From c70e54c7b7357222d53ed3d48ee8e88a37ed27cc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 22 Oct 2026 18:43:55 +0000 Subject: [PATCH 1/3] build(deps): bump trufflesecurity/trufflehog from 3.99.2 to 3.99.3 Bumps [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) from 3.99.2 to 3.99.3. - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](https://github.com/trufflesecurity/trufflehog/compare/e76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9...e63326d6545de8f425d93ce24078c6e68d83f70e) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.99.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/secret-scan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml index 21bd3282..28ed69b1 100644 --- a/.github/workflows/secret-scan.yml +++ b/.github/workflows/secret-scan.yml @@ -49,7 +49,7 @@ jobs: - name: TruffleHog OSS id: trufflehog - uses: trufflesecurity/trufflehog@e76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9 # v3.99.2 + uses: trufflesecurity/trufflehog@e63326d6545de8f425d93ce24078c6e68d83f70e # v3.99.3 with: path: ./ base: ${{ steps.scan_range.outputs.base }} From e76aeb0b00c4c8a7540d510be55fa1b2694691a8 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Fri, 23 Oct 2026 00:20:29 -0700 Subject: [PATCH 2/3] chore: record TruffleHog security scanner update Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index d27fca49..a1c4edab 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ ## Unreleased +- Update the TruffleHog secret-scanning action to v3.99.3 for dependency security fixes and more reliable GitHub comment scans. Thanks @dependabot. - Request `synchronous=FULL` on every SQLite connection and, on macOS, `fullfsync` for commits and checkpoints. Go test binaries skip the macOS full flush. - Let the native code producer publish from a captured upstream commit when core progress is fresh, even while provider coverage is incomplete. Retries and coverage are not changed. - Add `portable export --compression split`, which publishes the uncompressed portable database as verified 32 MiB parts so Git stores each new generation as a small delta instead of a new 68 MB gzip blob. Refresh, init, status and recovery read split stores; older readers refuse them and keep their last good mirror. After advancing to a split generation, strict refresh geometrically repacks recent objects so subscribers also keep each generation as a delta, skipping a loose backlog of more than 512 objects. Raw and gzip stores are still never repacked. From 35a732a7d7ae0a07d90853237b3570a76414e498 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Fri, 23 Oct 2026 00:22:28 -0700 Subject: [PATCH 3/3] docs: clarify TruffleHog action refresh scope --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a1c4edab..a0552996 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ ## Unreleased -- Update the TruffleHog secret-scanning action to v3.99.3 for dependency security fixes and more reliable GitHub comment scans. Thanks @dependabot. +- Update the pinned TruffleHog secret-scanning action to v3.99.3. Thanks @dependabot. - Request `synchronous=FULL` on every SQLite connection and, on macOS, `fullfsync` for commits and checkpoints. Go test binaries skip the macOS full flush. - Let the native code producer publish from a captured upstream commit when core progress is fresh, even while provider coverage is incomplete. Retries and coverage are not changed. - Add `portable export --compression split`, which publishes the uncompressed portable database as verified 32 MiB parts so Git stores each new generation as a small delta instead of a new 68 MB gzip blob. Refresh, init, status and recovery read split stores; older readers refuse them and keep their last good mirror. After advancing to a split generation, strict refresh geometrically repacks recent objects so subscribers also keep each generation as a delta, skipping a loose backlog of more than 512 objects. Raw and gzip stores are still never repacked.