chore(deps): update all non-major dependencies

[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@vue/test-utils	2.4.6 → 2.5.1			devDependencies	minor
actions/checkout	v6.0.2 → v6.1.0			action	minor
lycheeverse/lychee-action	v2.8.0 → v2.9.0			action	minor
trufflesecurity/trufflehog	v3.90.5 → v3.99.2			action	minor

---

Release Notes

vuejs/test-utils (@​vue/test-utils)

v2.5.1

Compare Source

What's Changed

• fix: generic SFC findComponent types by @​simonyang08 in #​2934
• fix: share config across builds by @​cexbrayat in #​2937

New Contributors

• @​simonyang08 made their first contribution in #​2934

Full Changelog: vuejs/test-utils@v2.5.0...v2.5.1

v2.5.0

Compare Source

⚠️ Breaking change: Vue Test Utils no longer supports class components. See #​2904.

What's Changed

• fix: keep re-rendering root component after another wrapper is mounted by @​lazerg in #​2890
• fix: correct summary element behavior by @​nn-morishita in #​2806
• fix: clear emitted event history for child components on unmount by @​ebiryu in #​2898
• chore!: drop class component support by @​cexbrayat in #​2904
• fix: expose defineExpose bindings on findComponent vm by @​adamberecz in #​2927

New Contributors

• @​MetRonnie made their first contribution in #​2885
• @​lazerg made their first contribution in #​2890
• @​bartlomieju made their first contribution in #​2892
• @​nn-morishita made their first contribution in #​2806
• @​ebiryu made their first contribution in #​2898
• @​chiaraani made their first contribution in #​2916
• @​souserge made their first contribution in #​2695
• @​adamberecz made their first contribution in #​2927

Full Changelog: vuejs/test-utils@v2.4.11...v2.5.0

v2.4.11

Compare Source

compare changes

🩹 Fixes

• Drop legacy Mutation Event listener entries (#​2844)
• Handle setData() correctly for components using both setup() and data() (#​2846)
• Export GlobalMountOptions type (#​2851)
• Set spec-compliant event.code on keydown/keyup (#​2850)

❤️ Contributors

• Cédric Exbrayat (@​cexbrayat)
• Renato de Leão (@​renatodeleao)
• Matt Van Horn (@​mvanhorn)
• Carsten Brachem (@​cbrachem)
• Ahmad Hanan (@​AhmadHannan037)
• Paul Cochrane (@​paultcochrane)
• Arpit Jain (@​arpitjain099)

v2.4.10

Compare Source

compare changes

🩹 Fixes

• Restore text()/html() for single-root components (#​2835)

❤️ Contributors

• Cédric Exbrayat (@​cexbrayat)
• Lorenz van Herwaarden (@​lorenzvanherwaarden)

v2.4.9

Compare Source

compare changes

🩹 Fixes

• Tolerate duplicate attachTo cleanup (#​2830)

📖 Documentation

• Document release process (#​2834)

🏡 Chore

• Migrate renovate config (5d37934)

🤖 CI

• Pin github actions to commit hashes (75dcef3)

❤️ Contributors

• Cédric Exbrayat (@​cexbrayat)
• Daniel Roe (@​danielroe)

v2.4.8

Compare Source

compare changes

🩹 Fixes

• Correct declaration entrypoint (#​2826)

🤖 CI

• Enable pkg.pr.new (#​2827)

❤️ Contributors

• Cédric Exbrayat (@​cexbrayat)
• Daniel Roe (@​danielroe)

v2.4.7

Compare Source

compare changes

🚀 Enhancements

• Add Chinese docs translation (#​2552)
• SetData()/shallowMount with initialData for components using the Composition API / <script setup> (#​2655)

🩹 Fixes

• Preserve code from keyboard events (#​2434)
• Switch browser and require exports definitions (#​2501)
• Re-add peer dependencies but with wider range (#​2511)
• Resolve warnings in docs:dev (30b7491)
• Resolve TypeScript type errors in .vitepress/config (#​2549)
• Accept FunctionalComponent as selector (0bb947f)
• Text() misses content for array functional component (#​2579)
• Use await in test (c5482b4)
• deps: Update dependency vue-component-type-helpers to v3 (#​2683)
• Remove wrapper div when unmount (#​2700)
• Make mount options slots compatible with noUncheckedIndexedAccess true (#​2713)
• Add missing peerDependency @​vue/compiler-dom (75801ba)
• docs: Declare css module for vitepress typecheck (ddaca97)

