[dependabot]

Bumps trufflesecurity/trufflehog from 3.99.7 to 3.99.8.

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.99.8

What's Changed

• Skip GitHub comment errors when issues or PRs are off by @​kashifkhan0771 in trufflesecurity/trufflehog#5467
• [SCAN-180]: Populate SecretParts for custom detector results by @​casey-tran in trufflesecurity/trufflehog#5470
• Clean up S3 source logging for per-source debug by @​kashifkhan0771 in trufflesecurity/trufflehog#5481
• Clean up GitHub source logging for per-source debug by @​kashifkhan0771 in trufflesecurity/trufflehog#5457
• feat(detectors): add Composio API key detector by @​groovyBugify in trufflesecurity/trufflehog#5322
• Clean up Docker source logging for per-source debug by @​kashifkhan0771 in trufflesecurity/trufflehog#5494
• Add source fields to Init logs in single-source CLI commands by @​kashifkhan0771 in trufflesecurity/trufflehog#5466
• Close Couchbase clusters after verification and honor the context by @​unsmith in trufflesecurity/trufflehog#5489
• [SCAN-317] Recover from detector panics in the verification overlap worker by @​dipto-truffle in trufflesecurity/trufflehog#5495
• Cap 7z LZMA and LZMA2 dictionary sizes and keep scanning past refused entries by @​bryanbeverly in trufflesecurity/trufflehog#5483
• Update module github.com/go-git/go-git/v5 to v5.19.3 by @​renovate[bot] in trufflesecurity/trufflehog#5480
• Update module github.com/jlaffaye/ftp to v0.2.4 by @​renovate[bot] in trufflesecurity/trufflehog#5365
• Update module github.com/mattn/go-isatty to v0.0.24 by @​renovate[bot] in trufflesecurity/trufflehog#5366
• Clean up GitLab source logging for per-source debug by @​kashifkhan0771 in trufflesecurity/trufflehog#5485
• Verify BoxOauth credentials only when Box issues a token for a subject by @​unsmith in trufflesecurity/trufflehog#5498

New Contributors

• @​groovyBugify made their first contribution in trufflesecurity/trufflehog#5322

Full Changelog: trufflesecurity/trufflehog@v3.99.7...v3.99.8

Commits

• ea68ca0 Verify BoxOauth credentials only when Box issues a token for a subject (#5498)
• 7238e0e Clean up GitLab source logging for per-source debug (#5485)
• 5a3176f Update module github.com/mattn/go-isatty to v0.0.24 (#5366)
• a74daf6 Update module github.com/jlaffaye/ftp to v0.2.4 (#5365)
• 1641840 Update module github.com/go-git/go-git/v5 to v5.19.3 (#5480)
• ee5d0d2 Cap 7z LZMA and LZMA2 dictionary sizes and keep scanning past refused entries...
• 421026a Recover from detector panics in the verification overlap worker (#5495)
• 6973459 Close Couchbase clusters after verification and honor the context (#5489)
• 87adc84 Add source fields to Init logs in single-source CLI commands (#5466)
• 020634e Clean up Docker source logging for per-source debug (#5494)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking request to align the explicit scanner versions.

Findings

1.  Scanner pins disagree ▶

Fix with agent prompt

### Issue 1
.github/workflows/trufflehog-ci.yml:19
The action now points to `v3.99.8`, but both this workflow and `.github/workflows/trufflehog-weekly.yml` still pass `version: 3.99.7`. Keeping these pins out of sync risks leaving scans on the older release despite this update. Update the `version` input to `3.99.8` in both files too.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Updates the pinned TruffleHog action from v3.99.7 to v3.99.8 in both scan workflows.

• Both secret-scan workflows now point to the TruffleHog v3.99.8 action revision.

_{Reviews (1) · Last reviewed commit: "Bump trufflesecurity/trufflehog from 3.9..." · Reviewed by Greptile}

[greptile-apps]

Scanner pins disagree

The action now points to v3.99.8, but both this workflow and .github/workflows/trufflehog-weekly.yml still pass version: 3.99.7. Keeping these pins out of sync risks leaving scans on the older release despite this update. Update the version input to 3.99.8 in both files too.

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/trufflehog-ci.yml
Line: 19

Comment:
**Scanner pins disagree**

The action now points to `v3.99.8`, but both this workflow and `.github/workflows/trufflehog-weekly.yml` still pass `version: 3.99.7`. Keeping these pins out of sync risks leaving scans on the older release despite this update. Update the `version` input to `3.99.8` in both files too.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.