #​4845
• @​alafiand made their first contribution in #​4840

Full Changelog: trufflesecurity/trufflehog@v3.94.2...v3.94.3

v3.94.2

Compare Source

What's Changed

• Skip TestAPKHandler by @​shahzadhaider1 in #​4841
• fix: replace release-guard workflow with revert-latest job by @​sysread in #​4838
• Deprecated GoogleAPIKey Detector by @​nabeelalam in #​4853
• todoist: replac

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🚀 Integration Test Results

npm-pr-version action test:

• ✅ Version generation: 0.0.0-PR-80--b734426
• ✅ package.json update: Successful
• ✅ Format validation: Passed

The action is working correctly! 🎉

[github-actions]

🧪 Test Results

✅ All tests passed successfully!

• Linting: ✅ Passed
• Unit tests: ✅ Passed
• Integration tests: ✅ Passed

[github-actions]

❌ PR package publish failed!

Error: ❌ ERROR: OIDC token not available. Add permissions:

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
trufflesecurity/trufflehog	action	minor	v3.94.1 → v3.97.4

---

Release Notes

trufflesecurity/trufflehog (trufflesecurity/trufflehog)

v3.97.4

Compare Source

What's Changed

• Make Transport Errors indeterminate for Twilio secrets and twilioapikeys by @​jordanTunstill in #​5267
• Improve the json-enumerator source by @​bradlarsen in #​5265
• added tests for twilio detector fixes by @​jordanTunstill in #​5271

Full Changelog: trufflesecurity/trufflehog@v3.97.3...v3.97.4

v3.97.3

Compare Source

What's Changed

• fix(s3): cut a child context per object so key/size log values don't pile up by @​mariduv in #​5236
• Revert "[INT-933] De-base64 SourceUnit.UnitData in the GitHub Source" by @​trufflesteeeve in #​5269

Full Changelog: trufflesecurity/trufflehog@v3.97.2...v3.97.3

v3.97.2

Compare Source

What's Changed

• detectors/github/v2: differentiate token type in ExtraData by @​hartsock in #​5223
• Update dependency trufflesecurity/.github to v1.0.4 by @​renovate[bot] in #​5228
• ci: let Renovate bump the golangci-lint pin in scripts/lint.sh by @​bryanbeverly in #​5231
• Update github.com/trufflesecurity/ldap-verify digest to aa52b46 by @​renovate[bot] in #​5172
• Update github-actions by @​renovate[bot] in #​5197
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​5173
• Update module github.com/aws/smithy-go to v1.27.9 by @​renovate[bot] in #​5174
• [SCAN-18] Add SOURCE_TYPE_AWS_SECRETS_MANAGER source type by @​dipto-truffle in #​5234
• [INS-377] Add V2 for weights and biases detector by @​mustansir14 in #​4951
• Fix PagerDuty detector: treat 403 and 402 as verified credentials by @​unsmith in #​5230
• [INT-933] De-base64 SourceUnit.UnitData in the GitHub Source by @​camgunz in #​5248
• Implement Enumerate for the Jenkins source by @​Ahsan-Sarbaz in #​5229
• Update link to Truffle Security documentation by @​shahzadhaider1 in #​5256
• Retry git clone on secondary rate limit (bare 403/429) by @​kashifkhan0771 in #​5260

New Contributors

• @​hartsock made their first contribution in #​5223

Full Changelog: trufflesecurity/trufflehog@v3.97.1...v3.97.2

v3.97.1

Compare Source

What's Changed

• Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] by @​renovate[bot] in #​5196
• Fix GHEC with Data Residency (*.ghe.com) base URL by @​shahzadhaider1 in #​4777
• docs: add generic config-secret custom detector example by @​pgmpofu in #​5195
• fix(detectors/docker): don't greedy match in keyPat by @​mariduv in #​5214
• [SCAN-1020] neon scram pgx by @​alafiand in #​5217
• Raised MongoDB detector timeout value by @​jordanTunstill in #​5222
• preallocate bindings capacity in dockerhub and groq, with unit tests by @​jordanTunstill in #​5213
• [SCAN-101] S3 Source accept persisted unit envelopes in UnmarshalSourceUnit by @​amanfcp in #​5224
• Refine SECURITY.md by @​bradlarsen in #​5216
• Carry GitHub App installation ID on repo units by @​bill-rich in #​5215

New Contributors

• @​pgmpofu made their first contribution in #​5195

Full Changelog: trufflesecurity/trufflehog@v3.97.0...v3.97.1

v3.97.0

Compare Source

What's Changed

• fix(detectors/privatekey): report encrypted keys with uncrackable passphrases by @​genisis0x in #​5127
• Update module go.mongodb.org/mongo-driver to v1.17.7 [SECURITY] by @​renovate[bot] in #​5058
• Remove url tag from common HTTP client metrics by @​mcastorina in #​5158
• Update github.com/avast/apkparser digest to 7fcaee4 by @​renovate[bot] in #​5037
• [INS-318] Add New Relic License Key Detector by @​mustansir14 in #​4760
• [INS-348] Add New Relic Browser Key detector by @​mustansir14 in #​4769
• [INS-339] Add New Relic User Key detector by @​mustansir14 in #​4794
• [INS-345] Add New Relic Insights Query Key detector by @​mustansir14 in #​4781
• fix(sources): stop UnitHook Close racing in-flight Finish sends by @​bill-rich in #​5154
• There are now 3 CircleCI projects by @​trufflesteeeve in #​5166
• Update github.com/shurcooL/githubv4 digest to 2402fdf by @​renovate[bot] in #​5038
• Update github-actions by @​renovate[bot] in #​5036
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​4890
• [INS-344] Add New Relic Mobile App Token Detector by @​mustansir14 in #​4810
• Give each clone its own directory under --clone-path by @​shahzadhaider1 in #​5175
• feat(output): add SARIF output format for GitHub code scanning by @​kashifkhan0771 in #​5165
• [SCAN-1018] Treat SlackWebhook invalid_token (HTTP 400) as determinate not-live by @​alafiand in #​5177
• make cwd-changing normalization tests non-parallel to fix flaky clone failures by @​jordanTunstill in #​5178
• [INS-456] Add Microsoft Teams Webhook V2 detector by @​mustansir14 in #​4902
• surface git clone errors at v(0) by @​jordanTunstill in #​5162
• Add Figma Personal Access Token v3 Detector by @​shahzadhaider1 in #​4790
• fix(github): fallback resource Name to avoid empty-string proto validation failure by @​kashifkhan0771 in #​5182
• [INT-643] Update Protos definition to cater bitbucket Api token authentication by @​MuneebUllahKhan222 in #​5171
• Update regex pattern and 403 handling in the Lob detector to fix false positives by @​MachiavelliII in #​5188
• Deprecate AppOptics detector by @​Ahsan-Sarbaz in #​5198
• Anthropic detector: surface API error detail on non-2xx verification by @​Ahsan-Sarbaz in #​5180
• Deprecated bingsubscriptionkey detector by @​Ahsan-Sarbaz in #​5179
• Add SolarWinds Observability detector by @​Ahsan-Sarbaz in #​5199
• fix(jiratoken): stop 202 reverification retry loop by @​Ahsan-Sarbaz in #​5200
• Add custom endpoint support to the S3 source by @​shahzadhaider1 in #​5202
• fix(blogger): anchor regex to AIzaSy prefix to eliminate false positives by @​unsmith in #​5203
• fix(huggingface): move unscoped fine-grained models to UnboundedResources by @​unsmith in #​5204
• Add AWS Secrets Manager metadata type by @​rosecodym in #​5210
• fix(detectors/harness): allow underscore in PAT account segment by @​mattbrady-1 in #​5153

New Contributors

• @​MachiavelliII made their first contribution in #​5188
• @​Ahsan-Sarbaz made their first contribution in #​5198
• @​unsmith made their first contribution in #​5203

Full Changelog: trufflesecurity/trufflehog@v3.96.0...v3.97.0

v3.96.0

Compare Source

What's Changed

• [INS-355] Added Hashicorp vault token detector by @​MuneebUllahKhan222 in #​4819
• Tighten JiraToken v1 verification by @​shahzadhaider1 in #​5122
• [INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @​bill-rich in #​5123
• Fix GitLab project metadata cache and switch to LRU by @​kashifkhan0771 in #​4727
• Log analyze errors for Anthropic Analyzer by @​kashifkhan0771 in #​5120
• Add metrics for chunks and results by @​mcastorina in #​5128
• Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @​kashifkhan0771 in #​5111
• [INS-312] Duo API Secret Key Detector by @​MuneebUllahKhan222 in #​4771
• [Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by @​nabeelalam in #​4739
• [INS-255] Updated datadog detector to set verificationError in case of a verification error by @​MuneebUllahKhan222 in #​4661
• Log analyze errors for Postgres analyzer by @​kashifkhan0771 in #​5131
• Log analyze errors for HuggingFace analyzer by @​kashifkhan0771 in #​5130
• Engine - Config.SourceManager doc by @​amanfcp in #​5002
• Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @​renovate[bot] in #​5034
• Retry git clone on transient network errors by @​shahzadhaider1 in #​5132
• Fix scan_all_installations Rejecting Org Member Personal Repos by @​shahzadhaider1 in #​5142
• updated detector to include underscore char by @​mattbrady-1 in #​5121
• [chore] Change job_id in metric to source_type by @​mcastorina in #​5149
• Posthog regex update by @​mattbrady-1 in #​5133
• fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @​johannestaas-trufflesec in #​5151

New Contributors

• @​mattbrady-1 made their first contribution in #​5121

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

v3.95.9

Compare Source

What's Changed

• feat: add OpenRouter detector by @​McPatate in #​4500
• Integrations fully codeowns detectors by @​trufflesteeeve in #​5104
• [INS-332] Add New Relic Insights Insert key detector by @​mustansir14 in #​4778
• [INS-351] Added Duffel Token Detector by @​MuneebUllahKhan222 in #​4795
• [INS-341] Added Shippo detector by @​MuneebUllahKhan222 in #​4820
• [INS-467] Add IPinfo detector to default detectors list by @​mustansir14 in #​4970
• fix: reject --include-repos/--exclude-repos with --repo in github scan by @​kashifkhan0771 in #​5112
• [INS-468] Add improved lob detector to defaults.go by @​mustansir14 in #​4971
• feat(action): add image input to allow registry mirror overrides by @​eightseventhreethree in #​4965
• feat: Support archived repo exclusion from GH org scans by @​hibare in #​4875
• [INT-715] Retry transient failures when verifying OpenAI keys by @​bill-rich in #​5117
• [INS-410] Added batch token detector by @​MuneebUllahKhan222 in #​4824
• [INT-650] Don't log as error when git diff is too long by @​bill-rich in #​5113

New Contributors

• @​McPatate made their first contribution in #​4500
• @​eightseventhreethree made their first contribution in #​4965

Full Changelog: trufflesecurity/trufflehog@v3.95.8...v3.95.9

v3.95.8

Compare Source

What's Changed

• removed "unauthorized" as exception for rotated graphana secrets by @​jordanTunstill in #​5068
• fix(azuresastoken): match SAS tokens regardless of parameter order by @​genisis0x in #​5043
• Add prometheus metrics for engine channels and workers by @​mcastorina in #​5095
• [INS-465] Skip unverified JWT Detector results when feature flag is enabled by @​MuneebUllahKhan222 in #​5072
• [INS-334] Octopus Deploy detector by @​MuneebUllahKhan222 in #​4787
• Fix Syntax error in feature.go by @​MuneebUllahKhan222 in #​5109
• Include encoded resume info instead of clobbering it by @​bill-rich in #​5110

Full Changelog: trufflesecurity/trufflehog@v3.95.7...v3.95.8

v3.95.7

Compare Source

What's Changed

• fix(sources/filesystem): order resume comparison by path component by @​genisis0x in #​5041
• test(handlers): point APK test fixture at trufflehog-test-assets by @​amanfcp in #​5053
• fixed regex typo that was causing conf uuid's to be surfaced as non-live atlassian secrets. by @​jordanTunstill in #​5029
• Fix GitHub App cross-org member enumeration using per-installation tokens by @​dustin-decker in #​4774
• fix: add git worktree support in PrepareRepo by @​andoniaf in #​4690
• [INS-406] Braintrust detector by @​MuneebUllahKhan222 in #​4826
• huggingface: add bucket scanning by @​julien-c in #​5017
• Skip reverification results during deduplication by @​mcastorina in #​5069
• chore(renovate): bump shared config to v1.0.3 by @​bryanbeverly in #​5044
• Add scan_all_installations option for multi-org GitHub App scanning by @​dustin-decker in #​4775
• Expose SecretParts in the JSON output by @​bradlarsen in #​5073
• [INS-497] Add Pganalyze Read Key Detector by @​MuneebUllahKhan222 in #​4993
• [INS-197] Add redhatpyxis api key detector by @​MuneebUllahKhan222 in #​4995
• [INS-407] Fixed AWS detector producing non deterministic output by @​MuneebUllahKhan222 in #​4836

New Contributors

• @​genisis0x made their first contribution in #​5041
• @​andoniaf made their first contribution in #​4690
• @​julien-c made their first contribution in #​5017

Full Changelog: trufflesecurity/trufflehog@v3.95.6...v3.95.7

v3.95.6

Compare Source

What's Changed

• Enigma detector enhance verification to prevent false verified findings by @​shahzadhaider1 in #​5011
• fix: scan files with lines exceeding bufio's default 64 KB token limit by @​MuneebUllahKhan222 in #​5022
• fix(postgres): honor ignore tags for default port URLs by @​Dawn-Fighter in #​4968
• Move to github.com/moby/moby/client from docker/docker by @​trufflesteeeve in #​4987
• fix: avoid terminal probes before CLI output by @​Hackerchen716 in #​4994
• Update test containers dependency by @​trufflesteeeve in #​4978
• Re-host pkg/handlers JSON test fixtures under the org by @​amanfcp in #​5023
• [INS-465] Add datadogapikey detector to defaults.go by @​mustansir14 in #​4969
• [INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic by @​MuneebUllahKhan222 in #​5006
• [INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic by @​MuneebUllahKhan222 in #​5008
• Updating Klaviyo PK new format by @​breetan in #​5009
• Restructure Klaviyo detector pattern tests by @​martinlocklear in #​5026
• Replace Renovate config with shared preset (high-risk tier) by @​bryanbeverly in #​4992
• set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it by @​jordanTunstill in #​5027
• GitHub finegrained analyzer was improperly handling errors by @​dustin-decker in #​4498
• [INS-469] Added Rev detectors to defaults.go and gated it behind feature flag by @​MuneebUllahKhan222 in #​5005
• Fix Renovate lookup: update setup-captain version comment by @​bryanbeverly in #​4999
• [INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration by @​MuneebUllahKhan222 in #​5007
• Fix: Resolve known dedup issues in notifierWorker by @​MuneebUllahKhan222 in #​5028
• fix(dropbox): prevent long sl.u. tokens from being truncated by @​lukem-ts in #​5012
• fix: add filetype=sdist param to pypi detector by @​lukem-ts in #​4988
• Handlers - Embed small HTTP test fixtures by @​amanfcp in #​5001
• S3: surface bucket listing failures and fix multi-role object count by @​shahzadhaider1 in #​5035

New Contributors

• @​Dawn-Fighter made their first contribution in #​4968
• @​Hackerchen716 made their first contribution in #​4994
• @​breetan made their first contribution in #​5009
• @​lukem-ts made their first contribution in #​5012

Full Changelog: trufflesecurity/trufflehog@v3.95.4...v3.95.6

v3.95.5

Compare Source

What's Changed

• [INS-461] Add test to ensure new detectors are registered in defaults.go by @​mustansir14 in #​4915
• [INS-455] Unify common logic in Atlassian Data Center detectors by @​mustansir14 in #​4907
• fix(github): cache repo info under original URL on redirect by @​kashifkhan0771 in #​4958
• Added GitLab OAuth Detector by @​shahzadhaider1 in #​4729
• Box Detector: Extract Subject ID for Analyzer Integration by @​shahzadhaider1 in #​4761
• [INS-346] SpectralOps Personal API Key Detector by @​MuneebUllahKhan222 in #​4770
• [INS-335] Added AWS Appsync Detector by @​MuneebUllahKhan222 in #​4803
• fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @​kashifkhan0771 in #​4954
• Automate corpora testing in CI by @​mustansir14 in #​4927
• Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @​amanfcp in #​4924
• feat: add host, db and username to ExtraData for database detectors by @​mariocj89 in #​4849
• Remove over speculation from Corpora CI workflow by @​mustansir14 in #​4974
• Fix line numbers for duplicate secrets within a chunk by @​amanfcp in #​4910
• Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @​camgunz in #​4961
• Update Go security dependencies by @​cursor[bot] in #​4986
• Pin GitHub Actions to SHA digests by @​bryanbeverly in #​4985
• Update CODEOWNERS: replace 5 slugs with scanning + integrations by @​bryanbeverly in #​4983
• Added source config flags to sharepoint proto by @​MuneebUllahKhan222 in #​4972
• [SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @​mustansir14 in #​4981
• adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @​johannestaas-trufflesec in #​4991

New Contributors

• @​mariocj89 made their first contribution in #​4849
• @​cursor[bot] made their first contribution in #​4986
• @​johannestaas-trufflesec made their first contribution in #​4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.5

v3.95.4

Compare Source

What's Changed

• [INS-461] Add test to ensure new detectors are registered in defaults.go by @​mustansir14 in #​4915
• [INS-455] Unify common logic in Atlassian Data Center detectors by @​mustansir14 in #​4907
• fix(github): cache repo info under original URL on redirect by @​kashifkhan0771 in #​4958
• Added GitLab OAuth Detector by @​shahzadhaider1 in #​4729
• Box Detector: Extract Subject ID for Analyzer Integration by @​shahzadhaider1 in #​4761
• [INS-346] SpectralOps Personal API Key Detector by @​MuneebUllahKhan222 in #​4770
• [INS-335] Added AWS Appsync Detector by @​MuneebUllahKhan222 in #​4803
• fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @​kashifkhan0771 in #​4954
• Automate corpora testing in CI by @​mustansir14 in #​4927
• Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @​amanfcp in #​4924
• feat: add host, db and username to ExtraData for database detectors by @​mariocj89 in #​4849
• Remove over speculation from Corpora CI workflow by @​mustansir14 in #​4974
• Fix line numbers for duplicate secrets within a chunk by @​amanfcp in #​4910
• Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @​camgunz in #​4961
• Update Go security dependencies by @​cursor[bot] in #​4986
• Pin GitHub Actions to SHA digests by @​bryanbeverly in #​4985
• Update CODEOWNERS: replace 5 slugs with scanning + integrations by @​bryanbeverly in #​4983
• Added source config flags to sharepoint proto by @​MuneebUllahKhan222 in #​4972
• [SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @​mustansir14 in #​4981
• adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @​johannestaas-trufflesec in #​4991

New Contributors

• @​mariocj89 made their first contribution in #​4849
• @​cursor[bot] made their first contribution in #​4986
• @​johannestaas-trufflesec made their first contribution in #​4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.4

v3.95.3

Compare Source

What's Changed

• Renamed AnypointOAuth2 detector's AnalysisInfo keys to make it consistent with its Analyzer by @​MuneebUllahKhan222 in #​4906
• Rename AnalysisInfo field to SecretParts on detectors.Result by @​mcastorina in #​4911
• Document SecretParts contract in detector-authoring docs by @​mcastorina in #​4912
• Add a static check for detectors that don't set SecretParts by @​mcastorina in #​4913
• Populate SecretParts on all detectors by @​mcastorina in #​4919
• Make checksecretparts required in CI by @​mcastorina in #​4921
• Deduplicate concurrent credential verification requests via singleflight by @​kashifkhan0771 in #​4314
• log non-critical chunk errors at V(2).Info instead of Error by @​johnelliott in #​4928
• [INS-320] Cloudinary detector by @​MuneebUllahKhan222 in #​4747
• ci: bump JS actions to Node 24 majors (incl. CodeQL v4 + WIF auth v3) by @​bryanbeverly in #​4933
• chore: bump golangci-lint-action v7 → v9 (Node 24) by @​bryanbeverly in #​4936
• Add default Content-Type: application/json header for custom detector verification request by @​MuneebUllahKhan222 in #​4947
• Make detector Result.SecretParts initialization stricter by @​mcastorina in #​4948
• Add Pinecone API key detector by @​dylanTruffle in #​4917
• adding customizable successRanges and rotatedRanges to customDetector by @​jordanTunstill in #​4892

Full Changelog: trufflesecurity/trufflehog@v3.95.2...v3.95.3

v3.95.2

Compare Source

What's Changed

• Revert "[INS-397] Fix git version parser panic on non-numeric patch versions" by @​trufflesteeeve in #​4903

Full Changelog: trufflesecurity/trufflehog@v3.95.1...v3.95.2

v3.95.1

Compare Source

What's Changed

• [INS-444] Fix verification logic in Mesibo detector by @​mustansir14 in #​4884

Full Changelog: trufflesecurity/trufflehog@v3.95.0...v3.95.1

v3.95.0

Compare Source

What's Changed

• Upgrade golangci-lint in CI runner and Makefile by @​amanfcp in #​4861
• Deprecate SquareUp Detector by @​nabeelalam in #​4855
• [INS-397] Fix git version parser panic on non-numeric patch versions by @​shahzadhaider1 in #​4882
• Fix Bitbucket line highlighting URLs by @​shahzadhaider1 in #​4854
• [INS-403] Support Custom endpoint config in hashicorpvaultauth Detector by @​MuneebUllahKhan222 in #​4825
• [INS-398] Added tests to ensure that custom endpoint configuration works in artifactory detectors by @​MuneebUllahKhan222 in #​4832
• Host ldap-verify library in trufflesecurity by @​trufflesteeeve in #​4859
• Add AnalysisError type and wrap all analyzer error paths by @​johnelliott in #​4779
• dep-updates: Go 1.25 and dependency refreshes by @​dustin-decker in #​4888
• Fix nil pointer panics in GitHub analyzer gist/repo binding functions by @​shahzadhaider1 in #​4864
• [INS-399] Added Bitbucket data center(on prem) PAT detector by @​MuneebUllahKhan222 in #​4883
• [INS-402] Add Jira Data Center PAT Detector by @​mustansir14 in #​4872
• Add man page generation for trufflehog by @​bryanbeverly in #​4894
• Add Confluence Data Center PAT detector by @​amanfcp in #​4886

Full Changelog: trufflesecurity/trufflehog@v3.94.3...v3.95.0

v3.94.3

Compare Source

What's Changed

• Add release bot workflow by @​bryanbeverly in #​4835
• handle AADSTS50173 as explicit revocation signal for azure refresh tokens by @​jordanTunstill in #​4842
• Add AnalysisInfo to verified results by @​hxnyk in #​4862
• Add nil check and error context to GitHub analyzer by @​johnelliott in #​4858
• [CSM-1857] Fix expired Azure secrets being silently dropped by @​dipto-truffle in #​4845
• Add HTML decoder for secret detection in HTML-formatted sources by @​alafiand in #​4840
• Split out detector types into separate proto file in order to narrow CODEOWNERS scope by @​casey-tran in #​4871

New Contributors

• @​johnelliott made their first contribution in #​4858
• @​dipto-truffle made their first contribution in #​4845
• @​alafiand made their first contribution in #​4840

Full Changelog: trufflesecurity/trufflehog@v3.94.2...v3.94.3

v3.94.2

Compare Source

What's Changed

• Skip TestAPKHandler by @​shahzadhaider1 in #​4841
• fix: replace release-guard workflow with revert-latest job by @​sysread in #​4838
• Deprecated GoogleAPIKey Detector by @​nabeelalam in #​4853
• todoist: replac

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🚀 Integration Test Results

npm-pr-version action test:

• ✅ Version generation: 0.0.0-PR-80--b734426
• ✅ package.json update: Successful
• ✅ Format validation: Passed

The action is working correctly! 🎉

[github-actions]

🧪 Test Results

✅ All tests passed successfully!

• Linting: ✅ Passed
• Unit tests: ✅ Passed
• Integration tests: ✅ Passed

[github-actions]

❌ PR package publish failed!

Error: ❌ ERROR: OIDC token not available. Add permissions:

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
trufflesecurity/trufflehog	action	minor	v3.94.1 → v3.97.4

---

Release Notes

trufflesecurity/trufflehog (trufflesecurity/trufflehog)

v3.97.4

Compare Source

What's Changed

• Make Transport Errors indeterminate for Twilio secrets and twilioapikeys by @​jordanTunstill in #​5267
• Improve the json-enumerator source by @​bradlarsen in #​5265
• added tests for twilio detector fixes by @​jordanTunstill in #​5271

Full Changelog: trufflesecurity/trufflehog@v3.97.3...v3.97.4

v3.97.3

Compare Source

What's Changed

• fix(s3): cut a child context per object so key/size log values don't pile up by @​mariduv in #​5236
• Revert "[INT-933] De-base64 SourceUnit.UnitData in the GitHub Source" by @​trufflesteeeve in #​5269

Full Changelog: trufflesecurity/trufflehog@v3.97.2...v3.97.3

v3.97.2

Compare Source

What's Changed

• detectors/github/v2: differentiate token type in ExtraData by @​hartsock in #​5223
• Update dependency trufflesecurity/.github to v1.0.4 by @​renovate[bot] in #​5228
• ci: let Renovate bump the golangci-lint pin in scripts/lint.sh by @​bryanbeverly in #​5231
• Update github.com/trufflesecurity/ldap-verify digest to aa52b46 by @​renovate[bot] in #​5172
• Update github-actions by @​renovate[bot] in #​5197
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​5173
• Update module github.com/aws/smithy-go to v1.27.9 by @​renovate[bot] in #​5174
• [SCAN-18] Add SOURCE_TYPE_AWS_SECRETS_MANAGER source type by @​dipto-truffle in #​5234
• [INS-377] Add V2 for weights and biases detector by @​mustansir14 in #​4951
• Fix PagerDuty detector: treat 403 and 402 as verified credentials by @​unsmith in #​5230
• [INT-933] De-base64 SourceUnit.UnitData in the GitHub Source by @​camgunz in #​5248
• Implement Enumerate for the Jenkins source by @​Ahsan-Sarbaz in #​5229
• Update link to Truffle Security documentation by @​shahzadhaider1 in #​5256
• Retry git clone on secondary rate limit (bare 403/429) by @​kashifkhan0771 in #​5260

New Contributors

• @​hartsock made their first contribution in #​5223

Full Changelog: trufflesecurity/trufflehog@v3.97.1...v3.97.2

v3.97.1

Compare Source

What's Changed

• Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] by @​renovate[bot] in #​5196
• Fix GHEC with Data Residency (*.ghe.com) base URL by @​shahzadhaider1 in #​4777
• docs: add generic config-secret custom detector example by @​pgmpofu in #​5195
• fix(detectors/docker): don't greedy match in keyPat by @​mariduv in #​5214
• [SCAN-1020] neon scram pgx by @​alafiand in #​5217
• Raised MongoDB detector timeout value by @​jordanTunstill in #​5222
• preallocate bindings capacity in dockerhub and groq, with unit tests by @​jordanTunstill in #​5213
• [SCAN-101] S3 Source accept persisted unit envelopes in UnmarshalSourceUnit by @​amanfcp in #​5224
• Refine SECURITY.md by @​bradlarsen in #​5216
• Carry GitHub App installation ID on repo units by @​bill-rich in #​5215

New Contributors

• @​pgmpofu made their first contribution in #​5195

Full Changelog: trufflesecurity/trufflehog@v3.97.0...v3.97.1

v3.97.0

Compare Source

What's Changed

• fix(detectors/privatekey): report encrypted keys with uncrackable passphrases by @​genisis0x in #​5127
• Update module go.mongodb.org/mongo-driver to v1.17.7 [SECURITY] by @​renovate[bot] in #​5058
• Remove url tag from common HTTP client metrics by @​mcastorina in #​5158
• Update github.com/avast/apkparser digest to 7fcaee4 by @​renovate[bot] in #​5037
• [INS-318] Add New Relic License Key Detector by @​mustansir14 in #​4760
• [INS-348] Add New Relic Browser Key detector by @​mustansir14 in #​4769
• [INS-339] Add New Relic User Key detector by @​mustansir14 in #​4794
• [INS-345] Add New Relic Insights Query Key detector by @​mustansir14 in #​4781
• fix(sources): stop UnitHook Close racing in-flight Finish sends by @​bill-rich in #​5154
• There are now 3 CircleCI projects by @​trufflesteeeve in #​5166
• Update github.com/shurcooL/githubv4 digest to 2402fdf by @​renovate[bot] in #​5038
• Update github-actions by @​renovate[bot] in #​5036
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​4890
• [INS-344] Add New Relic Mobile App Token Detector by @​mustansir14 in #​4810
• Give each clone its own directory under --clone-path by @​shahzadhaider1 in #​5175
• feat(output): add SARIF output format for GitHub code scanning by @​kashifkhan0771 in #​5165
• [SCAN-1018] Treat SlackWebhook invalid_token (HTTP 400) as determinate not-live by @​alafiand in #​5177
• make cwd-changing normalization tests non-parallel to fix flaky clone failures by @​jordanTunstill in #​5178
• [INS-456] Add Microsoft Teams Webhook V2 detector by @​mustansir14 in #​4902
• surface git clone errors at v(0) by @​jordanTunstill in #​5162
• Add Figma Personal Access Token v3 Detector by @​shahzadhaider1 in #​4790
• fix(github): fallback resource Name to avoid empty-string proto validation failure by @​kashifkhan0771 in #​5182
• [INT-643] Update Protos definition to cater bitbucket Api token authentication by @​MuneebUllahKhan222 in #​5171
• Update regex pattern and 403 handling in the Lob detector to fix false positives by @​MachiavelliII in #​5188
• Deprecate AppOptics detector by @​Ahsan-Sarbaz in #​5198
• Anthropic detector: surface API error detail on non-2xx verification by @​Ahsan-Sarbaz in #​5180
• Deprecated bingsubscriptionkey detector by @​Ahsan-Sarbaz in #​5179
• Add SolarWinds Observability detector by @​Ahsan-Sarbaz in #​5199
• fix(jiratoken): stop 202 reverification retry loop by @​Ahsan-Sarbaz in #​5200
• Add custom endpoint support to the S3 source by @​shahzadhaider1 in #​5202
• fix(blogger): anchor regex to AIzaSy prefix to eliminate false positives by @​unsmith in #​5203
• fix(huggingface): move unscoped fine-grained models to UnboundedResources by @​unsmith in #​5204
• Add AWS Secrets Manager metadata type by @​rosecodym in #​5210
• fix(detectors/harness): allow underscore in PAT account segment by @​mattbrady-1 in #​5153

New Contributors

• @​MachiavelliII made their first contribution in #​5188
• @​Ahsan-Sarbaz made their first contribution in #​5198
• @​unsmith made their first contribution in #​5203

Full Changelog: trufflesecurity/trufflehog@v3.96.0...v3.97.0

v3.96.0

Compare Source

What's Changed

• [INS-355] Added Hashicorp vault token detector by @​MuneebUllahKhan222 in #​4819
• Tighten JiraToken v1 verification by @​shahzadhaider1 in #​5122
• [INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @​bill-rich in #​5123
• Fix GitLab project metadata cache and switch to LRU by @​kashifkhan0771 in #​4727
• Log analyze errors for Anthropic Analyzer by @​kashifkhan0771 in #​5120
• Add metrics for chunks and results by @​mcastorina in #​5128
• Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @​kashifkhan0771 in #​5111
• [INS-312] Duo API Secret Key Detector by @​MuneebUllahKhan222 in #​4771
• [Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by @​nabeelalam in #​4739
• [INS-255] Updated datadog detector to set verificationError in case of a verification error by @​MuneebUllahKhan222 in #​4661
• Log analyze errors for Postgres analyzer by @​kashifkhan0771 in #​5131
• Log analyze errors for HuggingFace analyzer by @​kashifkhan0771 in #​5130
• Engine - Config.SourceManager doc by @​amanfcp in #​5002
• Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @​renovate[bot] in #​5034
• Retry git clone on transient network errors by @​shahzadhaider1 in #​5132
• Fix scan_all_installations Rejecting Org Member Personal Repos by @​shahzadhaider1 in #​5142
• updated detector to include underscore char by @​mattbrady-1 in #​5121
• [chore] Change job_id in metric to source_type by @​mcastorina in #​5149
• Posthog regex update by @​mattbrady-1 in #​5133
• fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @​johannestaas-trufflesec in #​5151

New Contributors

• @​mattbrady-1 made their first contribution in #​5121

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

v3.95.9

Compare Source

What's Changed

• feat: add OpenRouter detector by @​McPatate in #​4500
• Integrations fully codeowns detectors by @​trufflesteeeve in #​5104
• [INS-332] Add New Relic Insights Insert key detector by @​mustansir14 in #​4778
• [INS-351] Added Duffel Token Detector by @​MuneebUllahKhan222 in #​4795
• [INS-341] Added Shippo detector by @​MuneebUllahKhan222 in #​4820
• [INS-467] Add IPinfo detector to default detectors list by @​mustansir14 in #​4970
• fix: reject --include-repos/--exclude-repos with --repo in github scan by @​kashifkhan0771 in #​5112
• [INS-468] Add improved lob detector to defaults.go by @​mustansir14 in #​4971
• feat(action): add image input to allow registry mirror overrides by @​eightseventhreethree in #​4965
• feat: Support archived repo exclusion from GH org scans by @​hibare in #​4875
• [INT-715] Retry transient failures when verifying OpenAI keys by @​bill-rich in #​5117
• [INS-410] Added batch token detector by @​MuneebUllahKhan222 in #​4824
• [INT-650] Don't log as error when git diff is too long by @​bill-rich in #​5113

New Contributors

• @​McPatate made their first contribution in #​4500
• @​eightseventhreethree made their first contribution in #​4965

Full Changelog: trufflesecurity/trufflehog@v3.95.8...v3.95.9

v3.95.8

Compare Source

What's Changed

• removed "unauthorized" as exception for rotated graphana secrets by @​jordanTunstill in #​5068
• fix(azuresastoken): match SAS tokens regardless of parameter order by @​genisis0x in #​5043
• Add prometheus metrics for engine channels and workers by @​mcastorina in #​5095
• [INS-465] Skip unverified JWT Detector results when feature flag is enabled by @​MuneebUllahKhan222 in #​5072
• [INS-334] Octopus Deploy detector by @​MuneebUllahKhan222 in #​4787
• Fix Syntax error in feature.go by @​MuneebUllahKhan222 in #​5109
• Include encoded resume info instead of clobbering it by @​bill-rich in #​5110

Full Changelog: trufflesecurity/trufflehog@v3.95.7...v3.95.8

v3.95.7

Compare Source

What's Changed

• fix(sources/filesystem): order resume comparison by path component by @​genisis0x in #​5041
• test(handlers): point APK test fixture at trufflehog-test-assets by @​amanfcp in #​5053
• fixed regex typo that was causing conf uuid's to be surfaced as non-live atlassian secrets. by @​jordanTunstill in #​5029
• Fix GitHub App cross-org member enumeration using per-installation tokens by @​dustin-decker in #​4774
• fix: add git worktree support in PrepareRepo by @​andoniaf in #​4690
• [INS-406] Braintrust detector by @​MuneebUllahKhan222 in #​4826
• huggingface: add bucket scanning by @​julien-c in #​5017
• Skip reverification results during deduplication by @​mcastorina in #​5069
• chore(renovate): bump shared config to v1.0.3 by @​bryanbeverly in #​5044
• Add scan_all_installations option for multi-org GitHub App scanning by @​dustin-decker in #​4775
• Expose SecretParts in the JSON output by @​bradlarsen in #​5073
• [INS-497] Add Pganalyze Read Key Detector by @​MuneebUllahKhan222 in #​4993
• [INS-197] Add redhatpyxis api key detector by @​MuneebUllahKhan222 in #​4995
• [INS-407] Fixed AWS detector producing non deterministic output by @​MuneebUllahKhan222 in #​4836

New Contributors

• @​genisis0x made their first contribution in #​5041
• @​andoniaf made their first contribution in #​4690
• @​julien-c made their first contribution in #​5017

Full Changelog: trufflesecurity/trufflehog@v3.95.6...v3.95.7

v3.95.6

Compare Source

What's Changed

• Enigma detector enhance verification to prevent false verified findings by @​shahzadhaider1 in #​5011
• fix: scan files with lines exceeding bufio's default 64 KB token limit by @​MuneebUllahKhan222 in #​5022
• fix(postgres): honor ignore tags for default port URLs by @​Dawn-Fighter in #​4968
• Move to github.com/moby/moby/client from docker/docker by @​trufflesteeeve in #​4987
• fix: avoid terminal probes before CLI output by @​Hackerchen716 in #​4994
• Update test containers dependency by @​trufflesteeeve in #​4978
• Re-host pkg/handlers JSON test fixtures under the org by @​amanfcp in #​5023
• [INS-465] Add datadogapikey detector to defaults.go by @​mustansir14 in #​4969
• [INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic by @​MuneebUllahKhan222 in #​5006
• [INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic by @​MuneebUllahKhan222 in #​5008
• Updating Klaviyo PK new format by @​breetan in #​5009
• Restructure Klaviyo detector pattern tests by @​martinlocklear in #​5026
• Replace Renovate config with shared preset (high-risk tier) by @​bryanbeverly in #​4992
• set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it by @​jordanTunstill in #​5027
• GitHub finegrained analyzer was improperly handling errors by @​dustin-decker in #​4498
• [INS-469] Added Rev detectors to defaults.go and gated it behind feature flag by @​MuneebUllahKhan222 in #​5005
• Fix Renovate lookup: update setup-captain version comment by @​bryanbeverly in #​4999
• [INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration by @​MuneebUllahKhan222 in #​5007
• Fix: Resolve known dedup issues in notifierWorker by @​MuneebUllahKhan222 in #​5028
• fix(dropbox): prevent long sl.u. tokens from being truncated by @​lukem-ts in #​5012
• fix: add filetype=sdist param to pypi detector by @​lukem-ts in #​4988
• Handlers - Embed small HTTP test fixtures by @​amanfcp in #​5001
• S3: surface bucket listing failures and fix multi-role object count by @​shahzadhaider1 in #​5035

New Contributors

• @​Dawn-Fighter made their first contribution in #​4968
• @​Hackerchen716 made their first contribution in #​4994
• @​breetan made their first contribution in #​5009
• @​lukem-ts made their first contribution in #​5012

Full Changelog: trufflesecurity/trufflehog@v3.95.4...v3.95.6

v3.95.5

Compare Source

What's Changed

• [INS-461] Add test to ensure new detectors are registered in defaults.go by @​mustansir14 in #​4915
• [INS-455] Unify common logic in Atlassian Data Center detectors by @​mustansir14 in #​4907
• fix(github): cache repo info under original URL on redirect by @​kashifkhan0771 in #​4958
• Added GitLab OAuth Detector by @​shahzadhaider1 in #​4729
• Box Detector: Extract Subject ID for Analyzer Integration by @​shahzadhaider1 in #​4761
• [INS-346] SpectralOps Personal API Key Detector by @​MuneebUllahKhan222 in #​4770
• [INS-335] Added AWS Appsync Detector by @​MuneebUllahKhan222 in #​4803
• fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @​kashifkhan0771 in #​4954
• Automate corpora testing in CI by @​mustansir14 in #​4927
• Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @​amanfcp in #​4924
• feat: add host, db and username to ExtraData for database detectors by @​mariocj89 in #​4849
• Remove over speculation from Corpora CI workflow by @​mustansir14 in #​4974
• Fix line numbers for duplicate secrets within a chunk by @​amanfcp in #​4910
• Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @​camgunz in #​4961
• Update Go security dependencies by @​cursor[bot] in #​4986
• Pin GitHub Actions to SHA digests by @​bryanbeverly in #​4985
• Update CODEOWNERS: replace 5 slugs with scanning + integrations by @​bryanbeverly in #​4983
• Added source config flags to sharepoint proto by @​MuneebUllahKhan222 in #​4972
• [SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @​mustansir14 in #​4981
• adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @​johannestaas-trufflesec in #​4991

