Skip to content

chore(deps): bump the security-scanners group across 1 directory with 2 updates - #403

Merged
bedatty merged 1 commit into
developfrom
dependabot/github_actions/develop/security-scanners-85af15cdf5
Jun 17, 2026
Merged

chore(deps): bump the security-scanners group across 1 directory with 2 updates#403
bedatty merged 1 commit into
developfrom
dependabot/github_actions/develop/security-scanners-85af15cdf5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 8, 2026

Copy link
Copy Markdown
Contributor

Bumps the security-scanners group with 2 updates in the / directory: securego/gosec and trufflesecurity/trufflehog.

Updates securego/gosec from 2.26.1 to 2.27.1

Release notes

Sourced from securego/gosec's releases.

v2.27.1

Changelog

  • 9e6a9843d7a4a6e3e9a8539b02612c8a4aa3f889 Downgrade google lib to avoid min Go version bump (#1687)

v2.27.0

Changelog

  • 0a5c6504c46569257663726ac54c7cfdad42e846 Downgrade the jsonschema dep to v0.13.0 due to incompatibility with anthropick-sdk-go (#1686)
  • b48e668764ca9fd826a7b84c9e9194af3227fade Update all dependencies (#1685)
  • bd17b2589eb634e511b352f14fc30cb40863eefe Downgrade the github.com/invopop/jsonschema v0.13.0 to solve incopatibility with anthropic-sdk (#1683)
  • c6f8c3d9a75d897612c7beb55007ac5f29b2e3a2 Update all dependencies (#1682)
  • 5676cbccda635b33fab15bb85e32b2e741c9372f Update vulnerabilities alerts for indirect dependencies
  • ce167d4a37bc5fe3f49bb9be3209f9759b69ff6f Pin dependencies (#1681)
  • 74b726dfcebf218a1984a51b44fe962aecef5921 Skip pining for my repos
  • a68f8825bfa51b46cc517a5cd8baf4848e03a8d1 Update renovate configuration
  • 2f8791bad7bf8f6a11f0b29e41aec54ddb9fcb0b Fix typo
  • ad3778a7be907bf4e5cf5ed5c63333a377f3fb3b Update branch config in renovate config
  • b1583fe2f3ffb41074cb11996e58ca554c6c04e7 Migrate config renovate.json (#1678)
  • 139e33d474374c8e26a0e480f077526e131f43bb Update renovate to refresh the branch creation
  • f3c03ebb7f077f9b9ddfc64f710e0a2d2e92ded4 Update the renovate branch prefix
  • 85814f2e3964a6d38aeb6e6002ac9268c16fcab5 Update renovate config to pin the actions dependencies by digests (#1676)
  • 55f051973281b15900b2b8b30aaf467a7b9127ea Migrate the html remport to react v19. (#1675)
  • 6ad4476d269895a4a9b77883b3e3503f7e5e4103 Manually update version to fix renovate (#1674)
  • 8f88312a5f80dbf04d2248d75c372d165e54e589 feat: integrate Atlas Cloud provider (#1672)
  • 6351b0c6fcc7d75acb230a9be7f9047aada322ae Refactor error position parsing to support path with colon. (#1673)
  • de65614d10a6b84029e3e1215567b8ce7e490f23 Add two options to require rule ID and justificaiton for inline annotations (#1671)
  • e354c572d957eb8bf63481cc9ba2704b58a6ae35 Fix false positive in G118 when cancel is stored in a slice/map (#1670)
  • 4161f0b4333859990584c9fb3fd377a892eaf477 chore(go): update supported Go versions to 1.25.10 and 1.26.3 (#1669)
  • b4f29347566880540afec8205b633d2859377cec Harden the github workflows and action (#1665)
  • b7aca268861108d4446959fa92d2fe808eb7aa6f Fix justification delimiter in annotation format doc (#1661)
  • 945bce72d26a794e25a122d87527d063bf887903 Update all dependencies (#1664)
  • 5f4eec95fa28ce5dc6cf555de8c242cb57545f01 Update action to use gosec version v2.26.1 (#1660)
Commits
  • 9e6a984 Downgrade google lib to avoid min Go version bump (#1687)
  • 0a5c650 Downgrade the jsonschema dep to v0.13.0 due to incompatibility with anthropic...
  • b48e668 Update all dependencies (#1685)
  • bd17b25 Downgrade the github.com/invopop/jsonschema v0.13.0 to solve incopatibility w...
  • c6f8c3d Update all dependencies (#1682)
  • 5676cbc Update vulnerabilities alerts for indirect dependencies
  • ce167d4 Pin dependencies (#1681)
  • 74b726d Skip pining for my repos
  • a68f882 Update renovate configuration
  • 2f8791b Fix typo
  • Additional commits viewable in compare view

