build(deps): bump trufflesecurity/trufflehog from 3.95.9 to 3.96.0

[dependabot]

Bumps trufflesecurity/trufflehog from 3.95.9 to 3.96.0.

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.96.0

What's Changed

• [INS-355] Added Hashicorp vault token detector by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#4819
• Tighten JiraToken v1 verification by @​shahzadhaider1 in trufflesecurity/trufflehog#5122
• [INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @​bill-rich in trufflesecurity/trufflehog#5123
• Fix GitLab project metadata cache and switch to LRU by @​kashifkhan0771 in trufflesecurity/trufflehog#4727
• Log analyze errors for Anthropic Analyzer by @​kashifkhan0771 in trufflesecurity/trufflehog#5120
• Add metrics for chunks and results by @​mcastorina in trufflesecurity/trufflehog#5128
• Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @​kashifkhan0771 in trufflesecurity/trufflehog#5111
• [INS-312] Duo API Secret Key Detector by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#4771
• [Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by @​nabeelalam in trufflesecurity/trufflehog#4739
• [INS-255] Updated datadog detector to set verificationError in case of a verification error by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#4661
• Log analyze errors for Postgres analyzer by @​kashifkhan0771 in trufflesecurity/trufflehog#5131
• Log analyze errors for HuggingFace analyzer by @​kashifkhan0771 in trufflesecurity/trufflehog#5130
• Engine - Config.SourceManager doc by @​amanfcp in trufflesecurity/trufflehog#5002
• Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @​renovate[bot] in trufflesecurity/trufflehog#5034
• Retry git clone on transient network errors by @​shahzadhaider1 in trufflesecurity/trufflehog#5132
• Fix scan_all_installations Rejecting Org Member Personal Repos by @​shahzadhaider1 in trufflesecurity/trufflehog#5142
• updated detector to include underscore char by @​mattbrady-1 in trufflesecurity/trufflehog#5121
• [chore] Change job_id in metric to source_type by @​mcastorina in trufflesecurity/trufflehog#5149
• Posthog regex update by @​mattbrady-1 in trufflesecurity/trufflehog#5133
• fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @​johannestaas-trufflesec in trufflesecurity/trufflehog#5151

New Contributors

• @​mattbrady-1 made their first contribution in trufflesecurity/trufflehog#5121

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

Commits

• 6f3c981 fix(handlers): apk handler now doesnt check for apk extension since json-enum...
• 05a5832 fix(detectors/posthog): widen phx_ key body to {43,48} (#5133)
• a2ef4f5 [chore] Change job_id in metric to source_type (#5149)
• e74404a updated detector to include underscore char (#5121)
• 4d82f21 Fix scan_all_installations Rejecting Org Member Personal Repos (#5142)
• 38999f8 Retry git clone on transient network errors (#5132)
• 0eb1a81 Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] (#5034)
• ec20cb3 document Config.SourceManager (#5002)
• 4ecd7d5 Log analyze errors for HuggingFace analyzer (#5130)
• 1247638 Log analyze errors for Postgres analyzer (#5131)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 25, 2026, 8:55 AM ET / 12:55 UTC.

ClawSweeper review

What this changes

Updates the GitHub Actions secret-scan workflow to run TruffleHog v3.96.0 instead of v3.95.9.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

This is a narrow Dependabot update to the secret-scanning action and is not yet on current main; the remaining test check is still in progress, so it should stay open for normal workflow validation and merge review.

Priority: P2
Reviewed head: e6cd08f9a894510ee4c28d69ae504021651d36c7

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused one-line dependency update with successful security-related checks so far; the remaining test result is the only visible merge gate.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot workflow-maintenance PR is bot-authored; GitHub Actions results are the appropriate evidence, with the updated secret-scan checks already succeeding and the test check still running.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot workflow-maintenance PR is bot-authored; GitHub Actions results are the appropriate evidence, with the updated secret-scan checks already succeeding and the test check still running.
Evidence reviewed	3 items	PR diff: The branch changes exactly one workflow action reference, replacing trufflesecurity/trufflehog@v3.95.9 with @v3.96.0 in the secret scan job. Current-main comparison: The PR base is current main at e78551f2a1c29fba8e7dfba6221998a39a3dd021, and the submitted update is not part of that base revision. Validation state: The workflow reports successful analysis, dependency, Docker, lint, release-check, secret-scan, and CodeQL checks; the test check remains in progress.
Findings	None	None.
Security	None	None.

How this fits together

The repository’s secret-scan workflow runs TruffleHog against the checked-out source and scan range during GitHub Actions execution. Its result feeds the repository’s automated credential-detection gate before code is merged.

flowchart LR
  A[Repository push or pull request] --> B[Secret-scan workflow]
  B --> C[Determine scan range]
  C --> D[TruffleHog action]
  D --> E[Secret detection results]
  E --> F[GitHub Actions security gate]

Loading

Before merge

• Resolve merge risk (P1) - Merging changes executable third-party GitHub Action behavior in the repository’s secret-detection gate; complete the remaining test run and confirm the updated scan job still succeeds on the exact PR head.
• Complete next step (P2) - No code repair is needed; normal merge review should wait for the in-progress test check and verify the updated workflow gate.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Workflow surface	1 file affected; 1 action reference changed	The patch is tightly scoped to the repository’s automated secret-scanning gate.

Merge-risk options

Maintainer options:

1. Verify the updated scan gate before merge (recommended)
   Wait for the remaining test check and confirm the TruffleHog workflow succeeds on this head before merging the action-version update.
2. Pause if the scan behavior changes unexpectedly
   Keep the existing action version if the updated action fails, changes required permissions, or produces an unexplained scan regression.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Require all checks to pass, including the updated secret-scan workflow, before merging.

Technical review

Best possible solution:

Keep the narrowly scoped update, confirm all required checks including the current test run are green, then merge it through the normal dependency-update process.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates an automated workflow dependency rather than reporting a user-facing failure. The observable validation path is the GitHub Actions secret scan and remaining test run on the submitted head.

Is this the best way to solve the issue?

Yes. Updating the existing TruffleHog action reference is the narrowest maintainable way to adopt the upstream v3.96.0 release without changing scan configuration or repository behavior outside the workflow dependency.

AGENTS.md: unclear because the file could not be read completely.

Codex review notes: model internal, reasoning high; reviewed against e78551f2a1c2.

Labels

Label changes:

• add P2: This is a routine but security-adjacent CI dependency update with limited repository-wide blast radius.
• add merge-risk: 🚨 automation: The PR changes the executable action version used by the repository’s secret-scanning workflow, so its runtime behavior must be confirmed on the PR head.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot workflow-maintenance PR is bot-authored; GitHub Actions results are the appropriate evidence, with the updated secret-scan checks already succeeding and the test check still running.

Label justifications:

• P2: This is a routine but security-adjacent CI dependency update with limited repository-wide blast radius.
• merge-risk: 🚨 automation: The PR changes the executable action version used by the repository’s secret-scanning workflow, so its runtime behavior must be confirmed on the PR head.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot workflow-maintenance PR is bot-authored; GitHub Actions results are the appropriate evidence, with the updated secret-scan checks already succeeding and the test check still running.

Evidence

What I checked:

• PR diff: The branch changes exactly one workflow action reference, replacing trufflesecurity/trufflehog@v3.95.9 with @v3.96.0 in the secret scan job. (.github/workflows/secret-scan.yml:62, e6cd08f9a894)
• Current-main comparison: The PR base is current main at e78551f2a1c29fba8e7dfba6221998a39a3dd021, and the submitted update is not part of that base revision. (.github/workflows/secret-scan.yml:62, e78551f2a1c2)
• Validation state: The workflow reports successful analysis, dependency, Docker, lint, release-check, secret-scan, and CodeQL checks; the test check remains in progress. (e6cd08f9a894)

Likely related people:

• discrawl security-workflow contributors: The available review context identifies the changed security workflow but does not expose readable local git provenance for its prior contributors; route review to people responsible for GitHub Actions and repository security scanning. (role: adjacent workflow owners; confidence: low; files: .github/workflows/secret-scan.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Wait for the in-progress test check to complete successfully.
• Confirm the updated secret-scan job remains successful on the final merge head.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.