New Contributors

• @​mariocj89 made their first contribution in #​4849
• @​cursor[bot] made their first contribution in #​4986
• @​johannestaas-trufflesec made their first contribution in #​4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.5

v3.95.4

Compare Source

What's Changed

• [INS-461] Add test to ensure new detectors are registered in defaults.go by @​mustansir14 in #​4915
• [INS-455] Unify common logic in Atlassian Data Center detectors by @​mustansir14 in #​4907
• fix(github): cache repo info under original URL on redirect by @​kashifkhan0771 in #​4958
• Added GitLab OAuth Detector by @​shahzadhaider1 in #​4729
• Box Detector: Extract Subject ID for Analyzer Integration by @​shahzadhaider1 in #​4761
• [INS-346] SpectralOps Personal API Key Detector by @​MuneebUllahKhan222 in #​4770
• [INS-335] Added AWS Appsync Detector by @​MuneebUllahKhan222 in #​4803
• fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @​kashifkhan0771 in #​4954
• Automate corpora testing in CI by @​mustansir14 in #​4927
• Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @​amanfcp in #​4924
• feat: add host, db and username to ExtraData for database detectors by @​mariocj89 in #​4849
• Remove over speculation from Corpora CI workflow by @​mustansir14 in #​4974
• Fix line numbers for duplicate secrets within a chunk by @​amanfcp in #​4910
• Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @​camgunz in #​4961
• Update Go security dependencies by @​cursor[bot] in #​4986
• Pin GitHub Actions to SHA digests by @​bryanbeverly in #​4985
• Update CODEOWNERS: replace 5 slugs with scanning + integrations by @​bryanbeverly in #​4983
• Added source config flags to sharepoint proto by @​MuneebUllahKhan222 in #​4972
• [SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @​mustansir14 in #​4981
• adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @​johannestaas-trufflesec in #​4991

New Contributors

• @​mariocj89 made their first contribution in #​4849
• @​cursor[bot] made their first contribution in #​4986
• @​johannestaas-trufflesec made their first contribution in #​4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.4

v3.95.3

Compare Source

What's Changed

• Renamed AnypointOAuth2 detector's AnalysisInfo keys to make it consistent with its Analyzer by @​MuneebUllahKhan222 in #​4906
• Rename AnalysisInfo field to SecretParts on detectors.Result by @​mcastorina in #​4911
• Document SecretParts contract in detector-authoring docs by @​mcastorina in #​4912
• Add a static check for detectors that don't set SecretParts by @​mcastorina in #​4913
• Populate SecretParts on all detectors by @​mcastorina in #​4919
• Make checksecretparts required in CI by @​mcastorina in #​4921
• Deduplicate concurrent credential verification requests via singleflight by @​kashifkhan0771 in #​4314
• log non-critical chunk errors at V(2).Info instead of Error by @​johnelliott in #​4928
• [INS-320] Cloudinary detector by @​MuneebUllahKhan222 in #​4747
• ci: bump JS actions to Node 24 majors (incl. CodeQL v4 + WIF auth v3) by @​bryanbeverly in #​4933
• chore: bump golangci-lint-action v7 → v9 (Node 24) by @​bryanbeverly in #​4936
• Add default Content-Type: application/json header for custom detector verification request by @​MuneebUllahKhan222 in #​4947
• Make detector Result.SecretParts initialization stricter by @​mcastorina in #​4948
• Add Pinecone API key detector by @​dylanTruffle in #​4917
• adding customizable successRanges and rotatedRanges to customDetector by @​jordanTunstill in #​4892

Full Changelog: trufflesecurity/trufflehog@v3.95.2...v3.95.3

v3.95.2

Compare Source

What's Changed

• Revert "[INS-397] Fix git version parser panic on non-numeric patch versions" by @​trufflesteeeve in #​4903

Full Changelog: trufflesecurity/trufflehog@v3.95.1...v3.95.2

v3.95.1

Compare Source

What's Changed

• [INS-444] Fix verification logic in Mesibo detector by @​mustansir14 in #​4884

Full Changelog: trufflesecurity/trufflehog@v3.95.0...v3.95.1

v3.95.0

Compare Source

What's Changed

• Upgrade golangci-lint in CI runner and Makefile by @​amanfcp in #​4861
• Deprecate SquareUp Detector by @​nabeelalam in #​4855
• [INS-397] Fix git version parser panic on non-numeric patch versions by @​shahzadhaider1 in #​4882
• Fix Bitbucket line highlighting URLs by @​shahzadhaider1 in #​4854
• [INS-403] Support Custom endpoint config in hashicorpvaultauth Detector by @​MuneebUllahKhan222 in #​4825
• [INS-398] Added tests to ensure that custom endpoint configuration works in artifactory detectors by @​MuneebUllahKhan222 in #​4832
• Host ldap-verify library in trufflesecurity by @​trufflesteeeve in #​4859
• Add AnalysisError type and wrap all analyzer error paths by @​johnelliott in #​4779
• dep-updates: Go 1.25 and dependency refreshes by @​dustin-decker in #​4888
• Fix nil pointer panics in GitHub analyzer gist/repo binding functions by @​shahzadhaider1 in #​4864
• [INS-399] Added Bitbucket data center(on prem) PAT detector by @​MuneebUllahKhan222 in #​4883
• [INS-402] Add Jira Data Center PAT Detector by @​mustansir14 in #​4872
• Add man page generation for trufflehog by @​bryanbeverly in #​4894
• Add Confluence Data Center PAT detector by @​amanfcp in #​4886

Full Changelog: trufflesecurity/trufflehog@v3.94.3...v3.95.0

v3.94.3

Compare Source

What's Changed

• Add release bot workflow by @​bryanbeverly in #​4835
• handle AADSTS50173 as explicit revocation signal for azure refresh tokens by @​jordanTunstill in #​4842
• Add AnalysisInfo to verified results by @​hxnyk in #​4862
• Add nil check and error context to GitHub analyzer by @​johnelliott in #​4858
• [CSM-1857] Fix expired Azure secrets being silently dropped by @​dipto-truffle in #​4845
• Add HTML decoder for secret detection in HTML-formatted sources by @​alafiand in #​4840
• Split out detector types into separate proto file in order to narrow CODEOWNERS scope by @​casey-tran in #​4871

New Contributors

• @​johnelliott made their first contribution in #​4858
• @​dipto-truffle made their first contribution in #​4845
• @​alafiand made their first contribution in #​4840

Full Changelog: trufflesecurity/trufflehog@v3.94.2...v3.94.3

v3.94.2

Compare Source

What's Changed

• Skip TestAPKHandler by @​shahzadhaider1 in #​4841
• fix: replace release-guard workflow with revert-latest job by @​sysread in #​4838
• Deprecated GoogleAPIKey Detector by @​nabeelalam in #​4853
• todoist: replac

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🚀 Integration Test Results

npm-pr-version action test:

• ✅ Version generation: 0.0.0-PR-80--b734426
• ✅ package.json update: Successful
• ✅ Format validation: Passed

The action is working correctly! 🎉

[github-actions]

🧪 Test Results

✅ All tests passed successfully!

• Linting: ✅ Passed
• Unit tests: ✅ Passed
• Integration tests: ✅ Passed

[github-actions]

❌ PR package publish failed!

Error: ❌ ERROR: OIDC token not available. Add permissions:

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
trufflesecurity/trufflehog	action	minor	v3.94.1 → v3.97.4

---

Release Notes

trufflesecurity/trufflehog (trufflesecurity/trufflehog)

v3.97.4

Compare Source

What's Changed

• Make Transport Errors indeterminate for Twilio secrets and twilioapikeys by @​jordanTunstill in #​5267
• Improve the json-enumerator source by @​bradlarsen in #​5265
• added tests for twilio detector fixes by @​jordanTunstill in #​5271

Full Changelog: trufflesecurity/trufflehog@v3.97.3...v3.97.4

v3.97.3

Compare Source

What's Changed

• fix(s3): cut a child context per object so key/size log values don't pile up by @​mariduv in #​5236
• Revert "[INT-933] De-base64 SourceUnit.UnitData in the GitHub Source" by @​trufflesteeeve in #​5269

Full Changelog: trufflesecurity/trufflehog@v3.97.2...v3.97.3

v3.97.2

Compare Source

What's Changed

• detectors/github/v2: differentiate token type in ExtraData by @​hartsock in #​5223
• Update dependency trufflesecurity/.github to v1.0.4 by @​renovate[bot] in #​5228
• ci: let Renovate bump the golangci-lint pin in scripts/lint.sh by @​bryanbeverly in #​5231
• Update github.com/trufflesecurity/ldap-verify digest to aa52b46 by @​renovate[bot] in #​5172
• Update github-actions by @​renovate[bot] in #​5197
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​5173
• Update module github.com/aws/smithy-go to v1.27.9 by @​renovate[bot] in #​5174
• [SCAN-18] Add SOURCE_TYPE_AWS_SECRETS_MANAGER source type by @​dipto-truffle in #​5234
• [INS-377] Add V2 for weights and biases detector by @​mustansir14 in #​4951
• Fix PagerDuty detector: treat 403 and 402 as verified credentials by @​unsmith in #​5230
• [INT-933] De-base64 SourceUnit.UnitData in the GitHub Source by @​camgunz in #​5248
• Implement Enumerate for the Jenkins source by @​Ahsan-Sarbaz in #​5229
• Update link to Truffle Security documentation by @​shahzadhaider1 in #​5256
• Retry git clone on secondary rate limit (bare 403/429) by @​kashifkhan0771 in #​5260

New Contributors

• @​hartsock made their first contribution in #​5223

Full Changelog: trufflesecurity/trufflehog@v3.97.1...v3.97.2

v3.97.1

Compare Source

What's Changed

• Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] by @​renovate[bot] in #​5196
• Fix GHEC with Data Residency (*.ghe.com) base URL by @​shahzadhaider1 in #​4777
• docs: add generic config-secret custom detector example by @​pgmpofu in #​5195
• fix(detectors/docker): don't greedy match in keyPat by @​mariduv in #​5214
• [SCAN-1020] neon scram pgx by @​alafiand in #​5217
• Raised MongoDB detector timeout value by @​jordanTunstill in #​5222
• preallocate bindings capacity in dockerhub and groq, with unit tests by @​jordanTunstill in #​5213
• [SCAN-101] S3 Source accept persisted unit envelopes in UnmarshalSourceUnit by @​amanfcp in #​5224
• Refine SECURITY.md by @​bradlarsen in #​5216
• Carry GitHub App installation ID on repo units by @​bill-rich in #​5215

New Contributors

• @​pgmpofu made their first contribution in #​5195

Full Changelog: trufflesecurity/trufflehog@v3.97.0...v3.97.1

v3.97.0

Compare Source

What's Changed

• fix(detectors/privatekey): report encrypted keys with uncrackable passphrases by @​genisis0x in #​5127
• Update module go.mongodb.org/mongo-driver to v1.17.7 [SECURITY] by @​renovate[bot] in #​5058
• Remove url tag from common HTTP client metrics by @​mcastorina in #​5158
• Update github.com/avast/apkparser digest to 7fcaee4 by @​renovate[bot] in #​5037
• [INS-318] Add New Relic License Key Detector by @​mustansir14 in #​4760
• [INS-348] Add New Relic Browser Key detector by @​mustansir14 in #​4769
• [INS-339] Add New Relic User Key detector by @​mustansir14 in #​4794
• [INS-345] Add New Relic Insights Query Key detector by @​mustansir14 in #​4781
• fix(sources): stop UnitHook Close racing in-flight Finish sends by @​bill-rich in #​5154
• There are now 3 CircleCI projects by @​trufflesteeeve in #​5166
• Update github.com/shurcooL/githubv4 digest to 2402fdf by @​renovate[bot] in #​5038
• Update github-actions by @​renovate[bot] in #​5036
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​4890
• [INS-344] Add New Relic Mobile App Token Detector by @​mustansir14 in #​4810
• Give each clone its own directory under --clone-path by @​shahzadhaider1 in #​5175
• feat(output): add SARIF output format for GitHub code scanning by @​kashifkhan0771 in #​5165
• [SCAN-1018] Treat SlackWebhook invalid_token (HTTP 400) as determinate not-live by @​alafiand in #​5177
• make cwd-changing normalization tests non-parallel to fix flaky clone failures by @​jordanTunstill in #​5178
• [INS-456] Add Microsoft Teams Webhook V2 detector by @​mustansir14 in #​4902
• surface git clone errors at v(0) by @​jordanTunstill in #​5162
• Add Figma Personal Access Token v3 Detector by @​shahzadhaider1 in #​4790
• fix(github): fallback resource Name to avoid empty-string proto validation failure by @​kashifkhan0771 in #​5182
• [INT-643] Update Protos definition to cater bitbucket Api token authentication by @​MuneebUllahKhan222 in #​5171
• Update regex pattern and 403 handling in the Lob detector to fix false positives by @​MachiavelliII in #​5188
• Deprecate AppOptics detector by @​Ahsan-Sarbaz in #​5198
• Anthropic detector: surface API error detail on non-2xx verification by @​Ahsan-Sarbaz in #​5180
• Deprecated bingsubscriptionkey detector by @​Ahsan-Sarbaz in #​5179
• Add SolarWinds Observability detector by @​Ahsan-Sarbaz in #​5199
• fix(jiratoken): stop 202 reverification retry loop by @​Ahsan-Sarbaz in #​5200
• Add custom endpoint support to the S3 source by @​shahzadhaider1 in #​5202
• fix(blogger): anchor regex to AIzaSy prefix to eliminate false positives by @​unsmith in #​5203
• fix(huggingface): move unscoped fine-grained models to UnboundedResources by @​unsmith in #​5204
• Add AWS Secrets Manager metadata type by @​rosecodym in #​5210
• fix(detectors/harness): allow underscore in PAT account segment by @​mattbrady-1 in #​5153

New Contributors

• @​MachiavelliII made their first contribution in #​5188
• @​Ahsan-Sarbaz made their first contribution in #​5198
• @​unsmith made their first contribution in #​5203

Full Changelog: trufflesecurity/trufflehog@v3.96.0...v3.97.0

v3.96.0

Compare Source

What's Changed

• [INS-355] Added Hashicorp vault token detector by @​MuneebUllahKhan222 in #​4819
• Tighten JiraToken v1 verification by @​shahzadhaider1 in #​5122
• [INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @​bill-rich in #​5123
• Fix GitLab project metadata cache and switch to LRU by @​kashifkhan0771 in #​4727
• Log analyze errors for Anthropic Analyzer by @​kashifkhan0771 in #​5120
• Add metrics for chunks and results by @​mcastorina in #​5128
• Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @​kashifkhan0771 in #​5111
• [INS-312] Duo API Secret Key Detector by @​MuneebUllahKhan222 in #​4771
• [Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by @​nabeelalam in #​4739
• [INS-255] Updated datadog detector to set verificationError in case of a verification error by @​MuneebUllahKhan222 in #​4661
• Log analyze errors for Postgres analyzer by @​kashifkhan0771 in #​5131
• Log analyze errors for HuggingFace analyzer by @​kashifkhan0771 in #​5130
• Engine - Config.SourceManager doc by @​amanfcp in #​5002
• Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @​renovate[bot] in #​5034
• Retry git clone on transient network errors by @​shahzadhaider1 in #​5132
• Fix scan_all_installations Rejecting Org Member Personal Repos by @​shahzadhaider1 in #​5142
• updated detector to include underscore char by @​mattbrady-1 in #​5121
• [chore] Change job_id in metric to source_type by @​mcastorina in #​5149
• Posthog regex update by @​mattbrady-1 in #​5133
• fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @​johannestaas-trufflesec in #​5151

New Contributors

• @​mattbrady-1 made their first contribution in #​5121

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

v3.95.9

Compare Source

What's Changed

• feat: add OpenRouter detector by @​McPatate in #​4500
• Integrations fully codeowns detectors by @​trufflesteeeve in #​5104
• [INS-332] Add New Relic Insights Insert key detector by @​mustansir14 in #​4778
• [INS-351] Added Duffel Token Detector by @​MuneebUllahKhan222 in #​4795
• [INS-341] Added Shippo detector by @​MuneebUllahKhan222 in #​4820
• [INS-467] Add IPinfo detector to default detectors list by @​mustansir14 in #​4970
• fix: reject --include-repos/--exclude-repos with --repo in github scan by @​kashifkhan0771 in #​5112
• [INS-468] Add improved lob detector to defaults.go by @​mustansir14 in #​4971
• feat(action): add image input to allow registry mirror overrides by @​eightseventhreethree in #​4965
• feat: Support archived repo exclusion from GH org scans by @​hibare in #​4875
• [INT-715] Retry transient failures when verifying OpenAI keys by @​bill-rich in #​5117
• [INS-410] Added batch token detector by @​MuneebUllahKhan222 in #​4824
• [INT-650] Don't log as error when git diff is too long by @​bill-rich in #​5113

New Contributors

• @​McPatate made their first contribution in #​4500
• @​eightseventhreethree made their first contribution in #​4965

Full Changelog: trufflesecurity/trufflehog@v3.95.8...v3.95.9

v3.95.8

Compare Source

What's Changed

• removed "unauthorized" as exception for rotated graphana secrets by @​jordanTunstill in #​5068
• fix(azuresastoken): match SAS tokens regardless of parameter order by @​genisis0x in #​5043
• Add prometheus metrics for engine channels and workers by @​mcastorina in #​5095
• [INS-465] Skip unverified JWT Detector results when feature flag is enabled by @​MuneebUllahKhan222 in #​5072
• [INS-334] Octopus Deploy detector by @​MuneebUllahKhan222 in #​4787
• Fix Syntax error in feature.go by @​MuneebUllahKhan222 in #​5109
• Include encoded resume info instead of clobbering it by @​bill-rich in #​5110

Full Changelog: trufflesecurity/trufflehog@v3.95.7...v3.95.8

v3.95.7

Compare Source

What's Changed

• fix(sources/filesystem): order resume comparison by path component by @​genisis0x in #​5041
• test(handlers): point APK test fixture at trufflehog-test-assets by @​amanfcp in #​5053
• fixed regex typo that was causing conf uuid's to be surfaced as non-live atlassian secrets. by @​jordanTunstill in #​5029
• Fix GitHub App cross-org member enumeration using per-installation tokens by @​dustin-decker in #​4774
• fix: add git worktree support in PrepareRepo by @​andoniaf in #​4690
• [INS-406] Braintrust detector by @​MuneebUllahKhan222 in #​4826
• huggingface: add bucket scanning by @​julien-c in #​5017
• Skip reverification results during deduplication by @​mcastorina in #​5069
• chore(renovate): bump shared config to v1.0.3 by @​bryanbeverly in #​5044
• Add scan_all_installations option for multi-org GitHub App scanning by @​dustin-decker in #​4775
• Expose SecretParts in the JSON output by @​bradlarsen in #​5073
• [INS-497] Add Pganalyze Read Key Detector by @​MuneebUllahKhan222 in #​4993
• [INS-197] Add redhatpyxis api key detector by @​MuneebUllahKhan222 in #​4995
• [INS-407] Fixed AWS detector producing non deterministic output by @​MuneebUllahKhan222 in #​4836

New Contributors

• @​genisis0x made their first contribution in #​5041
• @​andoniaf made their first contribution in #​4690
• @​julien-c made their first contribution in #​5017

Full Changelog: trufflesecurity/trufflehog@v3.95.6...v3.95.7

v3.95.6

Compare Source

What's Changed

• Enigma detector enhance verification to prevent false verified findings by @​shahzadhaider1 in #​5011
• fix: scan files with lines exceeding bufio's default 64 KB token limit by @​MuneebUllahKhan222 in #​5022
• fix(postgres): honor ignore tags for default port URLs by @​Dawn-Fighter in #​4968
• Move to github.com/moby/moby/client from docker/docker by @​trufflesteeeve in #​4987
• fix: avoid terminal probes before CLI output by @​Hackerchen716 in #​4994
• Update test containers dependency by @​trufflesteeeve in #​4978
• Re-host pkg/handlers JSON test fixtures under the org by @​amanfcp in #​5023
• [INS-465] Add datadogapikey detector to defaults.go by @​mustansir14 in #​4969
• [INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic by @​MuneebUllahKhan222 in #​5006
• [INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic by @​MuneebUllahKhan222 in #​5008
• Updating Klaviyo PK new format by @​breetan in #​5009
• Restructure Klaviyo detector pattern tests by @​martinlocklear in #​5026
• Replace Renovate config with shared preset (high-risk tier) by @​bryanbeverly in #​4992
• set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it by @​jordanTunstill in #​5027
• GitHub finegrained analyzer was improperly handling errors by @​dustin-decker in #​4498
• [INS-469] Added Rev detectors to defaults.go and gated it behind feature flag by @​MuneebUllahKhan222 in #​5005
• Fix Renovate lookup: update setup-captain version comment by @​bryanbeverly in #​4999
• [INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration by @​MuneebUllahKhan222 in #​5007
• Fix: Resolve known dedup issues in notifierWorker by @​MuneebUllahKhan222 in #​5028
• fix(dropbox): prevent long sl.u. tokens from being truncated by @​lukem-ts in #​5012
• fix: add filetype=sdist param to pypi detector by @​lukem-ts in #​4988
• Handlers - Embed small HTTP test fixtures by @​amanfcp in #​5001
• S3: surface bucket listing failures and fix multi-role object count by @​shahzadhaider1 in #​5035