Updates trufflesecurity/trufflehog from 3.95.3 to 3.95.5

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.95.5

What's Changed

New Contributors

Full Changelog: trufflesecurity/trufflehog@v3.95.3...v3.95.5

v3.95.4

What's Changed

... (truncated)

Commits
  • d411fff feat(apk): adds some debugging info for APKs and fixes issues parsing obfusca...
  • 26eae1f [SCAN-795] HTML decoder: ASPX and entity-encoded HTML support (#4981)
  • 6c8f640 Added source config flags to sharepoint proto (#4972)
  • 9f0b97f Update CODEOWNERS: replace 5 slugs with scanning + integrations (#4983)
  • 36f6f69 Pin GitHub Actions to SHA digests (#4985)
  • 52ebebb Update Go security dependencies (#4986)
  • ec67ff2 Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors (#4961)
  • 0ec3634 Fix line numbers for duplicate secrets within a chunk (#4910)
  • 79acbf4 Remove over speculation from Corpora CI workflow (#4974)
  • d86254e feat: add host, db and username to ExtraData for database detectors (#4849)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Dependency updates (usually opened by Dependabot) github-actions Updates to GitHub Actions dependencies (Dependabot ecosystem) labels Jun 8, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner June 8, 2026 11:08
@dependabot dependabot Bot added dependencies Dependency updates (usually opened by Dependabot) github-actions Updates to GitHub Actions dependencies (Dependabot ecosystem) labels Jun 8, 2026
@lerian-studio lerian-studio added size/XS PR changes < 50 lines workflow Changes to one or more reusable workflow files security Changes to security workflows or vulnerability reporting policy golang Changes to Go-related workflows and removed dependencies Dependency updates (usually opened by Dependabot) labels Jun 8, 2026
@lerian-studio

lerian-studio commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

🔍 Lint Analysis

Check Files Scanned Status
YAML Lint 2 file(s) ✅ success
Action Lint 2 file(s) ✅ success
Pinned Actions 2 file(s) ✅ success
Markdown Link Check no changes ⏭️ skipped
Spelling Check 2 file(s) ✅ success
Shell Check 2 file(s) ✅ success
README Check 2 file(s) ✅ success
Composite Schema no changes ⏭️ skipped
Deployment Matrix no changes ⏭️ skipped

🔍 View full scan logs

@lerian-studio

lerian-studio commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Check Status Blocking
Source Branch ✅ success yes
PR Title ✅ success yes
PR Description ✅ success yes
PR Size ✅ success no
Auto Labels ✅ success no
PR Metadata ✅ success no

🔍 View workflow run

@lerian-studio

lerian-studio commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

🛡️ CodeQL Analysis Results

Languages analyzed: actions

✅ No security issues found.


🔍 View full scan logs | 🛡️ Security tab

… 2 updates

Bumps the security-scanners group with 2 updates in the / directory: [securego/gosec](https://github.com/securego/gosec) and [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog).


Updates `securego/gosec` from 2.26.1 to 2.27.1
- [Release notes](https://github.com/securego/gosec/releases)
- [Commits](securego/gosec@4a3bd8a...9e6a984)

Updates `trufflesecurity/trufflehog` from 3.95.3 to 3.95.5
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases)
- [Commits](trufflesecurity/trufflehog@37b7700...d411fff)

---
updated-dependencies:
- dependency-name: securego/gosec
  dependency-version: 2.27.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: security-scanners
- dependency-name: trufflesecurity/trufflehog
  dependency-version: 3.95.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: security-scanners
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump the security-scanners group with 2 updates chore(deps): bump the security-scanners group across 1 directory with 2 updates Jun 15, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/develop/security-scanners-85af15cdf5 branch from 7021955 to f8ce377 Compare June 15, 2026 11:08
@bedatty
bedatty merged commit 3b8d504 into develop Jun 17, 2026
1 check passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/develop/security-scanners-85af15cdf5 branch June 17, 2026 19:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

github-actions Updates to GitHub Actions dependencies (Dependabot ecosystem) golang Changes to Go-related workflows security Changes to security workflows or vulnerability reporting policy size/XS PR changes < 50 lines workflow Changes to one or more reusable workflow files

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants