[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-python	action	minor	v7.0.0 → v7.1.0
actions/setup-python (changelog)	action	digest	5fda3b9 → 6d4fd22
github/codeql-action (changelog)	action	digest	1c5b675 → 9b32540
github/codeql-action	action	patch	v4.39.0 → v4.39.1
python	uses-with	patch	3.15.0 → 3.15.1
reviewdog/action-actionlint (changelog)	action	digest	419a493 → 48e36f5
trufflesecurity/trufflehog	action	patch	v3.99.3 → v3.99.7

---

Release Notes

actions/setup-python

v7.1.0

Compare Source

What's Changed

Enhancements

• Add mirror and mirror-token inputs for custom Python distribution sources by @​luhenry in #​1302
• Improve error message clarity by @​v-lmvysakh in #​1351

Dependency Upgrade

• Upgrade browserslist from 4.28.2 to 4.28.9 by @​dependabot in #​1353
• Upgrade @​typescript-eslint/parser from 8.62.0 to 8.70.0 by @​dependabot in #​1343
• Upgrade eslint-plugin-jest from 29.15.2 to 29.16.6 by @​dependabot in #​1342
• Upgrade @​vercel/ncc from 0.44.0 to 0.45.0 by @​dependabot in #​1357
• Upgrade @​types/semver from 7.7.1 to 7.8.0 by @​dependabot in #​1359
• Upgrade undici from 6.28.0 to 6.29.0 by @​dependabot in #​1364
• Upgrade ts-jest from 29.4.11 to 29.4.14 by @​dependabot in #​1361
• Upgrade brace-expansion from 5.0.9 to 5.0.12 by @​dependabot in #​1365
• Upgrade prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 by @​dependabot in #​1363
• Upgrade @​typescript-eslint/eslint-plugin from 8.62.0 to 8.71.1 by @​dependabot in #​1369
• Upgrade actions/checkout from 7.0.0 to 7.0.1 by @​dependabot in #​1345
• Upgrade cache to 6.3.0 by @​v-HarithaVattikuti in #​1370
• Resolve Basic Validation audit failures by @​v-HarithaVattikuti in #​1347
• Resolve npm audit failures by @​v-HarithaVattikuti in #​1350

New Contributors

• @​luhenry made their first contribution in #​1302

Full Changelog: actions/setup-python@v7.0.0...v7.1.0

github/codeql-action

v4.39.1

Compare Source

• Update default CodeQL bundle version to 2.27.3. #​4256

actions/python-versions (python)

v3.15.1: 3.15.1

Compare Source

Python 3.15.1

trufflesecurity/trufflehog

v3.99.7

Compare Source

What's Changed

• Fix --include-wikis help typo and huggingface README description by @​protonnegativo in #​5471
• fix(detectors/anypointoauth2): stop treating HTTP 422 as verified by @​jamesgol in #​5386
• Add xAI analyzer by @​serval-frenchie in #​5456
• ci(lint): pin the semgrep container image by digest by @​Portll in #​5245
• feat(detectors): add Fireworks AI API key detector by @​sudo-a-man in #​5447
• feat(detectors): add Infisical service token detector by @​Varshith-Kali in #​5445
• Fix 7z and rar panics in the archive handler and log recovered panic stacks by @​dustin-decker in #​5474

New Contributors

• @​protonnegativo made their first contribution in #​5471
• @​serval-frenchie made their first contribution in #​5456
• @​Portll made their first contribution in #​5245
• @​sudo-a-man made their first contribution in #​5447
• @​Varshith-Kali made their first contribution in #​5445

Full Changelog: trufflesecurity/trufflehog@v3.99.6...v3.99.7

v3.99.6

Compare Source

v3.99.5 was tagged but never published because its release build failed. v3.99.6 supersedes it and includes all of the changes below.

What's Changed

• Update github-actions by @​renovate[bot] in #​5414
• Prefer nearest client/tenant IDs for Azure SP secrets by @​kashifkhan0771 in #​5449
• Clean up Filesystem source logging for per-source debug by @​kashifkhan0771 in #​5465
• security: bump andybalholm/brotli to v1.2.7 (CVE-2026-111497) by @​dustin-decker in #​5472
• Keep GoReleaser temp files off the tmpfs /tmp in releases by @​dustin-decker in #​5473

Full Changelog: trufflesecurity/trufflehog@v3.99.4...v3.99.6

v3.99.5

Compare Source

v3.99.4

Compare Source

What's Changed

• Add per-source debug option and hide sensitive data in debug logs by @​kashifkhan0771 in #​5446
• Mark results whose verification was skipped by @​unsmith in #​5448
• Clean up Git source logging for per-source debug by @​kashifkhan0771 in #​5451
• Add Lambda Cloud API key detector by @​lukem-ts in #​5435
• Update github.com/trufflesecurity/ldap-verify digest to 4a15faf by @​renovate[bot] in #​5441
• Update dependency trufflesecurity/.github to v1.0.5 by @​renovate[bot] in #​5442
• Update module golang.org/x/crypto to v0.56.0 [SECURITY] by @​renovate[bot] in #​5462
• Update module golang.org/x/net to v0.60.0 [SECURITY] by @​renovate[bot] in #​5464
• Update module github.com/yuin/goldmark to v1.7.17 [SECURITY] by @​renovate[bot] in #​5460
• github: check App installation grants before listing comments by @​unsmith in #​5454

Full Changelog: trufflesecurity/trufflehog@v3.99.3...v3.99.4

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • "before 6am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.