New Contributors

• @​Dawn-Fighter made their first contribution in #​4968
• @​Hackerchen716 made their first contribution in #​4994
• @​breetan made their first contribution in #​5009
• @​lukem-ts made their first contribution in #​5012

Full Changelog: trufflesecurity/trufflehog@v3.95.4...v3.95.6

v3.95.5

Compare Source

What's Changed

• [INS-461] Add test to ensure new detectors are registered in defaults.go by @​mustansir14 in #​4915
• [INS-455] Unify common logic in Atlassian Data Center detectors by @​mustansir14 in #​4907
• fix(github): cache repo info under original URL on redirect by @​kashifkhan0771 in #​4958
• Added GitLab OAuth Detector by @​shahzadhaider1 in #​4729
• Box Detector: Extract Subject ID for Analyzer Integration by @​shahzadhaider1 in #​4761
• [INS-346] SpectralOps Personal API Key Detector by @​MuneebUllahKhan222 in #​4770
• [INS-335] Added AWS Appsync Detector by @​MuneebUllahKhan222 in #​4803
• fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @​kashifkhan0771 in #​4954
• Automate corpora testing in CI by @​mustansir14 in #​4927
• Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @​amanfcp in #​4924
• feat: add host, db and username to ExtraData for database detectors by @​mariocj89 in #​4849
• Remove over speculation from Corpora CI workflow by @​mustansir14 in #​4974
• Fix line numbers for duplicate secrets within a chunk by @​amanfcp in #​4910
• Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @​camgunz in #​4961
• Update Go security dependencies by @​cursor[bot] in #​4986
• Pin GitHub Actions to SHA digests by @​bryanbeverly in #​4985
• Update CODEOWNERS: replace 5 slugs with scanning + integrations by @​bryanbeverly in #​4983
• Added source config flags to sharepoint proto by @​MuneebUllahKhan222 in #​4972
• [SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @​mustansir14 in #​4981
• adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @​johannestaas-trufflesec in #​4991

New Contributors

• @​mariocj89 made their first contribution in #​4849
• @​cursor[bot] made their first contribution in #​4986
• @​johannestaas-trufflesec made their first contribution in #​4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.5

v3.95.4

Compare Source

What's Changed

• [INS-461] Add test to ensure new detectors are registered in defaults.go by @​mustansir14 in #​4915
• [INS-455] Unify common logic in Atlassian Data Center detectors by @​mustansir14 in #​4907
• fix(github): cache repo info under original URL on redirect by @​kashifkhan0771 in #​4958
• Added GitLab OAuth Detector by @​shahzadhaider1 in #​4729
• Box Detector: Extract Subject ID for Analyzer Integration by @​shahzadhaider1 in #​4761
• [INS-346] SpectralOps Personal API Key Detector by @​MuneebUllahKhan222 in #​4770
• [INS-335] Added AWS Appsync Detector by @​MuneebUllahKhan222 in #​4803
• fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @​kashifkhan0771 in #​4954
• Automate corpora testing in CI by @​mustansir14 in #​4927
• Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @​amanfcp in #​4924
• feat: add host, db and username to ExtraData for database detectors by @​mariocj89 in #​4849
• Remove over speculation from Corpora CI workflow by @​mustansir14 in #​4974
• Fix line numbers for duplicate secrets within a chunk by @​amanfcp in #​4910
• Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @​camgunz in #​4961
• Update Go security dependencies by @​cursor[bot] in #​4986
• Pin GitHub Actions to SHA digests by @​bryanbeverly in #​4985
• Update CODEOWNERS: replace 5 slugs with scanning + integrations by @​bryanbeverly in #​4983
• Added source config flags to sharepoint proto by @​MuneebUllahKhan222 in #​4972
• [SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @​mustansir14 in #​4981
• adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @​johannestaas-trufflesec in #​4991

New Contributors

• @​mariocj89 made their first contribution in #​4849
• @​cursor[bot] made their first contribution in #​4986
• @​johannestaas-trufflesec made their first contribution in #​4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.4

v3.95.3

Compare Source

What's Changed

• Renamed AnypointOAuth2 detector's AnalysisInfo keys to make it consistent with its Analyzer by @​MuneebUllahKhan222 in #​4906
• Rename AnalysisInfo field to SecretParts on detectors.Result by @​mcastorina in #​4911
• Document SecretParts contract in detector-authoring docs by @​mcastorina in #​4912
• Add a static check for detectors that don't set SecretParts by @​mcastorina in #​4913
• Populate SecretParts on all detectors by @​mcastorina in #​4919
• Make checksecretparts required in CI by @​mcastorina in #​4921
• Deduplicate concurrent credential verification requests via singleflight by @​kashifkhan0771 in #​4314
• log non-critical chunk errors at V(2).Info instead of Error by @​johnelliott in #​4928
• [INS-320] Cloudinary detector by @​MuneebUllahKhan222 in #​4747
• ci: bump JS actions to Node 24 majors (incl. CodeQL v4 + WIF auth v3) by @​bryanbeverly in #​4933
• chore: bump golangci-lint-action v7 → v9 (Node 24) by @​bryanbeverly in #​4936
• Add default Content-Type: application/json header for custom detector verification request by @​MuneebUllahKhan222 in #​4947
• Make detector Result.SecretParts initialization stricter by @​mcastorina in #​4948
• Add Pinecone API key detector by @​dylanTruffle in #​4917
• adding customizable successRanges and rotatedRanges to customDetector by @​jordanTunstill in #​4892

Full Changelog: trufflesecurity/trufflehog@v3.95.2...v3.95.3

v3.95.2

Compare Source

What's Changed

• Revert "[INS-397] Fix git version parser panic on non-numeric patch versions" by @​trufflesteeeve in #​4903

Full Changelog: trufflesecurity/trufflehog@v3.95.1...v3.95.2

v3.95.1

Compare Source

What's Changed

• [INS-444] Fix verification logic in Mesibo detector by @​mustansir14 in #​4884

Full Changelog: trufflesecurity/trufflehog@v3.95.0...v3.95.1

v3.95.0

Compare Source

What's Changed

• Upgrade golangci-lint in CI runner and Makefile by @​amanfcp in #​4861
• Deprecate SquareUp Detector by @​nabeelalam in #​4855
• [INS-397] Fix git version parser panic on non-numeric patch versions by @​shahzadhaider1 in #​4882
• Fix Bitbucket line highlighting URLs by @​shahzadhaider1 in #​4854
• [INS-403] Support Custom endpoint config in hashicorpvaultauth Detector by @​MuneebUllahKhan222 in #​4825
• [INS-398] Added tests to ensure that custom endpoint configuration works in artifactory detectors by @​MuneebUllahKhan222 in #​4832
• Host ldap-verify library in trufflesecurity by @​trufflesteeeve in #​4859
• Add AnalysisError type and wrap all analyzer error paths by @​johnelliott in #​4779
• dep-updates: Go 1.25 and dependency refreshes by @​dustin-decker in #​4888
• Fix nil pointer panics in GitHub analyzer gist/repo binding functions by @​shahzadhaider1 in #​4864
• [INS-399] Added Bitbucket data center(on prem) PAT detector by @​MuneebUllahKhan222 in #​4883
• [INS-402] Add Jira Data Center PAT Detector by @​mustansir14 in #​4872
• Add man page generation for trufflehog by @​bryanbeverly in #​4894
• Add Confluence Data Center PAT detector by @​amanfcp in #​4886

Full Changelog: trufflesecurity/trufflehog@v3.94.3...v3.95.0

v3.94.3

Compare Source

What's Changed

• Add release bot workflow by @​bryanbeverly in #​4835
• handle AADSTS50173 as explicit revocation signal for azure refresh tokens by @​jordanTunstill in #​4842
• Add AnalysisInfo to verified results by @​hxnyk in #​4862
• Add nil check and error context to GitHub analyzer by @​johnelliott in #​4858
• [CSM-1857] Fix expired Azure secrets being silently dropped by @​dipto-truffle in #​4845
• Add HTML decoder for secret detection in HTML-formatted sources by @​alafiand in #​4840
• Split out detector types into separate proto file in order to narrow CODEOWNERS scope by @​casey-tran in #​4871

New Contributors

• @​johnelliott made their first contribution in #​4858
• @​dipto-truffle made their first contribution in #​4845
• @​alafiand made their first contribution in #​4840

Full Changelog: trufflesecurity/trufflehog@v3.94.2...v3.94.3

v3.94.2

Compare Source

What's Changed

• Skip TestAPKHandler by @​shahzadhaider1 in #​4841
• fix: replace release-guard workflow with revert-latest job by @​sysread in #​4838
• Deprecated GoogleAPIKey Detector by @​nabeelalam in #​4853
• todoist: replac

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🚀 Integration Test Results

npm-pr-version action test:

• ✅ Version generation: 0.0.0-PR-80--b734426
• ✅ package.json update: Successful
• ✅ Format validation: Passed

The action is working correctly! 🎉

[github-actions]

🧪 Test Results

✅ All tests passed successfully!

• Linting: ✅ Passed
• Unit tests: ✅ Passed
• Integration tests: ✅ Passed

[github-actions]

❌ PR package publish failed!

Error: ❌ ERROR: OIDC token not available. Add permissions:

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
trufflesecurity/trufflehog	action	minor	v3.94.1 → v3.97.4

---

Release Notes

trufflesecurity/trufflehog (trufflesecurity/trufflehog)

v3.97.4

Compare Source

What's Changed

• Make Transport Errors indeterminate for Twilio secrets and twilioapikeys by @​jordanTunstill in #​5267
• Improve the json-enumerator source by @​bradlarsen in #​5265
• added tests for twilio detector fixes by @​jordanTunstill in #​5271

Full Changelog: trufflesecurity/trufflehog@v3.97.3...v3.97.4

v3.97.3

Compare Source

What's Changed

• fix(s3): cut a child context per object so key/size log values don't pile up by @​mariduv in #​5236
• Revert "[INT-933] De-base64 SourceUnit.UnitData in the GitHub Source" by @​trufflesteeeve in #​5269

Full Changelog: trufflesecurity/trufflehog@v3.97.2...v3.97.3

v3.97.2

Compare Source

What's Changed

• detectors/github/v2: differentiate token type in ExtraData by @​hartsock in #​5223
• Update dependency trufflesecurity/.github to v1.0.4 by @​renovate[bot] in #​5228
• ci: let Renovate bump the golangci-lint pin in scripts/lint.sh by @​bryanbeverly in #​5231
• Update github.com/trufflesecurity/ldap-verify digest to aa52b46 by @​renovate[bot] in #​5172
• Update github-actions by @​renovate[bot] in #​5197
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​5173
• Update module github.com/aws/smithy-go to v1.27.9 by @​renovate[bot] in #​5174
• [SCAN-18] Add SOURCE_TYPE_AWS_SECRETS_MANAGER source type by @​dipto-truffle in #​5234
• [INS-377] Add V2 for weights and biases detector by @​mustansir14 in #​4951
• Fix PagerDuty detector: treat 403 and 402 as verified credentials by @​unsmith in #​5230
• [INT-933] De-base64 SourceUnit.UnitData in the GitHub Source by @​camgunz in #​5248
• Implement Enumerate for the Jenkins source by @​Ahsan-Sarbaz in #​5229
• Update link to Truffle Security documentation by @​shahzadhaider1 in #​5256
• Retry git clone on secondary rate limit (bare 403/429) by @​kashifkhan0771 in #​5260

New Contributors

• @​hartsock made their first contribution in #​5223

Full Changelog: trufflesecurity/trufflehog@v3.97.1...v3.97.2

v3.97.1

Compare Source

What's Changed

• Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] by @​renovate[bot] in #​5196
• Fix GHEC with Data Residency (*.ghe.com) base URL by @​shahzadhaider1 in #​4777
• docs: add generic config-secret custom detector example by @​pgmpofu in #​5195
• fix(detectors/docker): don't greedy match in keyPat by @​mariduv in #​5214
• [SCAN-1020] neon scram pgx by @​alafiand in #​5217
• Raised MongoDB detector timeout value by @​jordanTunstill in #​5222
• preallocate bindings capacity in dockerhub and groq, with unit tests by @​jordanTunstill in #​5213
• [SCAN-101] S3 Source accept persisted unit envelopes in UnmarshalSourceUnit by @​amanfcp in #​5224
• Refine SECURITY.md by @​bradlarsen in #​5216
• Carry GitHub App installation ID on repo units by @​bill-rich in #​5215

New Contributors

• @​pgmpofu made their first contribution in #​5195

Full Changelog: trufflesecurity/trufflehog@v3.97.0...v3.97.1

v3.97.0

Compare Source

What's Changed

• fix(detectors/privatekey): report encrypted keys with uncrackable passphrases by @​genisis0x in #​5127
• Update module go.mongodb.org/mongo-driver to v1.17.7 [SECURITY] by @​renovate[bot] in #​5058
• Remove url tag from common HTTP client metrics by @​mcastorina in #​5158
• Update github.com/avast/apkparser digest to 7fcaee4 by @​renovate[bot] in #​5037
• [INS-318] Add New Relic License Key Detector by @​mustansir14 in #​4760
• [INS-348] Add New Relic Browser Key detector by @​mustansir14 in #​4769
• [INS-339] Add New Relic User Key detector by @​mustansir14 in #​4794
• [INS-345] Add New Relic Insights Query Key detector by @​mustansir14 in #​4781
• fix(sources): stop UnitHook Close racing in-flight Finish sends by @​bill-rich in #​5154
• There are now 3 CircleCI projects by @​trufflesteeeve in #​5166
• Update github.com/shurcooL/githubv4 digest to 2402fdf by @​renovate[bot] in #​5038
• Update github-actions by @​renovate[bot] in #​5036
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​4890
• [INS-344] Add New Relic Mobile App Token Detector by @​mustansir14 in #​4810
• Give each clone its own directory under --clone-path by @​shahzadhaider1 in #​5175
• feat(output): add SARIF output format for GitHub code scanning by @​kashifkhan0771 in #​5165
• [SCAN-1018] Treat SlackWebhook invalid_token (HTTP 400) as determinate not-live by @​alafiand in #​5177
• make cwd-changing normalization tests non-parallel to fix flaky clone failures by @​jordanTunstill in #​5178
• [INS-456] Add Microsoft Teams Webhook V2 detector by @​mustansir14 in #​4902
• surface git clone errors at v(0) by @​jordanTunstill in #​5162
• Add Figma Personal Access Token v3 Detector by @​shahzadhaider1 in #​4790
• fix(github): fallback resource Name to avoid empty-string proto validation failure by @​kashifkhan0771 in #​5182
• [INT-643] Update Protos definition to cater bitbucket Api token authentication by @​MuneebUllahKhan222 in #​5171
• Update regex pattern and 403 handling in the Lob detector to fix false positives by @​MachiavelliII in #​5188
• Deprecate AppOptics detector by @​Ahsan-Sarbaz in #​5198
• Anthropic detector: surface API error detail on non-2xx verification by @​Ahsan-Sarbaz in #​5180
• Deprecated bingsubscriptionkey detector by @​Ahsan-Sarbaz in #​5179
• Add SolarWinds Observability detector by @​Ahsan-Sarbaz in #​5199
• fix(jiratoken): stop 202 reverification retry loop by @​Ahsan-Sarbaz in #​5200
• Add custom endpoint support to the S3 source by @​shahzadhaider1 in #​5202
• fix(blogger): anchor regex to AIzaSy prefix to eliminate false positives by @​unsmith in #​5203
• fix(huggingface): move unscoped fine-grained models to UnboundedResources by @​unsmith in #​5204
• Add AWS Secrets Manager metadata type by @​rosecodym in #​5210
• fix(detectors/harness): allow underscore in PAT account segment by @​mattbrady-1 in #​5153

New Contributors

• @​MachiavelliII made their first contribution in #​5188
• @​Ahsan-Sarbaz made their first contribution in #​5198
• @​unsmith made their first contribution in #​5203

Full Changelog: trufflesecurity/trufflehog@v3.96.0...v3.97.0

v3.96.0

Compare Source

What's Changed

• [INS-355] Added Hashicorp vault token detector by @​MuneebUllahKhan222 in #​4819
• Tighten JiraToken v1 verification by @​shahzadhaider1 in #​5122
• [INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @​bill-rich in #​5123
• Fix GitLab project metadata cache and switch to LRU by @​kashifkhan0771 in #​4727
• Log analyze errors for Anthropic Analyzer by @​kashifkhan0771 in #​5120
• Add metrics for chunks and results by @​mcastorina in #​5128
• Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @​kashifkhan0771 in #​5111
• [INS-312] Duo API Secret Key Detector by @​MuneebUllahKhan222 in #​4771
• [Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by @​nabeelalam in #​4739
• [INS-255] Updated datadog detector to set verificationError in case of a verification error by @​MuneebUllahKhan222 in #​4661
• Log analyze errors for Postgres analyzer by @​kashifkhan0771 in #​5131
• Log analyze errors for HuggingFace analyzer by @​kashifkhan0771 in #​5130
• Engine - Config.SourceManager doc by @​amanfcp in #​5002
• Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @​renovate[bot] in #​5034
• Retry git clone on transient network errors by @​shahzadhaider1 in #​5132
• Fix scan_all_installations Rejecting Org Member Personal Repos by @​shahzadhaider1 in #​5142
• updated detector to include underscore char by @​mattbrady-1 in #​5121
• [chore] Change job_id in metric to source_type by @​mcastorina in #​5149
• Posthog regex update by @​mattbrady-1 in #​5133
• fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @​johannestaas-trufflesec in #​5151

New Contributors

• @​mattbrady-1 made their first contribution in #​5121

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

v3.95.9

Compare Source

What's Changed

• feat: add OpenRouter detector by @​McPatate in #​4500
• Integrations fully codeowns detectors by @​trufflesteeeve in #​5104
• [INS-332] Add New Relic Insights Insert key detector by @​mustansir14 in #​4778
• [INS-351] Added Duffel Token Detector by @​MuneebUllahKhan222 in #​4795
• [INS-341] Added Shippo detector by @​MuneebUllahKhan222 in #​4820
• [INS-467] Add IPinfo detector to default detectors list by @​mustansir14 in #​4970
• fix: reject --include-repos/--exclude-repos with --repo in github scan by @​kashifkhan0771 in #​5112
• [INS-468] Add improved lob detector to defaults.go by @​mustansir14 in #​4971
• feat(action): add image input to allow registry mirror overrides by @​eightseventhreethree in #​4965
• feat: Support archived repo exclusion from GH org scans by @​hibare in #​4875
• [INT-715] Retry transient failures when verifying OpenAI keys by @​bill-rich in #​5117
• [INS-410] Added batch token detector by @​MuneebUllahKhan222 in #​4824
• [INT-650] Don't log as error when git diff is too long by @​bill-rich in #​5113

New Contributors

• @​McPatate made their first contribution in #​4500
• @​eightseventhreethree made their first contribution in #​4965

Full Changelog: trufflesecurity/trufflehog@v3.95.8...v3.95.9

v3.95.8

Compare Source

What's Changed

• removed "unauthorized" as exception for rotated graphana secrets by @​jordanTunstill in #​5068
• fix(azuresastoken): match SAS tokens regardless of parameter order by @​genisis0x in #​5043
• Add prometheus metrics for engine channels and workers by @​mcastorina in #​5095
• [INS-465] Skip unverified JWT Detector results when feature flag is enabled by @​MuneebUllahKhan222 in #​5072
• [INS-334] Octopus Deploy detector by @​MuneebUllahKhan222 in #​4787
• Fix Syntax error in feature.go by @​MuneebUllahKhan222 in #​5109
• Include encoded resume info instead of clobbering it by @​bill-rich in #​5110

