build(deps): bump trufflesecurity/trufflehog from 3.95.7 to 3.95.9

[dependabot]

Bumps trufflesecurity/trufflehog from 3.95.7 to 3.95.9.

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.95.9

What's Changed

• feat: add OpenRouter detector by @​McPatate in trufflesecurity/trufflehog#4500
• Integrations fully codeowns detectors by @​trufflesteeeve in trufflesecurity/trufflehog#5104
• [INS-332] Add New Relic Insights Insert key detector by @​mustansir14 in trufflesecurity/trufflehog#4778
• [INS-351] Added Duffel Token Detector by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#4795
• [INS-341] Added Shippo detector by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#4820
• [INS-467] Add IPinfo detector to default detectors list by @​mustansir14 in trufflesecurity/trufflehog#4970
• fix: reject --include-repos/--exclude-repos with --repo in github scan by @​kashifkhan0771 in trufflesecurity/trufflehog#5112
• [INS-468] Add improved lob detector to defaults.go by @​mustansir14 in trufflesecurity/trufflehog#4971
• feat(action): add image input to allow registry mirror overrides by @​eightseventhreethree in trufflesecurity/trufflehog#4965
• feat: Support archived repo exclusion from GH org scans by @​hibare in trufflesecurity/trufflehog#4875
• [INT-715] Retry transient failures when verifying OpenAI keys by @​bill-rich in trufflesecurity/trufflehog#5117
• [INS-410] Added batch token detector by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#4824
• [INT-650] Don't log as error when git diff is too long by @​bill-rich in trufflesecurity/trufflehog#5113

New Contributors

• @​McPatate made their first contribution in trufflesecurity/trufflehog#4500
• @​eightseventhreethree made their first contribution in trufflesecurity/trufflehog#4965

Full Changelog: trufflesecurity/trufflehog@v3.95.8...v3.95.9

v3.95.8

What's Changed

• removed "unauthorized" as exception for rotated graphana secrets by @​jordanTunstill in trufflesecurity/trufflehog#5068
• fix(azuresastoken): match SAS tokens regardless of parameter order by @​genisis0x in trufflesecurity/trufflehog#5043
• Add prometheus metrics for engine channels and workers by @​mcastorina in trufflesecurity/trufflehog#5095
• [INS-465] Skip unverified JWT Detector results when feature flag is enabled by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#5072
• [INS-334] Octopus Deploy detector by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#4787
• Fix Syntax error in feature.go by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#5109
• Include encoded resume info instead of clobbering it by @​bill-rich in trufflesecurity/trufflehog#5110

Full Changelog: trufflesecurity/trufflehog@v3.95.7...v3.95.8

Commits

• 27b0417 Don't log as error when git diff is too long (#5113)
• d328285 [INS-410] Added batch token detector (#4824)
• 33d9dad [INT-715] Retry transient failures when verifying OpenAI keys (#5117)
• d7dcc6d feat: Support archived repo exclusion from GH org scans (#4875)
• f845f18 feat(action): add image input to allow registry mirror overrides (#4965)
• 6c97970 [INS-468] Add improved lob detector to defaults.go (#4971)
• 1675e17 fix: reject --include-repos/--exclude-repos with --repo in github scan (#5112)
• 5c27626 [INS-467] Add IPinfo detector to default detectors list (#4970)
• 53e6391 [INS-341] Added Shippo detector (#4820)
• d3b5487 [INS-351] Added Duffel Token Detector (#4795)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 11, 2026, 8:56 AM ET / 12:56 UTC.

Summary
Updates the TruffleHog GitHub Action in .github/workflows/secret-scan.yml from v3.95.7 to v3.95.9.

Reproducibility: not applicable. this is a bot-generated dependency update rather than a reported behavioral defect requiring reproduction.

Review metrics: 2 noteworthy metrics.

• Workflow scope: 1 file, 1 action reference changed. The dependency update is narrowly scoped and straightforward to audit.
• Validation: 10 checks passed, 0 failed. The exact PR head is cleanly mergeable with the modified secret-scan workflow and full CI passing.

