Repository navigation
build(deps): bump trufflesecurity/trufflehog from 3.99.2 to 3.99.3 - #317
Conversation
Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.99.2 to 3.99.3. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@e76dff8...e63326d) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.99.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
clawsweeper
Bot
added
P3
|
Codex review: needs maintainer review before merge. What this changesThis PR updates the pinned TruffleHog GitHub Action reference from v3.99.2 to v3.99.3. Example: A pull request triggers verified-secret scanning.
Review scores
ProductKind: Maintenance · Worth it: Yes · Fix scope: Complete Merge readiness✅ Ready for maintainer review Keep this PR open: main still uses the previous action revision, and the minimal update introduces no identified defect. The upstream action bytes are identical, so this changes the source reference without selecting a different scanner image. Priority: P3 Before mergeNone. FindingsNone. Agent review detailsHow this fits togetherGitHub Actions supplies the checked-out repository and commit range to TruffleHog, which verifies candidate credentials and returns the secret-scanning gate result. flowchart LR
A[Push or pull request] --> B[Checkout repository]
B --> C[Resolve commit range]
C --> D[Pinned composite action]
D --> E[Scanner image latest]
E --> F[Verified secret gate]
Technical reviewBest possible solution: Land the minimal action-reference refresh while treating scanner-image selection as the separate work in #313. Do we have a high-confidence way to reproduce the issue? No product bug is asserted; source inspection confirms the old reference on main and identical action contents at both upstream revisions. Is this the best way to solve the issue? The one-line update is the smallest reference refresh, although it does not pin or upgrade the scanner runtime because the action still selects latest. AGENTS.md: found but not applied because it conflicted with ClawSweeper's review contract. Codex review notes: model internal, reasoning medium; reviewed against c3dd4153e384. Provenance checked
TestingProof path: shipped entry point. SecurityNone. EvidenceWhat I checked:
Likely related people:
LabelsLabel changes:
Label justifications:
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment Reviewed October 24, 2026, 9:07 AM ET / 13:07 UTC. |
|
Verified this update was already merged as 65efdb5 before the prepared-patch recovery began. Its recorded checks passed at head 9815952. The v3.99.3 action and separately qualified v3.99.4 scanner image remain intact after landing #318, #315, and #316; no duplicate bump or scanner downgrade was applied. |
Bumps trufflesecurity/trufflehog from 3.99.2 to 3.99.3.
Release notes
Sourced from trufflesecurity/trufflehog's releases.
Commits
e63326dgithub: name the missing permission when a comment listing is refused (#5438)048de9fUpdate module google.golang.org/grpc to v1.83.2 [SECURITY] (#5431)31d7303Add per-logger debug level override for source logging (#5432)feea7f9Add SonarQube Server token detector (#5419)27d8ea2fix(github): use a single "app client registry" to make sure we reuse client ...b40e7fe[INT-1051] Fix GitHub comment scans stopping early on large repositories (#5405)9e93a20Update module google.golang.org/grpc to v1.83.1 [SECURITY] (#5426)4b56723Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace to v1.45.0 [S...37a6f6eReplace deprecated google.CredentialsFromJSON with CredentialsFromJSONWithTyp...6404b63Update module filippo.io/edwards25519 to v1.1.1 [SECURITY] (#5421)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)