Full Changelog: trufflesecurity/trufflehog@v3.95.7...v3.95.8

v3.95.7

Compare Source

What's Changed

• fix(sources/filesystem): order resume comparison by path component by @​genisis0x in #​5041
• test(handlers): point APK test fixture at trufflehog-test-assets by @​amanfcp in #​5053
• fixed regex typo that was causing conf uuid's to be surfaced as non-live atlassian secrets. by @​jordanTunstill in #​5029
• Fix GitHub App cross-org member enumeration using per-installation tokens by @​dustin-decker in #​4774
• fix: add git worktree support in PrepareRepo by @​andoniaf in #​4690
• [INS-406] Braintrust detector by @​MuneebUllahKhan222 in #​4826
• huggingface: add bucket scanning by @​julien-c in #​5017
• Skip reverification results during deduplication by @​mcastorina in #​5069
• chore(renovate): bump shared config to v1.0.3 by @​bryanbeverly in #​5044
• Add scan_all_installations option for multi-org GitHub App scanning by @​dustin-decker in #​4775
• Expose SecretParts in the JSON output by @​bradlarsen in #​5073
• [INS-497] Add Pganalyze Read Key Detector by @​MuneebUllahKhan222 in #​4993
• [INS-197] Add redhatpyxis api key detector by @​MuneebUllahKhan222 in #​4995
• [INS-407] Fixed AWS detector producing non deterministic output by @​MuneebUllahKhan222 in #​4836

New Contributors

• @​genisis0x made their first contribution in #​5041
• @​andoniaf made their first contribution in #​4690
• @​julien-c made their first contribution in #​5017

Full Changelog: trufflesecurity/trufflehog@v3.95.6...v3.95.7

v3.95.6

Compare Source

What's Changed

• Enigma detector enhance verification to prevent false verified findings by @​shahzadhaider1 in #​5011
• fix: scan files with lines exceeding bufio's default 64 KB token limit by @​MuneebUllahKhan222 in #​5022
• fix(postgres): honor ignore tags for default port URLs by @​Dawn-Fighter in #​4968
• Move to github.com/moby/moby/client from docker/docker by @​trufflesteeeve in #​4987
• fix: avoid terminal probes before CLI output by @​Hackerchen716 in #​4994
• Update test containers dependency by @​trufflesteeeve in #​4978
• Re-host pkg/handlers JSON test fixtures under the org by @​amanfcp in #​5023
• [INS-465] Add datadogapikey detector to defaults.go by @​mustansir14 in #​4969
• [INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic by @​MuneebUllahKhan222 in #​5006
• [INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic by @​MuneebUllahKhan222 in #​5008
• Updating Klaviyo PK new format by @​breetan in #​5009
• Restructure Klaviyo detector pattern tests by @​martinlocklear in #​5026
• Replace Renovate config with shared preset (high-risk tier) by @​bryanbeverly in #​4992
• set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it by @​jordanTunstill in #​5027
• GitHub finegrained analyzer was improperly handling errors by @​dustin-decker in #​4498
• [INS-469] Added Rev detectors to defaults.go and gated it behind feature flag by @​MuneebUllahKhan222 in #​5005
• Fix Renovate lookup: update setup-captain version comment by @​bryanbeverly in #​4999
• [INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration by @​MuneebUllahKhan222 in #​5007
• Fix: Resolve known dedup issues in notifierWorker by @​MuneebUllahKhan222 in #​5028
• fix(dropbox): prevent long sl.u. tokens from being truncated by @​lukem-ts in #​5012
• fix: add filetype=sdist param to pypi detector by @​lukem-ts in #​4988
• Handlers - Embed small HTTP test fixtures by @​amanfcp in #​5001
• S3: surface bucket listing failures and fix multi-role object count by @​shahzadhaider1 in #​5035

New Contributors

• @​Dawn-Fighter made their first contribution in #​4968
• @​Hackerchen716 made their first contribution in #​4994
• @​breetan made their first contribution in #​5009
• @​lukem-ts made their first contribution in #​5012

Full Changelog: trufflesecurity/trufflehog@v3.95.4...v3.95.6

v3.95.5

Compare Source

What's Changed

• [INS-461] Add test to ensure new detectors are registered in defaults.go by @​mustansir14 in #​4915
• [INS-455] Unify common logic in Atlassian Data Center detectors by @​mustansir14 in #​4907
• fix(github): cache repo info under original URL on redirect by @​kashifkhan0771 in #​4958
• Added GitLab OAuth Detector by @​shahzadhaider1 in #​4729
• Box Detector: Extract Subject ID for Analyzer Integration by @​shahzadhaider1 in #​4761
• [INS-346] SpectralOps Personal API Key Detector by @​MuneebUllahKhan222 in #​4770
• [INS-335] Added AWS Appsync Detector by @​MuneebUllahKhan222 in #​4803
• fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @​kashifkhan0771 in #​4954
• Automate corpora testing in CI by @​mustansir14 in #​4927
• Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @​amanfcp in #​4924
• feat: add host, db and username to ExtraData for database detectors by @​mariocj89 in #​4849
• Remove over speculation from Corpora CI workflow by @​mustansir14 in #​4974
• Fix line numbers for duplicate secrets within a chunk by @​amanfcp in #​4910
• Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @​camgunz in #​4961
• Update Go security dependencies by @​cursor[bot] in #​4986
• Pin GitHub Actions to SHA digests by @​bryanbeverly in #​4985
• Update CODEOWNERS: replace 5 slugs with scanning + integrations by @​bryanbeverly in #​4983
• Added source config flags to sharepoint proto by @​MuneebUllahKhan222 in #​4972
• [SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @​mustansir14 in #​4981
• adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @​johannestaas-trufflesec in #​4991

New Contributors

• @​mariocj89 made their first contribution in #​4849
• @​cursor[bot] made their first contribution in #​4986
• @​johannestaas-trufflesec made their first contribution in #​4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.5

v3.95.4

Compare Source

What's Changed

• [INS-461] Add test to ensure new detectors are registered in defaults.go by @​mustansir14 in #​4915
• [INS-455] Unify common logic in Atlassian Data Center detectors by @​mustansir14 in #​4907
• fix(github): cache repo info under original URL on redirect by @​kashifkhan0771 in #​4958
• Added GitLab OAuth Detector by @​shahzadhaider1 in #​4729
• Box Detector: Extract Subject ID for Analyzer Integration by @​shahzadhaider1 in #​4761
• [INS-346] SpectralOps Personal API Key Detector by @​MuneebUllahKhan222 in #​4770
• [INS-335] Added AWS Appsync Detector by @​MuneebUllahKhan222 in #​4803
• fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @​kashifkhan0771 in #​4954
• Automate corpora testing in CI by @​mustansir14 in #​4927
• Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @​amanfcp in #​4924
• feat: add host, db and username to ExtraData for database detectors by @​mariocj89 in #​4849
• Remove over speculation from Corpora CI workflow by @​mustansir14 in #​4974
• Fix line numbers for duplicate secrets within a chunk by @​amanfcp in #​4910
• Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @​camgunz in #​4961
• Update Go security dependencies by @​cursor[bot] in #​4986
• Pin GitHub Actions to SHA digests by @​bryanbeverly in #​4985
• Update CODEOWNERS: replace 5 slugs with scanning + integrations by @​bryanbeverly in #​4983
• Added source config flags to sharepoint proto by @​MuneebUllahKhan222 in #​4972
• [SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @​mustansir14 in #​4981
• adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @​johannestaas-trufflesec in #​4991

New Contributors

• @​mariocj89 made their first contribution in #​4849
• @​cursor[bot] made their first contribution in #​4986
• @​johannestaas-trufflesec made their first contribution in #​4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.4

v3.95.3

Compare Source

What's Changed

• Renamed AnypointOAuth2 detector's AnalysisInfo keys to make it consistent with its Analyzer by @​MuneebUllahKhan222 in #​4906
• Rename AnalysisInfo field to SecretParts on detectors.Result by @​mcastorina in #​4911
• Document SecretParts contract in detector-authoring docs by @​mcastorina in #​4912
• Add a static check for detectors that don't set SecretParts by @​mcastorina in #​4913
• Populate SecretParts on all detectors by @​mcastorina in #​4919
• Make checksecretparts required in CI by @​mcastorina in #​4921
• Deduplicate concurrent credential verification requests via singleflight by @​kashifkhan0771 in #​4314
• log non-critical chunk errors at V(2).Info instead of Error by @​johnelliott in #​4928
• [INS-320] Cloudinary detector by @​MuneebUllahKhan222 in #​4747
• ci: bump JS actions to Node 24 majors (incl. CodeQL v4 + WIF auth v3) by @​bryanbeverly in #​4933
• chore: bump golangci-lint-action v7 → v9 (Node 24) by @​bryanbeverly in #​4936
• Add default Content-Type: application/json header for custom detector verification request by @​MuneebUllahKhan222 in #​4947
• Make detector Result.SecretParts initialization stricter by @​mcastorina in #​4948
• Add Pinecone API key detector by @​dylanTruffle in #​4917
• adding customizable successRanges and rotatedRanges to customDetector by @​jordanTunstill in #​4892

Full Changelog: trufflesecurity/trufflehog@v3.95.2...v3.95.3

v3.95.2

Compare Source

What's Changed

• Revert "[INS-397] Fix git version parser panic on non-numeric patch versions" by @​trufflesteeeve in #​4903

Full Changelog: trufflesecurity/trufflehog@v3.95.1...v3.95.2

v3.95.1

Compare Source

What's Changed

• [INS-444] Fix verification logic in Mesibo detector by @​mustansir14 in #​4884

Full Changelog: trufflesecurity/trufflehog@v3.95.0...v3.95.1

v3.95.0

Compare Source

What's Changed

• Upgrade golangci-lint in CI runner and Makefile by @​amanfcp in #​4861
• Deprecate SquareUp Detector by @​nabeelalam in #​4855
• [INS-397] Fix git version parser panic on non-numeric patch versions by @​shahzadhaider1 in #​4882
• Fix Bitbucket line highlighting URLs by @​shahzadhaider1 in #​4854
• [INS-403] Support Custom endpoint config in hashicorpvaultauth Detector by @​MuneebUllahKhan222 in #​4825
• [INS-398] Added tests to ensure that custom endpoint configuration works in artifactory detectors by @​MuneebUllahKhan222 in #​4832
• Host ldap-verify library in trufflesecurity by @​trufflesteeeve in #​4859
• Add AnalysisError type and wrap all analyzer error paths by @​johnelliott in #​4779
• dep-updates: Go 1.25 and dependency refreshes by @​dustin-decker in #​4888
• Fix nil pointer panics in GitHub analyzer gist/repo binding functions by @​shahzadhaider1 in #​4864
• [INS-399] Added Bitbucket data center(on prem) PAT detector by @​MuneebUllahKhan222 in #​4883
• [INS-402] Add Jira Data Center PAT Detector by @​mustansir14 in #​4872
• Add man page generation for trufflehog by @​bryanbeverly in #​4894
• Add Confluence Data Center PAT detector by @​amanfcp in #​4886

Full Changelog: trufflesecurity/trufflehog@v3.94.3...v3.95.0

v3.94.3

Compare Source

What's Changed

• Add release bot workflow by @​bryanbeverly in #​4835
• handle AADSTS50173 as explicit revocation signal for azure refresh tokens by @​jordanTunstill in #​4842
• Add AnalysisInfo to verified results by @​hxnyk in #​4862
• Add nil check and error context to GitHub analyzer by @​johnelliott in #​4858
• [CSM-1857] Fix expired Azure secrets being silently dropped by @​dipto-truffle in #​4845
• Add HTML decoder for secret detection in HTML-formatted sources by @​alafiand in #​4840
• Split out detector types into separate proto file in order to narrow CODEOWNERS scope by @​casey-tran in #​4871

New Contributors

• @​johnelliott made their first contribution in #​4858
• @​dipto-truffle made their first contribution in #​4845
• @​alafiand made their first contribution in #​4840

Full Changelog: trufflesecurity/trufflehog@v3.94.2...v3.94.3

v3.94.2

Compare Source

What's Changed

• Skip TestAPKHandler by @​shahzadhaider1 in #​4841
• fix: replace release-guard workflow with revert-latest job by @​sysread in #​4838
• Deprecated GoogleAPIKey Detector by @​nabeelalam in #​4853
• todoist: replac

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🚀 Integration Test Results

npm-pr-version action test:

• ✅ Version generation: 0.0.0-PR-80--b734426
• ✅ package.json update: Successful
• ✅ Format validation: Passed

The action is working correctly! 🎉

[github-actions]

🧪 Test Results

✅ All tests passed successfully!

• Linting: ✅ Passed
• Unit tests: ✅ Passed
• Integration tests: ✅ Passed

[github-actions]

❌ PR package publish failed!

Error: ❌ ERROR: OIDC token not available. Add permissions:

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
trufflesecurity/trufflehog	action	minor	v3.94.1 → v3.97.4

---

Release Notes

trufflesecurity/trufflehog (trufflesecurity/trufflehog)

v3.97.4

Compare Source

What's Changed

• Make Transport Errors indeterminate for Twilio secrets and twilioapikeys by @​jordanTunstill in #​5267
• Improve the json-enumerator source by @​bradlarsen in #​5265
• added tests for twilio detector fixes by @​jordanTunstill in #​5271

Full Changelog: trufflesecurity/trufflehog@v3.97.3...v3.97.4

v3.97.3

Compare Source

What's Changed

• fix(s3): cut a child context per object so key/size log values don't pile up by @​mariduv in #​5236
• Revert "[INT-933] De-base64 SourceUnit.UnitData in the GitHub Source" by @​trufflesteeeve in #​5269

Full Changelog: trufflesecurity/trufflehog@v3.97.2...v3.97.3

v3.97.2

Compare Source

What's Changed

• detectors/github/v2: differentiate token type in ExtraData by @​hartsock in #​5223
• Update dependency trufflesecurity/.github to v1.0.4 by @​renovate[bot] in #​5228
• ci: let Renovate bump the golangci-lint pin in scripts/lint.sh by @​bryanbeverly in #​5231
• Update github.com/trufflesecurity/ldap-verify digest to aa52b46 by @​renovate[bot] in #​5172
• Update github-actions by @​renovate[bot] in #​5197
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​5173
• Update module github.com/aws/smithy-go to v1.27.9 by @​renovate[bot] in #​5174
• [SCAN-18] Add SOURCE_TYPE_AWS_SECRETS_MANAGER source type by @​dipto-truffle in #​5234
• [INS-377] Add V2 for weights and biases detector by @​mustansir14 in #​4951
• Fix PagerDuty detector: treat 403 and 402 as verified credentials by @​unsmith in #​5230
• [INT-933] De-base64 SourceUnit.UnitData in the GitHub Source by @​camgunz in #​5248
• Implement Enumerate for the Jenkins source by @​Ahsan-Sarbaz in #​5229
• Update link to Truffle Security documentation by @​shahzadhaider1 in #​5256
• Retry git clone on secondary rate limit (bare 403/429) by @​kashifkhan0771 in #​5260

New Contributors

• @​hartsock made their first contribution in #​5223

Full Changelog: trufflesecurity/trufflehog@v3.97.1...v3.97.2

v3.97.1

Compare Source

What's Changed

• Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] by @​renovate[bot] in #​5196
• Fix GHEC with Data Residency (*.ghe.com) base URL by @​shahzadhaider1 in #​4777
• docs: add generic config-secret custom detector example by @​pgmpofu in #​5195
• fix(detectors/docker): don't greedy match in keyPat by @​mariduv in #​5214
• [SCAN-1020] neon scram pgx by @​alafiand in #​5217
• Raised MongoDB detector timeout value by @​jordanTunstill in #​5222
• preallocate bindings capacity in dockerhub and groq, with unit tests by @​jordanTunstill in #​5213
• [SCAN-101] S3 Source accept persisted unit envelopes in UnmarshalSourceUnit by @​amanfcp in #​5224
• Refine SECURITY.md by @​bradlarsen in #​5216
• Carry GitHub App installation ID on repo units by @​bill-rich in #​5215

New Contributors

• @​pgmpofu made their first contribution in #​5195

Full Changelog: trufflesecurity/trufflehog@v3.97.0...v3.97.1

v3.97.0

Compare Source

What's Changed

• fix(detectors/privatekey): report encrypted keys with uncrackable passphrases by @​genisis0x in #​5127
• Update module go.mongodb.org/mongo-driver to v1.17.7 [SECURITY] by @​renovate[bot] in #​5058
• Remove url tag from common HTTP client metrics by @​mcastorina in #​5158
• Update github.com/avast/apkparser digest to 7fcaee4 by @​renovate[bot] in #​5037
• [INS-318] Add New Relic License Key Detector by @​mustansir14 in #​4760
• [INS-348] Add New Relic Browser Key detector by @​mustansir14 in #​4769
• [INS-339] Add New Relic User Key detector by @​mustansir14 in #​4794
• [INS-345] Add New Relic Insights Query Key detector by @​mustansir14 in #​4781
• fix(sources): stop UnitHook Close racing in-flight Finish sends by @​bill-rich in #​5154
• There are now 3 CircleCI projects by @​trufflesteeeve in #​5166
• Update github.com/shurcooL/githubv4 digest to 2402fdf by @​renovate[bot] in #​5038
• Update github-actions by @​renovate[bot] in #​5036
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​4890
• [INS-344] Add New Relic Mobile App Token Detector by @​mustansir14 in #​4810
• Give each clone its own directory under --clone-path by @​shahzadhaider1 in #​5175
• feat(output): add SARIF output format for GitHub code scanning by @​kashifkhan0771 in #​5165
• [SCAN-1018] Treat SlackWebhook invalid_token (HTTP 400) as determinate not-live by @​alafiand in #​5177
• make cwd-changing normalization tests non-parallel to fix flaky clone failures by @​jordanTunstill in #​5178
• [INS-456] Add Microsoft Teams Webhook V2 detector by @​mustansir14 in #​4902
• surface git clone errors at v(0) by @​jordanTunstill in #​5162
• Add Figma Personal Access Token v3 Detector by @​shahzadhaider1 in #​4790
• fix(github): fallback resource Name to avoid empty-string proto validation failure by @​kashifkhan0771 in #​5182
• [INT-643] Update Protos definition to cater bitbucket Api token authentication by @​MuneebUllahKhan222 in #​5171
• Update regex pattern and 403 handling in the Lob detector to fix false positives by @​MachiavelliII in #​5188
• Deprecate AppOptics detector by @​Ahsan-Sarbaz in #​5198
• Anthropic detector: surface API error detail on non-2xx verification by @​Ahsan-Sarbaz in #​5180
• Deprecated bingsubscriptionkey detector by @​Ahsan-Sarbaz in #​5179
• Add SolarWinds Observability detector by @​Ahsan-Sarbaz in #​5199
• fix(jiratoken): stop 202 reverification retry loop by @​Ahsan-Sarbaz in #​5200
• Add custom endpoint support to the S3 source by @​shahzadhaider1 in #​5202
• fix(blogger): anchor regex to AIzaSy prefix to eliminate false positives by @​unsmith in #​5203
• fix(huggingface): move unscoped fine-grained models to UnboundedResources by @​unsmith in #​5204
• Add AWS Secrets Manager metadata type by @​rosecodym in #​5210
• fix(detectors/harness): allow underscore in PAT account segment by @​mattbrady-1 in #​5153

New Contributors

• @​MachiavelliII made their first contribution in #​5188
• @​Ahsan-Sarbaz made their first contribution in #​5198
• @​unsmith made their first contribution in #​5203

Full Changelog: trufflesecurity/trufflehog@v3.96.0...v3.97.0

v3.96.0

Compare Source

What's Changed

• [INS-355] Added Hashicorp vault token detector by @​MuneebUllahKhan222 in #​4819
• Tighten JiraToken v1 verification by @​shahzadhaider1 in #​5122
• [INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @​bill-rich in #​5123
• Fix GitLab project metadata cache and switch to LRU by @​kashifkhan0771 in #​4727
• Log analyze errors for Anthropic Analyzer by @​kashifkhan0771 in #​5120
• Add metrics for chunks and results by @​mcastorina in #​5128
• Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @​kashifkhan0771 in #​5111
• [INS-312] Duo API Secret Key Detector by @​MuneebUllahKhan222 in #​4771
• [Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by @​nabeelalam in #​4739
• [INS-255] Updated datadog detector to set verificationError in case of a verification error by @​MuneebUllahKhan222 in #​4661
• Log analyze errors for Postgres analyzer by @​kashifkhan0771 in #​5131
• Log analyze errors for HuggingFace analyzer by @​kashifkhan0771 in #​5130
• Engine - Config.SourceManager doc by @​amanfcp in #​5002
• Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @​renovate[bot] in #​5034
• Retry git clone on transient network errors by @​shahzadhaider1 in #​5132
• Fix scan_all_installations Rejecting Org Member Personal Repos by @​shahzadhaider1 in #​5142
• updated detector to include underscore char by @​mattbrady-1 in #​5121
• [chore] Change job_id in metric to source_type by @​mcastorina in #​5149
• Posthog regex update by @​mattbrady-1 in #​5133
• fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @​johannestaas-trufflesec in #​5151