Root-cause cluster
Relationship: canonical
Canonical: #121
Summary: This PR is the current canonical TruffleHog patch update and supersedes the earlier Dependabot update.

Members:

• superseded: build(deps): bump trufflesecurity/trufflehog from 3.95.7 to 3.95.8 #119 - Dependabot explicitly closed the earlier v3.95.8 update as superseded by this v3.95.9 PR.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Next step before merge

• [P2] The clean, fully validated PR needs ordinary code-owner review and merge handling rather than an automated repair.

Security
Cleared: The patch updates an existing third-party action to a published patch release without broadening permissions, secret access, or repository-controlled inputs, and the modified workflow passes.

Review details

Best possible solution:

Merge the narrow patch update through the normal workflow code-owner path while preserving the existing scan configuration.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a bot-generated dependency update rather than a reported behavioral defect requiring reproduction.

Is this the best way to solve the issue?

Yes. Updating the existing action reference in place is the narrowest maintainable approach and preserves the workflow's permissions, inputs, and scan behavior.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against d91dcdb22870.

Label changes

Label changes:

• add P3: This is low-risk, routine patch-level maintenance of a GitHub Actions dependency.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The external-contributor real-setup proof gate does not apply to this Dependabot-authored maintenance PR; live workflow checks provide appropriate supplemental validation.

Label justifications:

• P3: This is low-risk, routine patch-level maintenance of a GitHub Actions dependency.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The external-contributor real-setup proof gate does not apply to this Dependabot-authored maintenance PR; live workflow checks provide appropriate supplemental validation.

Evidence reviewed

What I checked:

• Current-main behavior: Current main still references trufflesecurity/trufflehog@v3.95.7, confirming that the requested update has not already landed. (.github/workflows/secret-scan.yml:62, d91dcdb22870)
• Narrow branch diff: The proposed commit changes only the TruffleHog action version, with one insertion and one deletion. (.github/workflows/secret-scan.yml:62, efbe4afad632)
• Live validation: All live checks passed on the exact PR head, including two secret-scan executions, tests, lint, dependency checks, release checks, Docker, and CodeQL. (.github/workflows/secret-scan.yml:62, efbe4afad632)
• Upstream provenance: TruffleHog published v3.95.9 on July 9, 2026, and the release tag resolves to upstream commit 27b0417c16317ca9a472a9a8092acce143b49c55. (27b0417c1631)
• Action compatibility: The upstream action change adds an optional registry-image input while retaining ghcr.io/trufflesecurity/trufflehog as its default; this repository does not set or depend on the new input. (.github/workflows/secret-scan.yml:62, 27b0417c1631)
• Feature history: The verified-secret workflow dates to commit 0da02de393a7; subsequent TruffleHog and CI updates were carried by Peter Steinberger and Dependabot, including the current release-carried version. (.github/workflows/secret-scan.yml:1, 0da02de393a7)

Likely related people:

• Peter Steinberger: Authored the release-carried workflow version and several recent TruffleHog or CI dependency updates. (role: recent workflow contributor; confidence: high; commits: 6dbb9e2c5e8e, af61d96d5755, 5a64429fb61e; files: .github/workflows/secret-scan.yml)
• Vincent Koc: Introduced verified secret scanning and has another historical contribution to this workflow. (role: introduced behavior; confidence: high; commits: 0da02de393a7; files: .github/workflows/secret-scan.yml)
• openclaw/openclaw-secops: The repository CODEOWNERS file explicitly routes .github/workflows/ changes to this team. (role: code owner team; confidence: high; files: .github/CODEOWNERS, .github/workflows/secret-scan.yml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Maintainer verification on exact head efbe4afad6323ef436ea77bd16147107943ba65a against current origin/main:

• git diff --check origin/main...HEAD passed.
• actionlint .github/workflows/secret-scan.yml passed with actionlint 1.7.12.
• Live workflow proof: both exact-head Scan for Verified Secrets jobs passed using TruffleHog v3.95.9; the remaining eight hosted checks also passed.
• .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main --stream-engine-output reported no accepted/actionable findings (0.99 confidence).
• The one-line patch preserves permissions, inputs, and scan range. Maintenance-only; no changelog entry needed.

No merge performed; land-ready.