chore(deps): update github actions (version updates)

[wandb-renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout (changelog)	action	digest	df4cb1c → d23441a
actions/setup-node (changelog)	action	digest	48b55a0 → 2499707
trufflesecurity/trufflehog	action	minor	v3.95.8 → v3.96.0

---

Release Notes

trufflesecurity/trufflehog (trufflesecurity/trufflehog)

v3.96.0

Compare Source

What's Changed

• [INS-355] Added Hashicorp vault token detector by @​MuneebUllahKhan222 in #​4819
• Tighten JiraToken v1 verification by @​shahzadhaider1 in #​5122
• [INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @​bill-rich in #​5123
• Fix GitLab project metadata cache and switch to LRU by @​kashifkhan0771 in #​4727
• Log analyze errors for Anthropic Analyzer by @​kashifkhan0771 in #​5120
• Add metrics for chunks and results by @​mcastorina in #​5128
• Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @​kashifkhan0771 in #​5111
• [INS-312] Duo API Secret Key Detector by @​MuneebUllahKhan222 in #​4771
• [Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by @​nabeelalam in #​4739
• [INS-255] Updated datadog detector to set verificationError in case of a verification error by @​MuneebUllahKhan222 in #​4661
• Log analyze errors for Postgres analyzer by @​kashifkhan0771 in #​5131
• Log analyze errors for HuggingFace analyzer by @​kashifkhan0771 in #​5130
• Engine - Config.SourceManager doc by @​amanfcp in #​5002
• Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @​renovate[bot] in #​5034
• Retry git clone on transient network errors by @​shahzadhaider1 in #​5132
• Fix scan_all_installations Rejecting Org Member Personal Repos by @​shahzadhaider1 in #​5142
• updated detector to include underscore char by @​mattbrady-1 in #​5121
• [chore] Change job_id in metric to source_type by @​mcastorina in #​5149
• Posthog regex update by @​mattbrady-1 in #​5133
• fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @​johannestaas-trufflesec in #​5151

New Contributors

• @​mattbrady-1 made their first contribution in #​5121

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

v3.95.9

Compare Source

What's Changed

• feat: add OpenRouter detector by @​McPatate in #​4500
• Integrations fully codeowns detectors by @​trufflesteeeve in #​5104
• [INS-332] Add New Relic Insights Insert key detector by @​mustansir14 in #​4778
• [INS-351] Added Duffel Token Detector by @​MuneebUllahKhan222 in #​4795
• [INS-341] Added Shippo detector by @​MuneebUllahKhan222 in #​4820
• [INS-467] Add IPinfo detector to default detectors list by @​mustansir14 in #​4970
• fix: reject --include-repos/--exclude-repos with --repo in github scan by @​kashifkhan0771 in #​5112
• [INS-468] Add improved lob detector to defaults.go by @​mustansir14 in #​4971
• feat(action): add image input to allow registry mirror overrides by @​eightseventhreethree in #​4965
• feat: Support archived repo exclusion from GH org scans by @​hibare in #​4875
• [INT-715] Retry transient failures when verifying OpenAI keys by @​bill-rich in #​5117
• [INS-410] Added batch token detector by @​MuneebUllahKhan222 in #​4824
• [INT-650] Don't log as error when git diff is too long by @​bill-rich in #​5113

New Contributors

• @​McPatate made their first contribution in #​4500
• @​eightseventhreethree made their first contribution in #​4965

Full Changelog: trufflesecurity/trufflehog@v3.95.8...v3.95.9

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}