New Contributors

• @​mattbrady-1 made their first contribution in #​5121

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

v3.95.9

Compare Source

What's Changed

• feat: add OpenRouter detector by @​McPatate in #​4500
• Integrations fully codeowns detectors by @​trufflesteeeve in #​5104
• [INS-332] Add New Relic Insights Insert key detector by @​mustansir14 in #​4778
• [INS-351] Added Duffel Token Detector by @​MuneebUllahKhan222 in #​4795
• [INS-341] Added Shippo detector by @​MuneebUllahKhan222 in #​4820
• [INS-467] Add IPinfo detector to default detectors list by @​mustansir14 in #​4970
• fix: reject --include-repos/--exclude-repos with --repo in github scan by @​kashifkhan0771 in #​5112
• [INS-468] Add improved lob detector to defaults.go by @​mustansir14 in #​4971
• feat(action): add image input to allow registry mirror overrides by @​eightseventhreethree in #​4965
• feat: Support archived repo exclusion from GH org scans by @​hibare in #​4875
• [INT-715] Retry transient failures when verifying OpenAI keys by @​bill-rich in #​5117
• [INS-410] Added batch token detector by @​MuneebUllahKhan222 in #​4824
• [INT-650] Don't log as error when git diff is too long by @​bill-rich in #​5113

New Contributors

• @​McPatate made their first contribution in #​4500
• @​eightseventhreethree made their first contribution in #​4965

Full Changelog: trufflesecurity/trufflehog@v3.95.8...v3.95.9

v3.95.8

Compare Source

What's Changed

• removed "unauthorized" as exception for rotated graphana secrets by @​jordanTunstill in #​5068
• fix(azuresastoken): match SAS tokens regardless of parameter order by @​genisis0x in #​5043
• Add prometheus metrics for engine channels and workers by @​mcastorina in #​5095
• [INS-465] Skip unverified JWT Detector results when feature flag is enabled by @​MuneebUllahKhan222 in #​5072
• [INS-334] Octopus Deploy detector by @​MuneebUllahKhan222 in #​4787
• Fix Syntax error in feature.go by @​MuneebUllahKhan222 in #​5109
• Include encoded resume info instead of clobbering it by @​bill-rich in #​5110

Full Changelog: trufflesecurity/trufflehog@v3.95.7...v3.95.8

v3.95.7

Compare Source

What's Changed

• fix(sources/filesystem): order resume comparison by path component by @​genisis0x in #​5041
• test(handlers): point APK test fixture at trufflehog-test-assets by @​amanfcp in #​5053
• fixed regex typo that was causing conf uuid's to be surfaced as non-live atlassian secrets. by @​jordanTunstill in #​5029
• Fix GitHub App cross-org member enumeration using per-installation tokens by @​dustin-decker in #​4774
• fix: add git worktree support in PrepareRepo by @​andoniaf in #​4690
• [INS-406] Braintrust detector by @​MuneebUllahKhan222 in #​4826
• huggingface: add bucket scanning by @​julien-c in #​5017
• Skip reverification results during deduplication by @​mcastorina in #​5069
• chore(renovate): bump shared config to v1.0.3 by @​bryanbeverly in #​5044
• Add scan_all_installations option for multi-org GitHub App scanning by @​dustin-decker in #​4775
• Expose SecretParts in the JSON output by @​bradlarsen in #​5073
• [INS-497] Add Pganalyze Read Key Detector by @​MuneebUllahKhan222 in #​4993
• [INS-197] Add redhatpyxis api key detector by @​MuneebUllahKhan222 in #​4995
• [INS-407] Fixed AWS detector producing non deterministic output by @​MuneebUllahKhan222 in #​4836

New Contributors

• @​genisis0x made their first contribution in #​5041
• @​andoniaf made their first contribution in #​4690
• @​julien-c made their first contribution in #​5017

Full Changelog: trufflesecurity/trufflehog@v3.95.6...v3.95.7

v3.95.6

Compare Source

What's Changed

• Enigma detector enhance verification to prevent false verified findings by @​shahzadhaider1 in #​5011
• fix: scan files with lines exceeding bufio's default 64 KB token limit by @​MuneebUllahKhan222 in #​5022
• fix(postgres): honor ignore tags for default port URLs by @​Dawn-Fighter in #​4968
• Move to github.com/moby/moby/client from docker/docker by @​trufflesteeeve in #​4987
• fix: avoid terminal probes before CLI output by @​Hackerchen716 in #​4994
• Update test containers dependency by @​trufflesteeeve in #​4978
• Re-host pkg/handlers JSON test fixtures under the org by @​amanfcp in #​5023
• [INS-465] Add datadogapikey detector to defaults.go by @​mustansir14 in #​4969
• [INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic by @​MuneebUllahKhan222 in #​5006
• [INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic by @​MuneebUllahKhan222 in #​5008
• Updating Klaviyo PK new format by @​breetan in #​5009
• Restructure Klaviyo detector pattern tests by @​martinlocklear in #​5026
• Replace Renovate config with shared preset (high-risk tier) by @​bryanbeverly in #​4992
• set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it by @​jordanTunstill in #​5027
• GitHub finegrained analyzer was improperly handling errors by @​dustin-decker in #​4498
• [INS-469] Added Rev detectors to defaults.go and gated it behind feature flag by @​MuneebUllahKhan222 in #​5005
• Fix Renovate lookup: update setup-captain version comment by @​bryanbeverly in #​4999
• [INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration by @​MuneebUllahKhan222 in #​5007
• Fix: Resolve known dedup issues in notifierWorker by @​MuneebUllahKhan222 in #​5028
• fix(dropbox): prevent long sl.u. tokens from being truncated by @​lukem-ts in #​5012
• fix: add filetype=sdist param to pypi detector by @​lukem-ts in #​4988
• Handlers - Embed small HTTP test fixtures by @​amanfcp in #​5001
• S3: surface bucket listing failures and fix multi-role object count by @​shahzadhaider1 in #​5035

New Contributors

• @​Dawn-Fighter made their first contribution in #​4968
• @​Hackerchen716 made their first contribution in #​4994
• @​breetan made their first contribution in #​5009
• @​lukem-ts made their first contribution in #​5012

Full Changelog: trufflesecurity/trufflehog@v3.95.4...v3.95.6

v3.95.5

Compare Source

What's Changed

• [INS-461] Add test to ensure new detectors are registered in defaults.go by @​mustansir14 in #​4915
• [INS-455] Unify common logic in Atlassian Data Center detectors by @​mustansir14 in #​4907
• fix(github): cache repo info under original URL on redirect by @​kashifkhan0771 in #​4958
• Added GitLab OAuth Detector by @​shahzadhaider1 in #​4729
• Box Detector: Extract Subject ID for Analyzer Integration by @​shahzadhaider1 in #​4761
• [INS-346] SpectralOps Personal API Key Detector by @​MuneebUllahKhan222 in #​4770
• [INS-335] Added AWS Appsync Detector by @​MuneebUllahKhan222 in #​4803
• fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @​kashifkhan0771 in #​4954
• Automate corpora testing in CI by @​mustansir14 in #​4927
• Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @​amanfcp in #​4924
• feat: add host, db and username to ExtraData for database detectors by @​mariocj89 in #​4849
• Remove over speculation from Corpora CI workflow by @​mustansir14 in #​4974
• Fix line numbers for duplicate secrets within a chunk by @​amanfcp in #​4910
• Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @​camgunz in #​4961
• Update Go security dependencies by @​cursor[bot] in #​4986
• Pin GitHub Actions to SHA digests by @​bryanbeverly in #​4985
• Update CODEOWNERS: replace 5 slugs with scanning + integrations by @​bryanbeverly in #​4983
• Added source config flags to sharepoint proto by @​MuneebUllahKhan222 in #​4972
• [SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @​mustansir14 in #​4981
• adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @​johannestaas-trufflesec in #​4991

New Contributors

• @​mariocj89 made their first contribution in #​4849
• @​cursor[bot] made their first contribution in #​4986
• @​johannestaas-trufflesec made their first contribution in #​4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.5

v3.95.4

Compare Source

What's Changed

• [INS-461] Add test to ensure new detectors are registered in defaults.go by @​mustansir14 in #​4915
• [INS-455] Unify common logic in Atlassian Data Center detectors by @​mustansir14 in #​4907
• fix(github): cache repo info under original URL on redirect by @​kashifkhan0771 in #​4958
• Added GitLab OAuth Detector by @​shahzadhaider1 in #​4729
• Box Detector: Extract Subject ID for Analyzer Integration by @​shahzadhaider1 in #​4761
• [INS-346] SpectralOps Personal API Key Detector by @​MuneebUllahKhan222 in #​4770
• [INS-335] Added AWS Appsync Detector by @​MuneebUllahKhan222 in #​4803
• fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @​kashifkhan0771 in #​4954
• Automate corpora testing in CI by @​mustansir14 in #​4927
• Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @​amanfcp in #​4924
• feat: add host, db and username to ExtraData for database detectors by @​mariocj89 in #​4849
• Remove over speculation from Corpora CI workflow by @​mustansir14 in #​4974
• Fix line numbers for duplicate secrets within a chunk by @​amanfcp in #​4910
• Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @​camgunz in #​4961
• Update Go security dependencies by @​cursor[bot] in #​4986
• Pin GitHub Actions to SHA digests by @​bryanbeverly in #​4985
• Update CODEOWNERS: replace 5 slugs with scanning + integrations by @​bryanbeverly in #​4983
• Added source config flags to sharepoint proto by @​MuneebUllahKhan222 in #​4972
• [SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @​mustansir14 in #​4981
• adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @​johannestaas-trufflesec in #​4991

New Contributors

• @​mariocj89 made their first contribution in #​4849
• @​cursor[bot] made their first contribution in #​4986
• @​johannestaas-trufflesec made their first contribution in #​4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.4

v3.95.3

Compare Source

What's Changed

• Renamed AnypointOAuth2 detector's AnalysisInfo keys to make it consistent with its Analyzer by @​MuneebUllahKhan222 in #​4906
• Rename AnalysisInfo field to SecretParts on detectors.Result by @​mcastorina in #​4911
• Document SecretParts contract in detector-authoring docs by @​mcastorina in #​4912
• Add a static check for detectors that don't set SecretParts by @​mcastorina in #​4913
• Populate SecretParts on all detectors by @​mcastorina in #​4919
• Make checksecretparts required in CI by @​mcastorina in #​4921
• Deduplicate concurrent credential verification requests via singleflight by @​kashifkhan0771 in #​4314
• log non-critical chunk errors at V(2).Info instead of Error by @​johnelliott in #​4928
• [INS-320] Cloudinary detector by @​MuneebUllahKhan222 in #​4747
• ci: bump JS actions to Node 24 majors (incl. CodeQL v4 + WIF auth v3) by @​bryanbeverly in #​4933
• chore: bump golangci-lint-action v7 → v9 (Node 24) by @​bryanbeverly in #​4936
• Add default Content-Type: application/json header for custom detector verification request by @​MuneebUllahKhan222 in #​4947
• Make detector Result.SecretParts initialization stricter by @​mcastorina in #​4948
• Add Pinecone API key detector by @​dylanTruffle in #​4917
• adding customizable successRanges and rotatedRanges to customDetector by @​jordanTunstill in #​4892

Full Changelog: trufflesecurity/trufflehog@v3.95.2...v3.95.3

v3.95.2

Compare Source

What's Changed

• Revert "[INS-397] Fix git version parser panic on non-numeric patch versions" by @​trufflesteeeve in #​4903

Full Changelog: trufflesecurity/trufflehog@v3.95.1...v3.95.2

v3.95.1

Compare Source

What's Changed

• [INS-444] Fix verification logic in Mesibo detector by @​mustansir14 in #​4884

Full Changelog: trufflesecurity/trufflehog@v3.95.0...v3.95.1

v3.95.0

Compare Source

What's Changed

• Upgrade golangci-lint in CI runner and Makefile by @​amanfcp in #​4861
• Deprecate SquareUp Detector by @​nabeelalam in #​4855
• [INS-397] Fix git version parser panic on non-numeric patch versions by @​shahzadhaider1 in #​4882
• Fix Bitbucket line highlighting URLs by @​shahzadhaider1 in #​4854
• [INS-403] Support Custom endpoint config in hashicorpvaultauth Detector by @​MuneebUllahKhan222 in #​4825
• [INS-398] Added tests to ensure that custom endpoint configuration works in artifactory detectors by @​MuneebUllahKhan222 in #​4832
• Host ldap-verify library in trufflesecurity by @​trufflesteeeve in #​4859
• Add AnalysisError type and wrap all analyzer error paths by @​johnelliott in #​4779
• dep-updates: Go 1.25 and dependency refreshes by @​dustin-decker in #​4888
• Fix nil pointer panics in GitHub analyzer gist/repo binding functions by @​shahzadhaider1 in #​4864
• [INS-399] Added Bitbucket data center(on prem) PAT detector by @​MuneebUllahKhan222 in #​4883
• [INS-402] Add Jira Data Center PAT Detector by @​mustansir14 in #​4872
• Add man page generation for trufflehog by @​bryanbeverly in #​4894
• Add Confluence Data Center PAT detector by @​amanfcp in #​4886

Full Changelog: trufflesecurity/trufflehog@v3.94.3...v3.95.0

v3.94.3

Compare Source

What's Changed

• Add release bot workflow by @​bryanbeverly in #​4835
• handle AADSTS50173 as explicit revocation signal for azure refresh tokens by @​jordanTunstill in #​4842
• Add AnalysisInfo to verified results by @​hxnyk in #​4862
• Add nil check and error context to GitHub analyzer by @​johnelliott in #​4858
• [CSM-1857] Fix expired Azure secrets being silently dropped by @​dipto-truffle in #​4845
• Add HTML decoder for secret detection in HTML-formatted sources by @​alafiand in #​4840
• Split out detector types into separate proto file in order to narrow CODEOWNERS scope by @​casey-tran in #​4871

New Contributors

• @​johnelliott made their first contribution in #​4858
• @​dipto-truffle made their first contribution in #​4845
• @​alafiand made their first contribution in #​4840

Full Changelog: trufflesecurity/trufflehog@v3.94.2...v3.94.3

v3.94.2

Compare Source

What's Changed

• Skip TestAPKHandler by @​shahzadhaider1 in #​4841
• fix: replace release-guard workflow with revert-latest job by @​sysread in #​4838
• Deprecated GoogleAPIKey Detector by @​nabeelalam in #​4853
• todoist: replac

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🚀 Integration Test Results

npm-pr-version action test:

• ✅ Version generation: 0.0.0-PR-80--b734426
• ✅ package.json update: Successful
• ✅ Format validation: Passed

The action is working correctly! 🎉

[github-actions]

🧪 Test Results

✅ All tests passed successfully!

• Linting: ✅ Passed
• Unit tests: ✅ Passed
• Integration tests: ✅ Passed

[github-actions]

❌ PR package publish failed!

Error: ❌ ERROR: OIDC token not available. Add permissions:

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
trufflesecurity/trufflehog	action	minor	v3.94.1 → v3.97.4

---

Release Notes

trufflesecurity/trufflehog (trufflesecurity/trufflehog)

v3.97.4

Compare Source

What's Changed

• Make Transport Errors indeterminate for Twilio secrets and twilioapikeys by @​jordanTunstill in #​5267
• Improve the json-enumerator source by @​bradlarsen in #​5265
• added tests for twilio detector fixes by @​jordanTunstill in #​5271

Full Changelog: trufflesecurity/trufflehog@v3.97.3...v3.97.4

v3.97.3

Compare Source

What's Changed

• fix(s3): cut a child context per object so key/size log values don't pile up by @​mariduv in #​5236
• Revert "[INT-933] De-base64 SourceUnit.UnitData in the GitHub Source" by @​trufflesteeeve in #​5269

Full Changelog: trufflesecurity/trufflehog@v3.97.2...v3.97.3

v3.97.2

Compare Source

What's Changed

• detectors/github/v2: differentiate token type in ExtraData by @​hartsock in #​5223
• Update dependency trufflesecurity/.github to v1.0.4 by @​renovate[bot] in #​5228
• ci: let Renovate bump the golangci-lint pin in scripts/lint.sh by @​bryanbeverly in #​5231
• Update github.com/trufflesecurity/ldap-verify digest to aa52b46 by @​renovate[bot] in #​5172
• Update github-actions by @​renovate[bot] in #​5197
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​5173
• Update module github.com/aws/smithy-go to v1.27.9 by @​renovate[bot] in #​5174
• [SCAN-18] Add SOURCE_TYPE_AWS_SECRETS_MANAGER source type by @​dipto-truffle in #​5234
• [INS-377] Add V2 for weights and biases detector by @​mustansir14 in #​4951
• Fix PagerDuty detector: treat 403 and 402 as verified credentials by @​unsmith in #​5230
• [INT-933] De-base64 SourceUnit.UnitData in the GitHub Source by @​camgunz in #​5248
• Implement Enumerate for the Jenkins source by @​Ahsan-Sarbaz in #​5229
• Update link to Truffle Security documentation by @​shahzadhaider1 in #​5256
• Retry git clone on secondary rate limit (bare 403/429) by @​kashifkhan0771 in #​5260

New Contributors

• @​hartsock made their first contribution in #​5223

Full Changelog: trufflesecurity/trufflehog@v3.97.1...v3.97.2

v3.97.1

Compare Source

What's Changed

• Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] by @​renovate[bot] in #​5196
• Fix GHEC with Data Residency (*.ghe.com) base URL by @​shahzadhaider1 in #​4777
• docs: add generic config-secret custom detector example by @​pgmpofu in #​5195
• fix(detectors/docker): don't greedy match in keyPat by @​mariduv in #​5214
• [SCAN-1020] neon scram pgx by @​alafiand in #​5217
• Raised MongoDB detector timeout value by @​jordanTunstill in #​5222
• preallocate bindings capacity in dockerhub and groq, with unit tests by @​jordanTunstill in #​5213
• [SCAN-101] S3 Source accept persisted unit envelopes in UnmarshalSourceUnit by @​amanfcp in #​5224
• Refine SECURITY.md by @​bradlarsen in #​5216
• Carry GitHub App installation ID on repo units by @​bill-rich in #​5215

New Contributors

• @​pgmpofu made their first contribution in #​5195

Full Changelog: trufflesecurity/trufflehog@v3.97.0...v3.97.1

v3.97.0

Compare Source

What's Changed

• fix(detectors/privatekey): report encrypted keys with uncrackable passphrases by @​genisis0x in #​5127
• Update module go.mongodb.org/mongo-driver to v1.17.7 [SECURITY] by @​renovate[bot] in #​5058
• Remove url tag from common HTTP client metrics by @​mcastorina in #​5158
• Update github.com/avast/apkparser digest to 7fcaee4 by @​renovate[bot] in #​5037
• [INS-318] Add New Relic License Key Detector by @​mustansir14 in #​4760
• [INS-348] Add New Relic Browser Key detector by @​mustansir14 in #​4769
• [INS-339] Add New Relic User Key detector by @​mustansir14 in #​4794
• [INS-345] Add New Relic Insights Query Key detector by @​mustansir14 in #​4781
• fix(sources): stop UnitHook Close racing in-flight Finish sends by @​bill-rich in #​5154
• There are now 3 CircleCI projects by @​trufflesteeeve in #​5166
• Update github.com/shurcooL/githubv4 digest to 2402fdf by @​renovate[bot] in #​5038
• Update github-actions by @​renovate[bot] in #​5036
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​4890
• [INS-344] Add New Relic Mobile App Token Detector by @​mustansir14 in #​4810
• Give each clone its own directory under --clone-path by @​shahzadhaider1 in #​5175
• feat(output): add SARIF output format for GitHub code scanning by @​kashifkhan0771 in #​5165
• [SCAN-1018] Treat SlackWebhook invalid_token (HTTP 400) as determinate not-live by @​alafiand in #​5177
• make cwd-changing normalization tests non-parallel to fix flaky clone failures by @​jordanTunstill in #​5178
• [INS-456] Add Microsoft Teams Webhook V2 detector by @​mustansir14 in #​4902
• surface git clone errors at v(0) by @​jordanTunstill in #​5162
• Add Figma Personal Access Token v3 Detector by @​shahzadhaider1 in #​4790
• fix(github): fallback resource Name to avoid empty-string proto validation failure by @​kashifkhan0771 in #​5182
• [INT-643] Update Protos definition to cater bitbucket Api token authentication by @​MuneebUllahKhan222 in #​5171
• Update regex pattern and 403 handling in the Lob detector to fix false positives by @​MachiavelliII in #​5188
• Deprecate AppOptics detector by @​Ahsan-Sarbaz in #​5198
• Anthropic detector: surface API error detail on non-2xx verification by @​Ahsan-Sarbaz in #​5180
• Deprecated bingsubscriptionkey detector by @​Ahsan-Sarbaz in #​5179
• Add SolarWinds Observability detector by @​Ahsan-Sarbaz in #​5199
• fix(jiratoken): stop 202 reverification retry loop by @​Ahsan-Sarbaz in #​5200
• Add custom endpoint support to the S3 source by @​shahzadhaider1 in #​5202
• fix(blogger): anchor regex to AIzaSy prefix to eliminate false positives by @​unsmith in #​5203
• fix(huggingface): move unscoped fine-grained models to UnboundedResources by @​unsmith in #​5204
• Add AWS Secrets Manager metadata type by @​rosecodym in #​5210
• fix(detectors/harness): allow underscore in PAT account segment by @​mattbrady-1 in #​5153