💅 Refactors

• Enforce consistent usage of type imports (#​2734)

📖 Documentation

• Clarify findComponent vs getComponent (#​2435)
• Update fr docs (67064ef)
• Add note about partial transition stub support (#​2431)
• Fix missing data at passing data section essentials guide (dda205e)
• Fix missing data at passing data section essentials guide fr (ae2c72c)
• Fix plugin TS declaration example (#​2466)
• Fixed incorrect checkbox value check (#​2495)
• Capital letter in sentence fix (#​2499)
• Import missing DOMWrapper on Implementation of the plugin section (#​2519)
• Add migration step for deprecated ref syntax in findAllComponents (#​2498)
• Correct anchor hash links and fix typo (#​2551)
• Center logo on home (#​2559)
• zh-cn: Review a-crash-course (#​2563)
• Use code-group for install commands (#​2571)
• zh-cn: Review event-handing.md (#​2572)
• zh-cn: Enhance conditional-rendering.md (#​2562)
• zh-cn: Review easy-to-test (#​2567)
• zh-cn: Review passing-data.md (#​2575)
• zh-cn: Review async-suspense.md (#​2576)
• zh: 优化 API 文档格式和内容 (#​2569)
• zh: 更新 Vitest 模拟日期和计时器的说明 (#​2578)
• zh-cn: Review http-requests.md (#​2580)
• zh-cn: Review forms (#​2582)
• zh-cn: Guide/advanced/slots.md (#​2565)
• zh: Review extending-vtu (#​2583)
• zh: Review index (#​2584)
• Fix modelValue test example (85bfdf4)
• Removes broken link from plugins.md (69bc1ce)
• zh: Review transitions, component-instance, and reusability-composition (#​2616)
• zh: Review v-model and vuex (#​2617)
• zh: Review all the rest advanced guide (#​2619)
• zh: Review migration (#​2623)
• Fix a typo in transitions.md (#​2635)
• Update crash-course to script setup (c81aa79)
• Update Essentials section to setup (composition api) (#​2647)
• Typos in examples (#​2678)
• Typo in easy-to-test.md (#​2710)
• Add note about mocking requestAnimationFrame for transitions (2324c65)
• Updated example TodoApp to script setup (#​2727)
• Remove "Using data" section from "Conditional Rendering" guide and fix passing data test example (#​2743)
• Follow-up fixes for the conditional rendering guide (#​2744)
• Mention shallowMount stub name changes in migration guide (80e051a)
• Update conditional rendering documentation to clarify isVisible() usage with attachTo (#​2799)
• Restore Options API component for data() mounting example (#​2804)
• Promote Vitest as recommended test runner (#​2805)
• api: Note that setValue does not accept objects on <select> (#​2819)

🏡 Chore

• Add api/index.md to docs:translation:compare (6b8681c)
• Remove unnecessary generic arguments (cfd70c6)
• Ignore TS error in config object (9d0a618)
• Simplify eslint packages (c1d0ffd)
• Use eslint v9 with flat config (2f19fdf)
• Expose Stubs type publicly (#​2492)
• Update documentation file path (9c96594)
• Use pnpm v10 (e4c2cb3)
• Pnpm approve build (81c54e9)
• Use github issue forms (#​2673)
• Exclude class components from test type-checking (0899008)
• Add explicit coverage include for vitest v4 (51672b9)
• Update to prettier v3.7 (fed9e7c)
• Migrate to oxfmt (81c1de9)
• Migrate to oxlint (a361908)
• Prepare TypeScript 6 migration settings (55e1262)
• Adjust tsd config for TypeScript 6 (7d23eb5)
• Avoid TypeScript 6 target deprecation warning (81d063c)

🤖 CI

• Remove node v22 build (7ebf58d)
• Add node v22 build (57540ee)
• Use "pool: threads" instead of vmThreads (d0cbb54)
• Remove node v18 and add v24 (fd9cf95)
• Add trusted publishing release workflow (#​2825)

❤️ Contributors

• Lachlan Miller (@​lmiller1990)
• cexbrayat (@​cexbrayat)
• Nicolas Bonamy (@​nbonamy)
• KatWorkGit (@​KatWorkGit)
• Wouter Kroes (@​wouterkroes)
• Rama Muhammad Murshal (@​ramammurshal)
• Evan You (@​yyx990803)
• Vlad Starkovsky (@​starkovsky)
• Joe (@​joaoprp)
• Priyadarshi Kumar (@​Psingh132)
• Sébastien Ronveaux (@​sronveaux)
• Gilliam (@​Gi11i4m)
• Baranov Dmytro (@​dimas7001)
• BrendonHenrique (@​BrendonHenrique)
• Lorenz van Herwaarden (@​lorenzvanherwaarden)
• wuzhiqing (@​DDDDD12138)
• 阿菜 Cai (@​RSS1102)
• Jinjiang (@​Jinjiang)
• Kylin (@​lxKylin)
• Qianhe Chen (@​chenqianhe)
• 时瑶 (@​KiritaniAyaka)
• h7ml (@​h7ml)
• Nicander (@​Nicander93)
• Take-John (@​takejohn)
• ilyasherstoboev (@​ilyasherstoboev)
• aimerie (@​aimerie)
• Miguel Rincon (@​miguelrincon)
• bcastlel (@​bcastlel)
• Claudiu (@​sofuxro)
• Artem Dragunov (@​dragunovartem99)
• Robin (@​OrbisK)
• Koen Mertens (@​KCMertens)
• meomking (@​CaptainWang98)
• Pepijn Olivier (@​pepijnolivier)
• Tomina (@​Thomaash)
• Gareth Jones (@​G-Rath)
• Jerry Hogan (@​hdJerry)
• Marco Pasqualetti (@​marcalexiei)
• guoxk (@​guoxk-me)
• kimulaco (@​kimulaco)
• Erwan IQUEL (@​Olympus5)
• Matt Van Horn (@​mvanhorn)
• Daniel Roe (@​danielroe)

actions/checkout

v6.1.0

Compare Source

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v6 by @​aiqiaoy in #​2500
• backport fixes to releases-v6 by @​aiqiaoy in #​2527

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

lycheeverse/lychee-action

v2.9.0

Compare Source

Summary

This release updates the default lychee version from v0.23.0 to v0.24.2.

The main reason for this release is compatibility with the new lychee 0.24.x release artifacts. Starting with lychee v0.24.0, the archive layout changed, and the lychee binary may now be packaged inside a subdirectory. lychee-action now detects that layout automatically, so users can upgrade without changing their workflows.

If you use:

uses: lycheeverse/lychee-action@v2

you will get the new version once the floating v2 tag has been updated. If you pin exact versions, update to:

uses: lycheeverse/lychee-action@v2.9.0

What’s new from lychee v0.24.x

Better diagnostics

lychee now reports line and column numbers for detected links. This makes broken link reports easier to act on, especially in larger documentation sites or generated reports.

Text fragment checking

lychee can now check URL text fragments, such as links containing #:~:text=.... This helps catch links that point to a valid page but no longer points to the intended highlighted text.

Sitemap support

lychee can now read sitemap.xml inputs. This is useful for checking published websites or generated documentation sites where the sitemap is the easiest source of URLs to validate.

JUnit output

lychee now supports JUnit output. This makes it easier to integrate link checking results with CI systems and test reporting tools that understand JUnit XML.

Redirect and remap visibility

lychee can now show redirects and remaps more clearly. This helps explain why a URL was checked as a different final URL and makes debugging link-checking behavior easier.

Multiple config files

lychee now supports multiple configuration files and expanded config handling. This is useful for repositories that split documentation, website, or package-specific link-checking settings.

Timeout handling

lychee can now accept timeouts explicitly. This gives users more control over how strict their link checks should be for flaky or slow endpoints.

Fixes and reliability improvements

Fixed lychee 0.24.x archive compatibility

lychee-action now handles the new lychee release archive layout by detecting whether the lychee binary is inside a subdirectory.

This fixes compatibility with lychee 0.24.x.

More stable installation path

The action now installs lychee into $RUNNER_TEMP/lychee/bin instead of $HOME.

This avoids failures on runners where $HOME differs between composite action steps. In those environments, the action could add one directory to PATH but install the binary somewhere else, causing lychee: command not found.

Safer automatic lychee version updates

The workflow that checks for new lychee releases now guards against null release versions before creating update PRs. This prevents invalid automated PRs such as “Update lycheeVersion to null”.

