build(deps): bump trufflesecurity/trufflehog from 3.95.9 to 3.96.0

[dependabot]

Bumps trufflesecurity/trufflehog from 3.95.9 to 3.96.0.

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.96.0

What's Changed

• [INS-355] Added Hashicorp vault token detector by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#4819
• Tighten JiraToken v1 verification by @​shahzadhaider1 in trufflesecurity/trufflehog#5122
• [INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @​bill-rich in trufflesecurity/trufflehog#5123
• Fix GitLab project metadata cache and switch to LRU by @​kashifkhan0771 in trufflesecurity/trufflehog#4727
• Log analyze errors for Anthropic Analyzer by @​kashifkhan0771 in trufflesecurity/trufflehog#5120
• Add metrics for chunks and results by @​mcastorina in trufflesecurity/trufflehog#5128
• Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @​kashifkhan0771 in trufflesecurity/trufflehog#5111
• [INS-312] Duo API Secret Key Detector by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#4771
• [Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by @​nabeelalam in trufflesecurity/trufflehog#4739
• [INS-255] Updated datadog detector to set verificationError in case of a verification error by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#4661
• Log analyze errors for Postgres analyzer by @​kashifkhan0771 in trufflesecurity/trufflehog#5131
• Log analyze errors for HuggingFace analyzer by @​kashifkhan0771 in trufflesecurity/trufflehog#5130
• Engine - Config.SourceManager doc by @​amanfcp in trufflesecurity/trufflehog#5002
• Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @​renovate[bot] in trufflesecurity/trufflehog#5034
• Retry git clone on transient network errors by @​shahzadhaider1 in trufflesecurity/trufflehog#5132
• Fix scan_all_installations Rejecting Org Member Personal Repos by @​shahzadhaider1 in trufflesecurity/trufflehog#5142
• updated detector to include underscore char by @​mattbrady-1 in trufflesecurity/trufflehog#5121
• [chore] Change job_id in metric to source_type by @​mcastorina in trufflesecurity/trufflehog#5149
• Posthog regex update by @​mattbrady-1 in trufflesecurity/trufflehog#5133
• fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @​johannestaas-trufflesec in trufflesecurity/trufflehog#5151

New Contributors

• @​mattbrady-1 made their first contribution in trufflesecurity/trufflehog#5121

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

Commits

• 6f3c981 fix(handlers): apk handler now doesnt check for apk extension since json-enum...
• 05a5832 fix(detectors/posthog): widen phx_ key body to {43,48} (#5133)
• a2ef4f5 [chore] Change job_id in metric to source_type (#5149)
• e74404a updated detector to include underscore char (#5121)
• 4d82f21 Fix scan_all_installations Rejecting Org Member Personal Repos (#5142)
• 38999f8 Retry git clone on transient network errors (#5132)
• 0eb1a81 Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] (#5034)
• ec20cb3 document Config.SourceManager (#5002)
• 4ecd7d5 Log analyze errors for HuggingFace analyzer (#5130)
• 1247638 Log analyze errors for Postgres analyzer (#5131)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 1, 2026, 12:15 PM ET / 16:15 UTC.

ClawSweeper review

What this changes

Updates the TruffleHog GitHub Action that scans pull requests and pushes for verified secrets from v3.95.9 to v3.96.0.

Merge readiness

⚠️ Ready for maintainer review - 3 items remain

This PR is still necessary: current main and the latest release both retain TruffleHog v3.95.9, while the branch narrowly updates the security-gate action to v3.96.0. The patch has no source-level correctness finding, but executing a newer third-party scanner in the verified-secret gate needs an explicit maintainer security-boundary decision before merge.

Priority: P3
Reviewed head: 68f3ad017cc08dec6621daf3fdbdcb130257d652
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A narrowly scoped, clean dependency update with successful workflow checks, pending a deliberate security-gate version decision.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot PR is bot-authored; the supplied successful secret-scan check provides relevant workflow evidence, while maintainer approval of the security-boundary change remains separate.
Patch quality	🐚 platinum hermit (4/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot PR is bot-authored; the supplied successful secret-scan check provides relevant workflow evidence, while maintainer approval of the security-boundary change remains separate.
Evidence reviewed	5 items	Current main remains on the prior action version: The current default branch invokes trufflesecurity/trufflehog@v3.95.9; it does not already implement the requested v3.96.0 update. Branch is a narrow workflow dependency update: The proposed commit changes exactly one action reference, from v3.95.9 to v3.96.0, with the scan range, verified-only mode, and failure behavior unchanged. Latest release still uses the prior scanner: Release v0.8.7 contains the same v3.95.9 TruffleHog reference, so the requested upgrade is neither released nor already present on current main.
Findings	None	None.
Security	Needs attention	Review the executable-action upgrade: This reference selects TruffleHog v3.96.0 for scans on pull requests and pushes. No source-level defect is identified, but the upstream scanner release must be accepted deliberately for this security boundary.

How this fits together

Gitcrawl’s secret-scan workflow receives repository pushes and pull requests, resolves the changed commit range, and runs TruffleHog to detect verified credentials. A failed scan stops the workflow and directs operators to rotate the exposed credential before merging.

flowchart LR
  A[Push or pull request] --> B[Secret-scan workflow]
  B --> C[Resolve commit range]
  C --> D[TruffleHog action]
  D --> E[Verified-secret results]
  E -->|Secrets found| F[Fail workflow and rotate credential]
  E -->|No verified secrets| G[Security gate passes]

Loading

Decision needed

Question	Recommendation
Should Gitcrawl accept TruffleHog v3.96.0 as the executable scanner for its verified-secret security gate?	Approve the scanner update: Accept v3.96.0 after reviewing the upstream release and the repository’s action-pinning expectations, then merge this unchanged one-line dependency bump.

Why: The patch is mechanically narrow and checks passed, but it changes the upstream program executed by a security-sensitive workflow; source inspection cannot make that trust decision on behalf of maintainers.

Before merge

• Resolve security concern: Review the executable-action upgrade - This reference selects TruffleHog v3.96.0 for scans on pull requests and pushes. No source-level defect is identified, but the upstream scanner release must be accepted deliberately for this security boundary.
• Resolve merge risk (P1) - Merging changes the third-party executable used on every pull-request and push secret scan; successful checks show compatibility, but maintainers still need to accept the upstream v3.96.0 scanner behavior for this security gate.

Findings

• [medium] Review the executable-action upgrade — .github/workflows/secret-scan.yml:52

Agent review details

Security

Needs attention: The diff is purpose-consistent and narrowly scoped, but it changes the externally executed scanner in a security workflow and therefore needs explicit maintainer acceptance.

Review metrics

Metric	Value	Why it matters
Workflow surface	1 file changed; 1 action ref updated	The branch leaves scan inputs, permissions, range resolution, and failure handling intact.

Merge-risk options

Maintainer options:

1. Approve after upstream security review (recommended)
   Confirm that adopting the v3.96.0 action release is acceptable for the verified-secret gate, then merge the existing focused update.
2. Pause the version bump
   Leave this PR open or close it if maintainers prefer to retain v3.95.9 pending a different supply-chain or pinning decision.

Technical review

Best possible solution:

Review the TruffleHog v3.96.0 release under the repository’s action-pinning and supply-chain policy, then merge this one-line update if that security-gate upgrade is accepted.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency-update PR rather than a report of broken behavior. The exact workflow change and successful PR scan runs are directly inspectable from the diff and supplied check context.

Is this the best way to solve the issue?

Unclear pending maintainer approval: changing only the action reference is the narrowest implementation, but accepting a newer executable security scanner is a maintainer trust decision rather than a source-level repair.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against dcdf94703540.

Labels

Label justifications:

• P3: This is a routine, low-scope dependency update rather than a currently broken user workflow.
• merge-risk: 🚨 security-boundary: The changed reference selects a newer third-party program that executes inside the repository’s verified-secret security workflow.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot PR is bot-authored; the supplied successful secret-scan check provides relevant workflow evidence, while maintainer approval of the security-boundary change remains separate.

Evidence

Security concerns:

• [medium] Review the executable-action upgrade — .github/workflows/secret-scan.yml:52
  This reference selects TruffleHog v3.96.0 for scans on pull requests and pushes. No source-level defect is identified, but the upstream scanner release must be accepted deliberately for this security boundary.
  Confidence: 0.96

What I checked:

• Current main remains on the prior action version: The current default branch invokes trufflesecurity/trufflehog@v3.95.9; it does not already implement the requested v3.96.0 update. (.github/workflows/secret-scan.yml:52, dcdf94703540)
• Branch is a narrow workflow dependency update: The proposed commit changes exactly one action reference, from v3.95.9 to v3.96.0, with the scan range, verified-only mode, and failure behavior unchanged. (.github/workflows/secret-scan.yml:52, 68f3ad017cc0)
• Latest release still uses the prior scanner: Release v0.8.7 contains the same v3.95.9 TruffleHog reference, so the requested upgrade is neither released nor already present on current main. (.github/workflows/secret-scan.yml:52, 4f737bb846e0)
• Workflow provenance and ownership: The verified-secret scan was introduced by Vincent Koc in a4ab91b; later workflow history includes routine TruffleHog bumps and Peter Steinberger’s v0.8.7 release preparation. (.github/workflows/secret-scan.yml:52, a4ab91b035da)
• Observed PR execution: The supplied PR context reports successful Scan for Verified Secrets, macOS, Ubuntu, Docker, and CodeQL checks on the proposed head. Those runs support workflow compatibility, but do not replace acceptance of the newer externally executed scanner release. (.github/workflows/secret-scan.yml:52, 68f3ad017cc0)

Likely related people:

• Vincent Koc: Introduced the verified-secret scanning workflow in the earliest retained workflow-history commit. (role: feature introducer; confidence: high; commits: a4ab91b035da, 858f8247197a; files: .github/workflows/secret-scan.yml)
• Peter Steinberger: Prepared v0.8.7, whose released secret-scan workflow retains the action reference this PR changes. (role: recent release-area contributor; confidence: medium; commits: 4f737bb846e0; files: .github/workflows/secret-scan.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Have a security-workflow owner review and accept the upstream v3.96.0 release before merge.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (10 earlier review cycles; latest 8 shown)

• reviewed 2026-07-31T01:04:56.621Z sha 68f3ad0 :: needs maintainer review before merge. :: none
• reviewed 2026-07-31T02:54:27.083Z sha 68f3ad0 :: needs maintainer review before merge. :: none
• reviewed 2026-07-31T09:33:51.933Z sha 68f3ad0 :: needs maintainer review before merge. :: none
• reviewed 2026-07-31T18:17:54.908Z sha 68f3ad0 :: needs maintainer review before merge. :: none
• reviewed 2026-07-31T21:16:17.302Z sha 68f3ad0 :: needs maintainer review before merge. :: none
• reviewed 2026-08-01T05:08:02.048Z sha 68f3ad0 :: needs maintainer review before merge. :: none
• reviewed 2026-08-01T11:18:05.399Z sha 68f3ad0 :: needs maintainer review before merge. :: none
• reviewed 2026-08-01T13:11:22.714Z sha 68f3ad0 :: needs maintainer review before merge. :: none