New Contributors

• @​MachiavelliII made their first contribution in #​5188
• @​Ahsan-Sarbaz made their first contribution in #​5198
• @​unsmith made their first contribution in #​5203

Full Changelog: trufflesecurity/trufflehog@v3.96.0...v3.97.0

v3.96.0

Compare Source

What's Changed

• [INS-355] Added Hashicorp vault token detector by @​MuneebUllahKhan222 in #​4819
• Tighten JiraToken v1 verification by @​shahzadhaider1 in #​5122
• [INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @​bill-rich in #​5123
• Fix GitLab project metadata cache and switch to LRU by @​kashifkhan0771 in #​4727
• Log analyze errors for Anthropic Analyzer by @​kashifkhan0771 in #​5120
• Add metrics for chunks and results by @​mcastorina in #​5128
• Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @​kashifkhan0771 in #​5111
• [INS-312] Duo API Secret Key Detector by @​MuneebUllahKhan222 in #​4771
• [Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by @​nabeelalam in #​4739
• [INS-255] Updated datadog detector to set verificationError in case of a verification error by @​MuneebUllahKhan222 in #​4661
• Log analyze errors for Postgres analyzer by @​kashifkhan0771 in #​5131
• Log analyze errors for HuggingFace analyzer by @​kashifkhan0771 in #​5130
• Engine - Config.SourceManager doc by @​amanfcp in #​5002
• Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @​renovate[bot] in #​5034
• Retry git clone on transient network errors by @​shahzadhaider1 in #​5132
• Fix scan_all_installations Rejecting Org Member Personal Repos by @​shahzadhaider1 in #​5142
• updated detector to include underscore char by @​mattbrady-1 in #​5121
• [chore] Change job_id in metric to source_type by @​mcastorina in #​5149
• Posthog regex update by @​mattbrady-1 in #​5133
• fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @​johannestaas-trufflesec in #​5151

New Contributors

• @​mattbrady-1 made their first contribution in #​5121

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

v3.95.9

Compare Source

What's Changed

• feat: add OpenRouter detector by @​McPatate in #​4500
• Integrations fully codeowns detectors by @​trufflesteeeve in #​5104
• [INS-332] Add New Relic Insights Insert key detector by @​mustansir14 in #​4778
• [INS-351] Added Duffel Token Detector by @​MuneebUllahKhan222 in #​4795
• [INS-341] Added Shippo detector by @​MuneebUllahKhan222 in #​4820
• [INS-467] Add IPinfo detector to default detectors list by @​mustansir14 in #​4970
• fix: reject --include-repos/--exclude-repos with --repo in github scan by @​kashifkhan0771 in #​5112
• [INS-468] Add improved lob detector to defaults.go by @​mustansir14 in #​4971
• feat(action): add image input to allow registry mirror overrides by @​eightseventhreethree in #​4965
• feat: Support archived repo exclusion from GH org scans by @​hibare in #​4875
• [INT-715] Retry transient failures when verifying OpenAI keys by @​bill-rich in #​5117
• [INS-410] Added batch token detector by @​MuneebUllahKhan222 in #​4824
• [INT-650] Don't log as error when git diff is too long by @​bill-rich in #​5113

New Contributors

• @​McPatate made their first contribution in #​4500
• @​eightseventhreethree made their first contribution in #​4965

Full Changelog: trufflesecurity/trufflehog@v3.95.8...v3.95.9

v3.95.8

Compare Source

What's Changed

• removed "unauthorized" as exception for rotated graphana secrets by @​jordanTunstill in #​5068
• fix(azuresastoken): match SAS tokens regardless of parameter order by @​genisis0x in #​5043
• Add prometheus metrics for engine channels and workers by @​mcastorina in #​5095
• [INS-465] Skip unverified JWT Detector results when feature flag is enabled by @​MuneebUllahKhan222 in #​5072
• [INS-334] Octopus Deploy detector by @​MuneebUllahKhan222 in #​4787
• Fix Syntax error in feature.go by @​MuneebUllahKhan222 in #​5109
• Include encoded resume info instead of clobbering it by @​bill-rich in #​5110

Full Changelog: trufflesecurity/trufflehog@v3.95.7...v3.95.8

v3.95.7

Compare Source

What's Changed

• fix(sources/filesystem): order resume comparison by path component by @​genisis0x in #​5041
• test(handlers): point APK test fixture at trufflehog-test-assets by @​amanfcp in #​5053
• fixed regex typo that was causing conf uuid's to be surfaced as non-live atlassian secrets. by @​jordanTunstill in #​5029
• Fix GitHub App cross-org member enumeration using per-installation tokens by @​dustin-decker in #​4774
• fix: add git worktree support in PrepareRepo by @​andoniaf in #​4690
• [INS-406] Braintrust detector by @​MuneebUllahKhan222 in #​4826
• huggingface: add bucket scanning by @​julien-c in #​5017
• Skip reverification results during deduplication by @​mcastorina in #​5069
• chore(renovate): bump shared config to v1.0.3 by @​bryanbeverly in #​5044
• Add scan_all_installations option for multi-org GitHub App scanning by @​dustin-decker in #​4775
• Expose SecretParts in the JSON output by @​bradlarsen in #​5073
• [INS-497] Add Pganalyze Read Key Detector by @​MuneebUllahKhan222 in #​4993
• [INS-197] Add redhatpyxis api key detector by @​MuneebUllahKhan222 in #​4995
• [INS-407] Fixed AWS detector producing non deterministic output by @​MuneebUllahKhan222 in #​4836

New Contributors

• @​genisis0x made their first contribution in #​5041
• @​andoniaf made their first contribution in #​4690
• @​julien-c made their first contribution in #​5017

Full Changelog: trufflesecurity/trufflehog@v3.95.6...v3.95.7

v3.95.6

Compare Source

What's Changed

• Enigma detector enhance verification to prevent false verified findings by @​shahzadhaider1 in #​5011
• fix: scan files with lines exceeding bufio's default 64 KB token limit by @​MuneebUllahKhan222 in #​5022
• fix(postgres): honor ignore tags for default port URLs by @​Dawn-Fighter in #​4968
• Move to github.com/moby/moby/client from docker/docker by @​trufflesteeeve in #​4987
• fix: avoid terminal probes before CLI output by @​Hackerchen716 in #​4994
• Update test containers dependency by @​trufflesteeeve in #​4978
• Re-host pkg/handlers JSON test fixtures under the org by @​amanfcp in #​5023
• [INS-465] Add datadogapikey detector to defaults.go by @​mustansir14 in #​4969
• [INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic by @​MuneebUllahKhan222 in #​5006
• [INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic by @​MuneebUllahKhan222 in #​5008
• Updating Klaviyo PK new format by @​breetan in #​5009
• Restructure Klaviyo detector pattern tests by @​martinlocklear in #​5026
• Replace Renovate config with shared preset (high-risk tier) by @​bryanbeverly in #​4992
• set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it by @​jordanTunstill in #​5027
• GitHub finegrained analyzer was improperly handling errors by @​dustin-decker in #​4498
• [INS-469] Added Rev detectors to defaults.go and gated it behind feature flag by @​MuneebUllahKhan222 in #​5005
• Fix Renovate lookup: update setup-captain version comment by @​bryanbeverly in #​4999
• [INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration by @​MuneebUllahKhan222 in #​5007
• Fix: Resolve known dedup issues in notifierWorker by @​MuneebUllahKhan222 in #​5028
• fix(dropbox): prevent long sl.u. tokens from being truncated by @​lukem-ts in #​5012
• fix: add filetype=sdist param to pypi detector by @​lukem-ts in #​4988
• Handlers - Embed small HTTP test fixtures by @​amanfcp in #​5001
• S3: surface bucket listing failures and fix multi-role object count by @​shahzadhaider1 in #​5035

New Contributors

• @​Dawn-Fighter made their first contribution in #​4968
• @​Hackerchen716 made their first contribution in #​4994
• @​breetan made their first contribution in #​5009
• @​lukem-ts made their first contribution in #​5012

Full Changelog: trufflesecurity/trufflehog@v3.95.4...v3.95.6

v3.95.5

Compare Source

What's Changed

• [INS-461] Add test to ensure new detectors are registered in defaults.go by @​mustansir14 in #​4915
• [INS-455] Unify common logic in Atlassian Data Center detectors by @​mustansir14 in #​4907
• fix(github): cache repo info under original URL on redirect by @​kashifkhan0771 in #​4958
• Added GitLab OAuth Detector by @​shahzadhaider1 in #​4729
• Box Detector: Extract Subject ID for Analyzer Integration by @​shahzadhaider1 in #​4761
• [INS-346] SpectralOps Personal API Key Detector by @​MuneebUllahKhan222 in #​4770
• [INS-335] Added AWS Appsync Detector by @​MuneebUllahKhan222 in #​4803
• fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @​kashifkhan0771 in #​4954
• Automate corpora testing in CI by @​mustansir14 in #​4927
• Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @​amanfcp in #​4924
• feat: add host, db and username to ExtraData for database detectors by @​mariocj89 in #​4849
• Remove over speculation from Corpora CI workflow by @​mustansir14 in #​4974
• Fix line numbers for duplicate secrets within a chunk by @​amanfcp in #​4910
• Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @​camgunz in #​4961
• Update Go security dependencies by @​cursor[bot] in #​4986
• Pin GitHub Actions to SHA digests by @​bryanbeverly in #​4985
• Update CODEOWNERS: replace 5 slugs with scanning + integrations by @​bryanbeverly in #​4983
• Added source config flags to sharepoint proto by @​MuneebUllahKhan222 in #​4972
• [SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @​mustansir14 in #​4981
• adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @​johannestaas-trufflesec in #​4991

New Contributors

• @​mariocj89 made their first contribution in #​4849
• @​cursor[bot] made their first contribution in #​4986
• @​johannestaas-trufflesec made their first contribution in #​4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.5

v3.95.4

Compare Source

What's Changed

• [INS-461] Add test to ensure new detectors are registered in defaults.go by @​mustansir14 in #​4915
• [INS-455] Unify common logic in Atlassian Data Center detectors by @​mustansir14 in #​4907
• fix(github): cache repo info under original URL on redirect by @​kashifkhan0771 in #​4958
• Added GitLab OAuth Detector by @​shahzadhaider1 in #​4729
• Box Detector: Extract Subject ID for Analyzer Integration by @​shahzadhaider1 in #​4761
• [INS-346] SpectralOps Personal API Key Detector by @​MuneebUllahKhan222 in #​4770
• [INS-335] Added AWS Appsync Detector by @​MuneebUllahKhan222 in #​4803
• fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @​kashifkhan0771 in #​4954
• Automate corpora testing in CI by @​mustansir14 in #​4927
• Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @​amanfcp in #​4924
• feat: add host, db and username to ExtraData for database detectors by @​mariocj89 in #​4849
• Remove over speculation from Corpora CI workflow by @​mustansir14 in #​4974
• Fix line numbers for duplicate secrets within a chunk by @​amanfcp in #​4910
• Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @​camgunz in #​4961
• Update Go security dependencies by @​cursor[bot] in #​4986
• Pin GitHub Actions to SHA digests by @​bryanbeverly in #​4985
• Update CODEOWNERS: replace 5 slugs with scanning + integrations by @​bryanbeverly in #​4983
• Added source config flags to sharepoint proto by @​MuneebUllahKhan222 in #​4972
• [SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @​mustansir14 in #​4981
• adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @​johannestaas-trufflesec in #​4991

New Contributors

• @​mariocj89 made their first contribution in #​4849
• @​cursor[bot] made their first contribution in #​4986
• @​johannestaas-trufflesec made their first contribution in #​4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.4

v3.95.3

Compare Source

What's Changed

• Renamed AnypointOAuth2 detector's AnalysisInfo keys to make it consistent with its Analyzer by @​MuneebUllahKhan222 in #​4906
• Rename AnalysisInfo field to SecretParts on detectors.Result by @​mcastorina in #​4911
• Document SecretParts contract in detector-authoring docs by @​mcastorina in #​4912
• Add a static check for detectors that don't set SecretParts by @​mcastorina in #​4913
• Populate SecretParts on all detectors by @​mcastorina in #​4919
• Make checksecretparts required in CI by @​mcastorina in #​4921
• Deduplicate concurrent credential verification requests via singleflight by @​kashifkhan0771 in #​4314
• log non-critical chunk errors at V(2).Info instead of Error by @​johnelliott in #​4928
• [INS-320] Cloudinary detector by @​MuneebUllahKhan222 in #​4747
• ci: bump JS actions to Node 24 majors (incl. CodeQL v4 + WIF auth v3) by @​bryanbeverly in #​4933
• chore: bump golangci-lint-action v7 → v9 (Node 24) by @​bryanbeverly in #​4936
• Add default Content-Type: application/json header for custom detector verification request by @​MuneebUllahKhan222 in #​4947
• Make detector Result.SecretParts initialization stricter by @​mcastorina in #​4948
• Add Pinecone API key detector by @​dylanTruffle in #​4917
• adding customizable successRanges and rotatedRanges to customDetector by @​jordanTunstill in #​4892

Full Changelog: trufflesecurity/trufflehog@v3.95.2...v3.95.3

v3.95.2

Compare Source

What's Changed

• Revert "[INS-397] Fix git version parser panic on non-numeric patch versions" by @​trufflesteeeve in #​4903

Full Changelog: trufflesecurity/trufflehog@v3.95.1...v3.95.2

v3.95.1

Compare Source

What's Changed

• [INS-444] Fix verification logic in Mesibo detector by @​mustansir14 in #​4884

Full Changelog: trufflesecurity/trufflehog@v3.95.0...v3.95.1

v3.95.0

Compare Source

What's Changed

• Upgrade golangci-lint in CI runner and Makefile by @​amanfcp in #​4861
• Deprecate SquareUp Detector by @​nabeelalam in #​4855
• [INS-397] Fix git version parser panic on non-numeric patch versions by @​shahzadhaider1 in #​4882
• Fix Bitbucket line highlighting URLs by @​shahzadhaider1 in #​4854
• [INS-403] Support Custom endpoint config in hashicorpvaultauth Detector by @​MuneebUllahKhan222 in #​4825
• [INS-398] Added tests to ensure that custom endpoint configuration works in artifactory detectors by @​MuneebUllahKhan222 in #​4832
• Host ldap-verify library in trufflesecurity by @​trufflesteeeve in #​4859
• Add AnalysisError type and wrap all analyzer error paths by @​johnelliott in #​4779
• dep-updates: Go 1.25 and dependency refreshes by @​dustin-decker in #​4888
• Fix nil pointer panics in GitHub analyzer gist/repo binding functions by @​shahzadhaider1 in #​4864
• [INS-399] Added Bitbucket data center(on prem) PAT detector by @​MuneebUllahKhan222 in #​4883
• [INS-402] Add Jira Data Center PAT Detector by @​mustansir14 in #​4872
• Add man page generation for trufflehog by @​bryanbeverly in #​4894
• Add Confluence Data Center PAT detector by @​amanfcp in #​4886

Full Changelog: trufflesecurity/trufflehog@v3.94.3...v3.95.0

v3.94.3

Compare Source

What's Changed

• Add release bot workflow by @​bryanbeverly in #​4835
• handle AADSTS50173 as explicit revocation signal for azure refresh tokens by @​jordanTunstill in #​4842
• Add AnalysisInfo to verified results by @​hxnyk in #​4862
• Add nil check and error context to GitHub analyzer by @​johnelliott in #​4858
• [CSM-1857] Fix expired Azure secrets being silently dropped by @​dipto-truffle in #​4845
• Add HTML decoder for secret detection in HTML-formatted sources by @​alafiand in #​4840
• Split out detector types into separate proto file in order to narrow CODEOWNERS scope by @​casey-tran in #​4871

New Contributors

• @​johnelliott made their first contribution in #​4858
• @​dipto-truffle made their first contribution in #​4845
• @​alafiand made their first contribution in #​4840

Full Changelog: trufflesecurity/trufflehog@v3.94.2...v3.94.3

v3.94.2

Compare Source

What's Changed

• Skip TestAPKHandler by @​shahzadhaider1 in #​4841
• fix: replace release-guard workflow with revert-latest job by @​sysread in #​4838
• Deprecated GoogleAPIKey Detector by @​nabeelalam in #​4853
• todoist: replac

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🚀 Integration Test Results

npm-pr-version action test:

• ✅ Version generation: 0.0.0-PR-80--b734426
• ✅ package.json update: Successful
• ✅ Format validation: Passed

The action is working correctly! 🎉

[github-actions]

🧪 Test Results

✅ All tests passed successfully!

• Linting: ✅ Passed
• Unit tests: ✅ Passed
• Integration tests: ✅ Passed

[github-actions]

❌ PR package publish failed!