Dependency updates

• Updated actions/checkout from v6 to v7
• Updated actions/cache from v5 to v6

Upstream lychee changelog

For the full lychee changelog, see:

• https://github.com/lycheeverse/lychee/releases/tag/lychee-v0.24.0
• https://github.com/lycheeverse/lychee/releases/tag/lychee-v0.24.1
• https://github.com/lycheeverse/lychee/releases/tag/lychee-v0.24.2

What’s Changed

• bump default to 0.24.1 and auto-detect lychee bin in subfolder by @​kaitlyndotmoe in #​330
• fixes #​322 check for null by @​bgermann in #​336
• Install into $RUNNER_TEMP instead of $HOME by @​mre in #​338
• Bump actions/checkout from 6 to 7 by @​dependabot in #​339
• Bump actions/cache from 5 to 6 by @​dependabot in #​340

Full Changelog: lycheeverse/lychee-action@v2.8.0...v2.9.0

trufflesecurity/trufflehog

v3.99.2

Compare Source

What's Changed

• Copy over dedupe cache size into the engine from the config by @​camgunz in #​5402

Full Changelog: trufflesecurity/trufflehog@v3.99.1...v3.99.2

v3.99.1

Compare Source

What's Changed

• Update github-actions by @​renovate[bot] in #​5363
• [INT-1084] Make the results deduplication cache size configurable by @​camgunz in #​5399

Full Changelog: trufflesecurity/trufflehog@v3.99.0...v3.99.1

v3.99.0

Compare Source

What's Changed

• Fix Sumo Logic detector ignoring configured verifier endpoints by @​unsmith in #​5395
• Add OAuth2 (ROPC) auth for verification requests by @​unsmith in #​5392

Full Changelog: trufflesecurity/trufflehog@v3.98.1...v3.99.0

v3.98.1

Compare Source

What's Changed

• Add postman source documentation by @​kashifkhan0771 in #​5389
• Add a TruffleHog dectector for Kong Konnect Platform by @​mrwanny in #​5305
• Add api_timeout_seconds to Gerrit source proto by @​kashifkhan0771 in #​5394

New Contributors

• @​mrwanny made their first contribution in #​5305

Full Changelog: trufflesecurity/trufflehog@v3.98.0...v3.98.1

v3.98.0

Compare Source

What's Changed

• Int 595 verify asymmetry by @​shahzadhaider1 in #​5261
• return error body for fetchBearerToken by @​jordanTunstill in #​5301
• Update module github.com/charmbracelet/bubbletea to v1.3.10 by @​renovate[bot] in #​5281
• Update github.com/trufflesecurity/ldap-verify digest to 3142cc9 by @​renovate[bot] in #​5280
• [INT-1086] Don't reuse maps; editing them afterwards edits them for all results by @​camgunz in #​5351
• [INT-1091] Treat Square 403 as verified on INSUFFICIENT_SCOPES by @​MuneebUllahKhan222 in #​5367
• feat: add --no-ignore-tag to report secrets on trufflehog:ignore lines by @​thiswillnevermatch in #​5293
• Fix failing TestGHCRListImages test in CI by @​MuneebUllahKhan222 in #​5368
• Revert duplicate --no-ignore-tag changes from #​5293 by @​shahzadhaider1 in #​5369
• Show progress inside S3 buckets by @​shahzadhaider1 in #​5330
• fix(output): escape special characters in --github-actions output by @​kenanyararbas in #​5353
• fix(detectors): remove stray fmt.Printf in portainertoken by @​Gracy769 in #​5334
• resolve race condition in result deduplication cache by @​kvnphvm in #​5359
• added entropy filter and improved verification for gitlab v2/v3 by @​jordanTunstill in #​5358
• Update Okta domain pat to account for mil and fedramp by @​kvnphvm in #​5355
• Corpora bench reports clean when a detector produces zero matches on both sides by @​kvnphvm in #​5357
• Add huggingface source documentation by @​kashifkhan0771 in #​5373
• Add Gitlab source documentation by @​kashifkhan0771 in #​5371
• Add Github source documentation by @​kashifkhan0771 in #​5370
• fix(detectors/auth0oauth): match Auth0 Private Cloud auth0app.com domains by @​saghaulor in #​5354
• List only the include prefixes in S3 scans by @​shahzadhaider1 in #​5377
• fix(github): switch back to fetching access token through apiClient, by @​mariduv in #​5380
• Fix NetSuite detector running out of memory on dense input by @​shahzadhaider1 in #​5383
• Add Jenkins source documentation by @​kashifkhan0771 in #​5388
• docs: point five internal links at files that exist by @​CalvinTjoaquinn in #​5375
• Add pkg/ssrf shared egress guard; use it for WithNoLocalIP and analyzer clients by @​bill-rich in #​5288

New Contributors

• @​thiswillnevermatch made their first contribution in #​5293
• @​kenanyararbas made their first contribution in #​5353
• @​Gracy769 made their first contribution in #​5334
• @​CalvinTjoaquinn made their first contribution in #​5375

Full Changelog: trufflesecurity/trufflehog@v3.97.9...v3.98.0

v3.97.9

Compare Source

What's Changed

• [SCAN-162] Add Err() to JobProgress and JobProgressRef by @​dipto-truffle in #​5346
• ci: scope Smoke timeouts to trufflehog runs, not the build by @​bryanbeverly in #​5317
• Update module github.com/aymanbagabas/go-osc52 to v1.2.2 by @​renovate[bot] in #​5252
• Update module github.com/gabriel-vasile/mimetype to v1.4.15 by @​renovate[bot] in #​5283
• make 401s for Basic auth verified false. by @​jordanTunstill in #​5290
• [INT-1088] Add version and comment_number lines to SharePoint source metadata by @​camgunz in #​5348
• Int 595 auth errors by @​shahzadhaider1 in #​5259
• Spruce up Makefile a little by @​camgunz in #​5347

Full Changelog: trufflesecurity/trufflehog@v3.97.8...v3.97.9

v3.97.8

Compare Source

What's Changed

• Add Okta OAuth support in Okta detector by @​shreyas-sriram in #​5323
• Add per detector verification timing to verification cache by @​kvnphvm in #​5341
• Set all verification errors in detectors by @​shahzadhaider1 in #​5253

Full Changelog: trufflesecurity/trufflehog@v3.97.7...v3.97.8

v3.97.7

Compare Source

What's Changed

• Recognize a missing Postgres database by SQLSTATE by @​gaborbernat in #​5312
• Improve Github App installation access token caching by @​mariduv in #​5324
• give git the real base..head range for diff scans by @​kvnphvm in #​5325
• Add GCS source documentation by @​kashifkhan0771 in #​5319
• [PERF] Remove \b anchor from escaped-unicode codePointPat by @​Ahsan-Sarbaz in #​5320
• 🐛 fix(engine): map decoded results to source lines by @​gaborbernat in #​5219

New Contributors

• @​gaborbernat made their first contribution in #​5312

Full Changelog: trufflesecurity/trufflehog@v3.97.6...v3.97.7

v3.97.6

Compare Source

What's Changed

• Clarify security policy by @​bradlarsen in #​5295
• Add git source documentation by @​kashifkhan0771 in #​5326
• fix(gitparse): cheaper low-memory git scan, stop losing trailing commits by @​kashifkhan0771 in #​5331
• analyzer/github: include is_fine_grained metadata and make gist enumeration non-fatal by @​unsmith in #​5332

Full Changelog: trufflesecurity/trufflehog@v3.97.5...v3.97.6

v3.97.5

Compare Source

What's Changed

• Update module github.com/rabbitmq/amqp091-go to v1.13.0 [SECURITY] by @​renovate[bot] in #​5274
• Update github-actions by @​renovate[bot] in #​5250
• Update dependency golangci/golangci-lint to v2.13.2 by @​renovate[bot] in #​5251
• Make GitHub App installationId optional when scanning all installations by @​kashifkhan0771 in #​5275
• [INT-942] Add HumioAPIToken detector by @​unsmith in #​5258
• Object filtering in S3 by @​shahzadhaider1 in #​5286
• feat(detectors): add Resend detector by @​mwoss in #​5103
• Clean up use of wasilibs/go-re2 by @​bradlarsen in #​5273
• Low-memory Git Scanning by @​mariduv in #​5257
• Adding no-ignore flag to allow reporting of "ignored" secrets by @​jordanTunstill in #​5297
• Postgres: drop non-connection URI params before verifying by @​jordanTunstill in #​5296
• fix(detectors/ngrok): broaden valid bearer tokens matching by @​mattbrady-1 in #​5152
• ci: avoid Node 20 BuildPulse action by @​dustin-decker in #​5266
• Introduce a new optional detector interface that will allow us to verify credentials not in the cache by @​kvnphvm in #​5298
• perf(engine): lowercase prefilter chunks as ASCII in a pooled buffer by @​kashifkhan0771 in #​5291
• Add documentation for CircleCI source by @​kashifkhan0771 in #​5268
• Add filesystem source documentation by @​kashifkhan0771 in #​5285
• Add elasticsearch source documentation by @​kashifkhan0771 in #​5284
• [SCAN-177] Purge secret parts from verification cache by @​casey-tran in #​5318

New Contributors

• @​mwoss made their first contribution in #​5103
• @​kvnphvm made their first contribution in #​5298

Full Changelog: trufflesecurity/trufflehog@v3.97.4...v3.97.5

v3.97.4

Compare Source

What's Changed

• Make Transport Errors indeterminate for Twilio secrets and twilioapikeys by @​jordanTunstill in #​5267
• Improve the json-enumerator source by @​bradlarsen in #​5265
• added tests for twilio detector fixes by @​jordanTunstill in #​5271

Full Changelog: trufflesecurity/trufflehog@v3.97.3...v3.97.4

v3.97.3

Compare Source

What's Changed

• fix(s3): cut a child context per object so key/size log values don't pile up by @​mariduv in #​5236
• Revert "[INT-933] De-base64 SourceUnit.UnitData in the GitHub Source" by @​trufflesteeeve in #​5269

Full Changelog: trufflesecurity/trufflehog@v3.97.2...v3.97.3

v3.97.2

Compare Source

What's Changed

• detectors/github/v2: differentiate token type in ExtraData by @​hartsock in #​5223
• Update dependency trufflesecurity/.github to v1.0.4 by @​renovate[bot] in #​5228
• ci: let Renovate bump the golangci-lint pin in scripts/lint.sh by @​bryanbeverly in #​5231
• Update github.com/trufflesecurity/ldap-verify digest to aa52b46 by @​renovate[bot] in #​5172
• Update github-actions by @​renovate[bot] in #​5197
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​5173
• Update module github.com/aws/smithy-go to v1.27.9 by @​renovate[bot] in #​5174
• [SCAN-18] Add SOURCE_TYPE_AWS_SECRETS_MANAGER source type by @​dipto-truffle in #​5234
• [INS-377] Add V2 for weights and biases detector by @​mustansir14 in #​4951
• Fix PagerDuty detector: treat 403 and 402 as verified credentials by @​unsmith in #​5230
• [INT-933] De-base64 SourceUnit.UnitData in the GitHub Source by @​camgunz in #​5248
• Implement Enumerate for the Jenkins source by @​Ahsan-Sarbaz in #​5229
• Update link to Truffle Security documentation by @​shahzadhaider1 in #​5256
• Retry git clone on secondary rate limit (bare 403/429) by @​kashifkhan0771 in #​5260

New Contributors

• @​hartsock made their first contribution in #​5223

Full Changelog: trufflesecurity/trufflehog@v3.97.1...v3.97.2

v3.97.1

Compare Source

What's Changed

• Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] by @​renovate[bot] in #​5196
• Fix GHEC with Data Residency (*.ghe.com) base URL by @​shahzadhaider1 in #​4777
• docs: add generic config-secret custom detector example by @​pgmpofu in #​5195
• fix(detectors/docker): don't greedy match in keyPat by @​mariduv in #​5214
• [SCAN-1020] neon scram pgx by @​alafiand in #​5217
• Raised MongoDB detector timeout value by @​jordanTunstill in #​5222
• preallocate bindings capacity in dockerhub and groq, with unit tests by @​jordanTunstill in #​5213
• [SCAN-101] S3 Source accept persisted unit envelopes in UnmarshalSourceUnit by @​amanfcp in #​5224
• Refine SECURITY.md by @​bradlarsen in #​5216
• Carry GitHub App installation ID on repo units by @​bill-rich in #​5215

New Contributors

• @​pgmpofu made their first contribution in #​5195

Full Changelog: trufflesecurity/trufflehog@v3.97.0...v3.97.1

v3.97.0

Compare Source

What's Changed

• fix(detectors/privatekey): report encrypted keys with uncrackable passphrases by @​genisis0x in #​5127
• Update module go.mongodb.org/mongo-driver to v1.17.7 [SECURITY] by @​renovate[bot] in #​5058
• Remove url tag from common HTTP client metrics by @​mcastorina in #​5158
• Update github.com/avast/apkparser di

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • "before 5am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Visit the preview URL for this PR (updated for commit 8743f43):

https://zksync-docs-staging-5eb09--pr436-renovate-all-minor-p-jd70yzro.web.app

_{(expires Tue, 20 Oct 2026 13:18:11 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: bfaafba5fa82d4f63473aaa76a21fabf1fbb3a11}