Error: ❌ ERROR: OIDC token not available. Add permissions:

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
trufflesecurity/trufflehog	action	minor	v3.94.1 → v3.97.4

---

Release Notes

trufflesecurity/trufflehog (trufflesecurity/trufflehog)

v3.97.4

Compare Source

What's Changed

• Make Transport Errors indeterminate for Twilio secrets and twilioapikeys by @​jordanTunstill in #​5267
• Improve the json-enumerator source by @​bradlarsen in #​5265
• added tests for twilio detector fixes by @​jordanTunstill in #​5271

Full Changelog: trufflesecurity/trufflehog@v3.97.3...v3.97.4

v3.97.3

Compare Source

What's Changed

• fix(s3): cut a child context per object so key/size log values don't pile up by @​mariduv in #​5236
• Revert "[INT-933] De-base64 SourceUnit.UnitData in the GitHub Source" by @​trufflesteeeve in #​5269

Full Changelog: trufflesecurity/trufflehog@v3.97.2...v3.97.3

v3.97.2

Compare Source

What's Changed

• detectors/github/v2: differentiate token type in ExtraData by @​hartsock in #​5223
• Update dependency trufflesecurity/.github to v1.0.4 by @​renovate[bot] in #​5228
• ci: let Renovate bump the golangci-lint pin in scripts/lint.sh by @​bryanbeverly in #​5231
• Update github.com/trufflesecurity/ldap-verify digest to aa52b46 by @​renovate[bot] in #​5172
• Update github-actions by @​renovate[bot] in #​5197
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​5173
• Update module github.com/aws/smithy-go to v1.27.9 by @​renovate[bot] in #​5174
• [SCAN-18] Add SOURCE_TYPE_AWS_SECRETS_MANAGER source type by @​dipto-truffle in #​5234
• [INS-377] Add V2 for weights and biases detector by @​mustansir14 in #​4951
• Fix PagerDuty detector: treat 403 and 402 as verified credentials by @​unsmith in #​5230
• [INT-933] De-base64 SourceUnit.UnitData in the GitHub Source by @​camgunz in #​5248
• Implement Enumerate for the Jenkins source by @​Ahsan-Sarbaz in #​5229
• Update link to Truffle Security documentation by @​shahzadhaider1 in #​5256
• Retry git clone on secondary rate limit (bare 403/429) by @​kashifkhan0771 in #​5260

New Contributors

• @​hartsock made their first contribution in #​5223

Full Changelog: trufflesecurity/trufflehog@v3.97.1...v3.97.2

v3.97.1

Compare Source

What's Changed

• Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] by @​renovate[bot] in #​5196
• Fix GHEC with Data Residency (*.ghe.com) base URL by @​shahzadhaider1 in #​4777
• docs: add generic config-secret custom detector example by @​pgmpofu in #​5195
• fix(detectors/docker): don't greedy match in keyPat by @​mariduv in #​5214
• [SCAN-1020] neon scram pgx by @​alafiand in #​5217
• Raised MongoDB detector timeout value by @​jordanTunstill in #​5222
• preallocate bindings capacity in dockerhub and groq, with unit tests by @​jordanTunstill in #​5213
• [SCAN-101] S3 Source accept persisted unit envelopes in UnmarshalSourceUnit by @​amanfcp in #​5224
• Refine SECURITY.md by @​bradlarsen in #​5216
• Carry GitHub App installation ID on repo units by @​bill-rich in #​5215

New Contributors

• @​pgmpofu made their first contribution in #​5195

Full Changelog: trufflesecurity/trufflehog@v3.97.0...v3.97.1

v3.97.0

Compare Source

What's Changed

• fix(detectors/privatekey): report encrypted keys with uncrackable passphrases by @​genisis0x in #​5127
• Update module go.mongodb.org/mongo-driver to v1.17.7 [SECURITY] by @​renovate[bot] in #​5058
• Remove url tag from common HTTP client metrics by @​mcastorina in #​5158
• Update github.com/avast/apkparser digest to 7fcaee4 by @​renovate[bot] in #​5037
• [INS-318] Add New Relic License Key Detector by @​mustansir14 in #​4760
• [INS-348] Add New Relic Browser Key detector by @​mustansir14 in #​4769
• [INS-339] Add New Relic User Key detector by @​mustansir14 in #​4794
• [INS-345] Add New Relic Insights Query Key detector by @​mustansir14 in #​4781
• fix(sources): stop UnitHook Close racing in-flight Finish sends by @​bill-rich in #​5154
• There are now 3 CircleCI projects by @​trufflesteeeve in #​5166
• Update github.com/shurcooL/githubv4 digest to 2402fdf by @​renovate[bot] in #​5038
• Update github-actions by @​renovate[bot] in #​5036
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​4890
• [INS-344] Add New Relic Mobile App Token Detector by @​mustansir14 in #​4810
• Give each clone its own directory under --clone-path by @​shahzadhaider1 in #​5175
• feat(output): add SARIF output format for GitHub code scanning by @​kashifkhan0771 in #​5165
• [SCAN-1018] Treat SlackWebhook invalid_token (HTTP 400) as determinate not-live by @​alafiand in #​5177
• make cwd-changing normalization tests non-parallel to fix flaky clone failures by @​jordanTunstill in #​5178
• [INS-456] Add Microsoft Teams Webhook V2 detector by @​mustansir14 in #​4902
• surface git clone errors at v(0) by @​jordanTunstill in #​5162
• Add Figma Personal Access Token v3 Detector by @​shahzadhaider1 in #​4790
• fix(github): fallback resource Name to avoid empty-string proto validation failure by @​kashifkhan0771 in #​5182
• [INT-643] Update Protos definition to cater bitbucket Api token authentication by @​MuneebUllahKhan222 in #​5171
• Update regex pattern and 403 handling in the Lob detector to fix false positives by @​MachiavelliII in #​5188
• Deprecate AppOptics detector by @​Ahsan-Sarbaz in #​5198
• Anthropic detector: surface API error detail on non-2xx verification by @​Ahsan-Sarbaz in #​5180
• Deprecated bingsubscriptionkey detector by @​Ahsan-Sarbaz in #​5179
• Add SolarWinds Observability detector by @​Ahsan-Sarbaz in #​5199
• fix(jiratoken): stop 202 reverification retry loop by @​Ahsan-Sarbaz in #​5200
• Add custom endpoint support to the S3 source by @​shahzadhaider1 in #​5202
• fix(blogger): anchor regex to AIzaSy prefix to eliminate false positives by @​unsmith in #​5203
• fix(huggingface): move unscoped fine-grained models to UnboundedResources by @​unsmith in #​5204
• Add AWS Secrets Manager metadata type by @​rosecodym in #​5210
• fix(detectors/harness): allow underscore in PAT account segment by @​mattbrady-1 in #​5153

New Contributors

• @​MachiavelliII made their first contribution in #​5188
• @​Ahsan-Sarbaz made their first contribution in #​5198
• @​unsmith made their first contribution in #​5203

Full Changelog: trufflesecurity/trufflehog@v3.96.0...v3.97.0

v3.96.0

Compare Source

What's Changed

• [INS-355] Added Hashicorp vault token detector by @​MuneebUllahKhan222 in #​4819
• Tighten JiraToken v1 verification by @​shahzadhaider1 in #​5122
• [INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @​bill-rich in #​5123
• Fix GitLab project metadata cache and switch to LRU by @​kashifkhan0771 in #​4727
• Log analyze errors for Anthropic Analyzer by @​kashifkhan0771 in #​5120
• Add metrics for chunks and results by @​mcastorina in #​5128
• Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @​kashifkhan0771 in #​5111
• [INS-312] Duo API Secret Key Detector by @​MuneebUllahKhan222 in #​4771
• [Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by @​nabeelalam in #​4739
• [INS-255] Updated datadog detector to set verificationError in case of a verification error by @​MuneebUllahKhan222 in #​4661
• Log analyze errors for Postgres analyzer by @​kashifkhan0771 in #​5131
• Log analyze errors for HuggingFace analyzer by @​kashifkhan0771 in #​5130
• Engine - Config.SourceManager doc by @​amanfcp in #​5002
• Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @​renovate[bot] in #​5034
• Retry git clone on transient network errors by @​shahzadhaider1 in #​5132
• Fix scan_all_installations Rejecting Org Member Personal Repos by @​shahzadhaider1 in #​5142
• updated detector to include underscore char by @​mattbrady-1 in #​5121
• [chore] Change job_id in metric to source_type by @​mcastorina in #​5149
• Posthog regex update by @​mattbrady-1 in #​5133
• fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @​johannestaas-trufflesec in #​5151

New Contributors

• @​mattbrady-1 made their first contribution in #​5121

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

v3.95.9

Compare Source

What's Changed

• feat: add OpenRouter detector by @​McPatate in #​4500
• Integrations fully codeowns detectors by @​trufflesteeeve in #​5104
• [INS-332] Add New Relic Insights Insert key detector by @​mustansir14 in #​4778
• [INS-351] Added Duffel Token Detector by @​MuneebUllahKhan222 in #​4795
• [INS-341] Added Shippo detector by @​MuneebUllahKhan222 in #​4820
• [INS-467] Add IPinfo detector to default detectors list by @​mustansir14 in #​4970
• fix: reject --include-repos/--exclude-repos with --repo in github scan by @​kashifkhan0771 in #​5112
• [INS-468] Add improved lob detector to defaults.go by @​mustansir14 in #​4971
• feat(action): add image input to allow registry mirror overrides by @​eightseventhreethree in #​4965
• feat: Support archived repo exclusion from GH org scans by @​hibare in #​4875
• [INT-715] Retry transient failures when verifying OpenAI keys by @​bill-rich in #​5117
• [INS-410] Added batch token detector by @​MuneebUllahKhan222 in #​4824
• [INT-650] Don't log as error when git diff is too long by @​bill-rich in #​5113

New Contributors

• @​McPatate made their first contribution in #​4500
• @​eightseventhreethree made their first contribution in #​4965

Full Changelog: trufflesecurity/trufflehog@v3.95.8...v3.95.9

v3.95.8

Compare Source

What's Changed

• removed "unauthorized" as exception for rotated graphana secrets by @​jordanTunstill in #​5068
• fix(azuresastoken): match SAS tokens regardless of parameter order by @​genisis0x in #​5043
• Add prometheus metrics for engine channels and workers by @​mcastorina in #​5095
• [INS-465] Skip unverified JWT Detector results when feature flag is enabled by @​MuneebUllahKhan222 in #​5072
• [INS-334] Octopus Deploy detector by @​MuneebUllahKhan222 in #​4787
• Fix Syntax error in feature.go by @​MuneebUllahKhan222 in #​5109
• Include encoded resume info instead of clobbering it by @​bill-rich in #​5110

Full Changelog: trufflesecurity/trufflehog@v3.95.7...v3.95.8

v3.95.7

Compare Source

What's Changed

• fix(sources/filesystem): order resume comparison by path component by @​genisis0x in #​5041
• test(handlers): point APK test fixture at trufflehog-test-assets by @​amanfcp in #​5053
• fixed regex typo that was causing conf uuid's to be surfaced as non-live atlassian secrets. by @​jordanTunstill in #​5029
• Fix GitHub App cross-org member enumeration using per-installation tokens by @​dustin-decker in #​4774
• fix: add git worktree support in PrepareRepo by @​andoniaf in #​4690
• [INS-406] Braintrust detector by @​MuneebUllahKhan222 in #​4826
• huggingface: add bucket scanning by @​julien-c in #​5017
• Skip reverification results during deduplication by @​mcastorina in #​5069
• chore(renovate): bump shared config to v1.0.3 by @​bryanbeverly in #​5044
• Add scan_all_installations option for multi-org GitHub App scanning by @​dustin-decker in #​4775
• Expose SecretParts in the JSON output by @​bradlarsen in #​5073
• [INS-497] Add Pganalyze Read Key Detector by @​MuneebUllahKhan222 in #​4993
• [INS-197] Add redhatpyxis api key detector by @​MuneebUllahKhan222 in #​4995
• [INS-407] Fixed AWS detector producing non deterministic output by @​MuneebUllahKhan222 in #​4836

New Contributors

• @​genisis0x made their first contribution in #​5041
• @​andoniaf made their first contribution in #​4690
• @​julien-c made their first contribution in #​5017

Full Changelog: trufflesecurity/trufflehog@v3.95.6...v3.95.7

v3.95.6

Compare Source

What's Changed

• Enigma detector enhance verification to prevent false verified findings by @​shahzadhaider1 in #​5011
• fix: scan files with lines exceeding bufio's default 64 KB token limit by @​MuneebUllahKhan222 in #​5022
• fix(postgres): honor ignore tags for default port URLs by @​Dawn-Fighter in #​4968
• Move to github.com/moby/moby/client from docker/docker by @​trufflesteeeve in #​4987
• fix: avoid terminal probes before CLI output by @​Hackerchen716 in #​4994
• Update test containers dependency by @​trufflesteeeve in #​4978
• Re-host pkg/handlers JSON test fixtures under the org by @​amanfcp in #​5023
• [INS-465] Add datadogapikey detector to defaults.go by @​mustansir14 in #​4969
• [INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic by @​MuneebUllahKhan222 in #​5006
• [INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic by @​MuneebUllahKhan222 in #​5008
• Updating Klaviyo PK new format by @​breetan in #​5009
• Restructure Klaviyo detector pattern tests by @​martinlocklear in #​5026
• Replace Renovate config with shared preset (high-risk tier) by @​bryanbeverly in #​4992
• set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it by @​jordanTunstill in #​5027
• GitHub finegrained analyzer was improperly handling errors by @​dustin-decker in #​4498
• [INS-469] Added Rev detectors to defaults.go and gated it behind feature flag by @​MuneebUllahKhan222 in #​5005
• Fix Renovate lookup: update setup-captain version comment by @​bryanbeverly in #​4999
• [INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration by @​MuneebUllahKhan222 in #​5007
• Fix: Resolve known dedup issues in notifierWorker by @​MuneebUllahKhan222 in #​5028
• fix(dropbox): prevent long sl.u. tokens from being truncated by @​lukem-ts in #​5012
• fix: add filetype=sdist param to pypi detector by @​lukem-ts in #​4988
• Handlers - Embed small HTTP test fixtures by @​amanfcp in #​5001
• S3: surface bucket listing failures and fix multi-role object count by @​shahzadhaider1 in #​5035

New Contributors

• @​Dawn-Fighter made their first contribution in #​4968
• @​Hackerchen716 made their first contribution in #​4994
• @​breetan made their first contribution in #​5009
• @​lukem-ts made their first contribution in #​5012

Full Changelog: trufflesecurity/trufflehog@v3.95.4...v3.95.6

v3.95.5

Compare Source

What's Changed

• [INS-461] Add test to ensure new detectors are registered in defaults.go by @​mustansir14 in #​4915
• [INS-455] Unify common logic in Atlassian Data Center detectors by @​mustansir14 in #​4907
• fix(github): cache repo info under original URL on redirect by @​kashifkhan0771 in #​4958
• Added GitLab OAuth Detector by @​shahzadhaider1 in #​4729
• Box Detector: Extract Subject ID for Analyzer Integration by @​shahzadhaider1 in #​4761
• [INS-346] SpectralOps Personal API Key Detector by @​MuneebUllahKhan222 in #​4770
• [INS-335] Added AWS Appsync Detector by @​MuneebUllahKhan222 in #​4803
• fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @​kashifkhan0771 in #​4954
• Automate corpora testing in CI by @​mustansir14 in #​4927
• Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @​amanfcp in #​4924
• feat: add host, db and username to ExtraData for database detectors by @​mariocj89 in #​4849
• Remove over speculation from Corpora CI workflow by @​mustansir14 in #​4974
• Fix line numbers for duplicate secrets within a chunk by @​amanfcp in #​4910
• Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @​camgunz in #​4961
• Update Go security dependencies by @​cursor[bot] in #​4986
• Pin GitHub Actions to SHA digests by @​bryanbeverly in #​4985
• Update CODEOWNERS: replace 5 slugs with scanning + integrations by @​bryanbeverly in #​4983
• Added source config flags to sharepoint proto by @​MuneebUllahKhan222 in #​4972
• [SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @​mustansir14 in #​4981
• adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @​johannestaas-trufflesec in #​4991

New Contributors

• @​mariocj89 made their first contribution in #​4849
• @​cursor[bot] made their first contribution in #​4986
• @​johannestaas-trufflesec made their first contribution in #​4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.5

v3.95.4

Compare Source

What's Changed

• [INS-461] Add test to ensure new detectors are registered in defaults.go by @​mustansir14 in #​4915
• [INS-455] Unify common logic in Atlassian Data Center detectors by @​mustansir14 in #​4907
• fix(github): cache repo info under original URL on redirect by @​kashifkhan0771 in #​4958
• Added GitLab OAuth Detector by @​shahzadhaider1 in #​4729
• Box Detector: Extract Subject ID for Analyzer Integration by @​shahzadhaider1 in #​4761
• [INS-346] SpectralOps Personal API Key Detector by @​MuneebUllahKhan222 in #​4770
• [INS-335] Added AWS Appsync Detector by @​MuneebUllahKhan222 in #​4803
• fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @​kashifkhan0771 in #​4954
• Automate corpora testing in CI by @​mustansir14 in #​4927
• Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @​amanfcp in #​4924
• feat: add host, db and username to ExtraData for database detectors by @​mariocj89 in #​4849
• Remove over speculation from Corpora CI workflow by @​mustansir14 in #​4974
• Fix line numbers for duplicate secrets within a chunk by @​amanfcp in #​4910
• Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @​camgunz in #​4961
• Update Go security dependencies by @​cursor[bot] in #​4986
• Pin GitHub Actions to SHA digests by @​bryanbeverly in #​4985
• Update CODEOWNERS: replace 5 slugs with scanning + integrations by @​bryanbeverly in #​4983
• Added source config flags to sharepoint proto by @​MuneebUllahKhan222 in #​4972
• [SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @​mustansir14 in #​4981
• adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @​johannestaas-trufflesec in #​4991

New Contributors

• @​mariocj89 made their first contribution in #​4849
• @​cursor[bot] made their first contribution in #​4986
• @​johannestaas-trufflesec made their first contribution in #​4991

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.4

v3.95.3

Compare Source

What's Changed

• Renamed AnypointOAuth2 detector's AnalysisInfo keys to make it consistent with its Analyzer by @​MuneebUllahKhan222 in #​4906
• Rename AnalysisInfo field to SecretParts on detectors.Result by @​mcastorina in #​4911
• Document SecretParts contract in detector-authoring docs by @​mcastorina in #​4912
• Add a static check for detectors that don't set SecretParts by @​mcastorina in #​4913
• Populate SecretParts on all detectors by @​mcastorina in #​4919
• Make checksecretparts required in CI by @​mcastorina in #​4921
• Deduplicate concurrent credential verification requests via singleflight by @​kashifkhan0771 in #​4314
• log non-critical chunk errors at V(2).Info instead of Error by @​johnelliott in #​4928
• [INS-320] Cloudinary detector by @​MuneebUllahKhan222 in #​4747
• ci: bump JS actions to Node 24 majors (incl. CodeQL v4 + WIF auth v3) by @​bryanbeverly in #​4933
• chore: bump golangci-lint-action v7 → v9 (Node 24) by @​bryanbeverly in #​4936
• Add default Content-Type: application/json header for custom detector verification request by @​MuneebUllahKhan222 in #​4947
• Make detector Result.SecretParts initialization stricter by @​mcastorina in #​4948
• Add Pinecone API key detector by @​dylanTruffle in #​4917
• adding customizable successRanges and rotatedRanges to customDetector by @​jordanTunstill in #​4892

Full Changelog: trufflesecurity/trufflehog@v3.95.2...v3.95.3

v3.95.2

Compare Source

What's Changed

• Revert "[INS-397] Fix git version parser panic on non-numeric patch versions" by @​trufflesteeeve in #​4903

Full Changelog: trufflesecurity/trufflehog@v3.95.1...v3.95.2

v3.95.1

Compare Source

What's Changed

• [INS-444] Fix verification logic in Mesibo detector by @​mustansir14 in #​4884

Full Changelog: trufflesecurity/trufflehog@v3.95.0...v3.95.1

v3.95.0

Compare Source

What's Changed

• Upgrade golangci-lint in CI runner and Makefile by @​amanfcp in #​4861
• Deprecate SquareUp Detector by @​nabeelalam in #​4855
• [INS-397] Fix git version parser panic on non-numeric patch versions by @​shahzadhaider1 in #​4882
• Fix Bitbucket line highlighting URLs by @​shahzadhaider1 in #​4854
• [INS-403] Support Custom endpoint config in hashicorpvaultauth Detector by @​MuneebUllahKhan222 in #​4825
• [INS-398] Added tests to ensure that custom endpoint configuration works in artifactory detectors by @​MuneebUllahKhan222 in #​4832
• Host ldap-verify library in trufflesecurity by @​trufflesteeeve in #​4859
• Add AnalysisError type and wrap all analyzer error paths by @​johnelliott in #​4779
• dep-updates: Go 1.25 and dependency refreshes by @​dustin-decker in #​4888
• Fix nil pointer panics in GitHub analyzer gist/repo binding functions by @​shahzadhaider1 in #​4864
• [INS-399] Added Bitbucket data center(on prem) PAT detector by @​MuneebUllahKhan222 in #​4883
• [INS-402] Add Jira Data Center PAT Detector by @​mustansir14 in #​4872
• Add man page generation for trufflehog by @​bryanbeverly in #​4894
• Add Confluence Data Center PAT detector by @​amanfcp in #​4886

Full Changelog: trufflesecurity/trufflehog@v3.94.3...v3.95.0

v3.94.3

Compare Source

What's Changed

• Add release bot workflow by @​bryanbeverly in #​4835
• handle AADSTS50173 as explicit revocation signal for azure refresh tokens by @​jordanTunstill in #​4842
• Add AnalysisInfo to verified results by @​hxnyk in #​4862
• Add nil check and error context to GitHub analyzer by @​johnelliott in #​4858
• [CSM-1857] Fix expired Azure secrets being silently dropped by @​dipto-truffle in #​4845
• Add HTML decoder for secret detection in HTML-formatted sources by @​alafiand in #​4840
• Split out detector types into separate proto file in order to narrow CODEOWNERS scope by @​casey-tran in #​4871

New Contributors

• @​johnelliott made their first contribution in #​4858
• @​dipto-truffle made their first contribution in #​4845
• @​alafiand made their first contribution in #​4840

Full Changelog: trufflesecurity/trufflehog@v3.94.2...v3.94.3

v3.94.2

Compare Source

What's Changed

• Skip TestAPKHandler by @​shahzadhaider1 in #​4841
• fix: replace release-guard workflow with revert-latest job by @​sysread in #​4838
• Deprecated GoogleAPIKey Detector by @​nabeelalam in #​4853
• todoist: replac

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🚀 Integration Test Results

npm-pr-version action test:

• ✅ Version generation: 0.0.0-PR-80--b734426
• ✅ package.json update: Successful
• ✅ Format validation: Passed

The action is working correctly! 🎉

[github-actions]

🧪 Test Results

✅ All tests passed successfully!

• Linting: ✅ Passed
• Unit tests: ✅ Passed
• Integration tests: ✅ Passed

[github-actions]

❌ PR package publish failed!

Error: ❌ ERROR: OIDC token not available. Add permissions: