chore(deps): bump the actions group with 4 updates (#165)

Bumps the actions group with 4 updates:
[actions/checkout](https://github.com/actions/checkout),
[github/codeql-action](https://github.com/github/codeql-action),
[trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog)
and
[hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml](https://github.com/hyperpolymath/panic-attacker).

Updates `actions/checkout` from 6.0.2 to 6.0.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v6.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Update changelog by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>Update changelog for v6.0.3 by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/yaananth"><code>@​yaananth</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>v6.0.3</h2>
<ul>
<li>Fix checkout init for SHA-256 repositories by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li>
<li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a
href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li>
</ul>
<h2>v6.0.2</h2>
<ul>
<li>Fix tag handling: preserve annotations and explicit fetch-tags by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li>
</ul>
<h2>v6.0.1</h2>
<ul>
<li>Add worktree support for persist-credentials includeIf by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li>
</ul>
<h2>v6.0.0</h2>
<ul>
<li>Persist creds to a separate file by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li>
<li>Update README to include Node.js 24 support details and requirements
by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li>
</ul>
<h2>v5.0.1</h2>
<ul>
<li>Port v6 cleanup to v5 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li>
</ul>
<h2>v5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>v4.3.1</h2>
<ul>
<li>Port v6 cleanup to v4 by <a
href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li>
</ul>
<h2>v4.3.0</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<h2>v4.2.0</h2>
<ul>
<li>Add Ref and Commit outputs by <a
href="https://github.com/lucacome"><code>@​lucacome</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1180">actions/checkout#1180</a></li>
<li>Dependency updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>- <a
href="https://redirect.github.com/actions/checkout/pull/1777">actions/checkout#1777</a>,
<a
href="https://redirect.github.com/actions/checkout/pull/1872">actions/checkout#1872</a></li>
</ul>
<h2>v4.1.7</h2>
<ul>
<li>Bump the minor-npm-dependencies group across 1 directory with 4
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1739">actions/checkout#1739</a></li>
<li>Bump actions/checkout from 3 to 4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1697">actions/checkout#1697</a></li>
<li>Check out other refs/* by commit by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1774">actions/checkout#1774</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a>
Update changelog for v6.0.3 (<a
href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/1cce3390c2bfda521930d01229c073c7ff920824"><code>1cce339</code></a>
Fix checkout init for SHA-256 repositories (<a
href="https://redirect.github.com/actions/checkout/issues/2439">#2439</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/900f2210b1d28bbbd0bd22d17926b9e224e8f231"><code>900f221</code></a>
fix: expand merge commit SHA regex and add SHA-256 test cases (<a
href="https://redirect.github.com/actions/checkout/issues/2414">#2414</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/0c366fd6a839edf440554fa01a7085ccba70ac98"><code>0c366fd</code></a>
Update changelog (<a
href="https://redirect.github.com/actions/checkout/issues/2357">#2357</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action` from 4.36.0 to 4.36.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.36.1</h2>
<p>No user facing changes.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.36.1 - 02 Jun 2026</h2>
<p>No user facing changes.</p>
<h2>4.36.0 - 22 May 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.19.4. <a
href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li>
<li>Add support for SHA-256 Git object IDs. <a
href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li>
</ul>
<h2>4.35.5 - 15 May 2026</h2>
<ul>
<li>We have improved how the JavaScript bundles for the CodeQL Action
are generated to avoid duplication across bundles and reduce the size of
the repository by around 70%. This should have no effect on the runtime
behaviour of the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li>
<li>For performance and accuracy reasons, <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> will now only be enabled on a pull request when
diff-informed analysis is also enabled for that run. If diff-informed
analysis is unavailable (for example, because the PR diff ranges could
not be computed), the action will fall back to a full analysis. <a
href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li>
<li>If multiple inputs are provided for the GitHub-internal
<code>analysis-kinds</code> input, only <code>code-scanning</code> will
be enabled. The <code>analysis-kinds</code> input is experimental, for
GitHub-internal use only, and may change without notice at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li>
<li>Added an experimental change which, when running a Code Scanning
analysis for a PR with <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a> enabled, prefers CodeQL CLI versions that have
a cached overlay-base database for the configured languages. This speeds
up analysis for a repository when there is not yet a cached overlay-base
database for the latest CLI version. We expect to roll this change out
to everyone in May. <a
href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li>
</ul>
<h2>4.35.4 - 07 May 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li>
</ul>
<h2>4.35.3 - 01 May 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: Add a deprecation warning for
customers using CodeQL version 2.19.3 and earlier. These versions of
CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise
Server 3.15, and will be unsupported by the next minor release of the
CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li>
<li>Configurations for private registries that use Cloudsmith or GCP
OIDC are now accepted. <a
href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li>
<li>Best-effort connection tests for private registries now use
<code>GET</code> requests instead of <code>HEAD</code> for better
compatibility with various registry implementations. For NuGet feeds,
the test is now always performed against the service index. <a
href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li>
<li>Fixed a bug where two diagnostics produced within the same
millisecond could overwrite each other on disk, causing one of them to
be lost. <a
href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3">2.25.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3865">#3865</a></li>
</ul>
<h2>4.35.2 - 15 Apr 2026</h2>
<ul>
<li>The undocumented TRAP cache cleanup feature that could be enabled
using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment
variable is deprecated and will be removed in May 2026. If you are
affected by this, we recommend disabling TRAP caching by passing the
<code>trap-caching: false</code> input to the <code>init</code> Action.
<a
href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li>
<li>The Git version 2.36.0 requirement for improved incremental analysis
now only applies to repositories that contain submodules. <a
href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li>
<li>Python analysis on GHES no longer extracts the standard library,
relying instead on models of the standard library. This should result in
significantly faster extraction and analysis times, while the effect on
alerts should be minimal. <a
href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li>
<li>Fixed a bug in the validation of OIDC configurations for private
registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li>
</ul>
<h2>4.35.1 - 27 Mar 2026</h2>
<ul>
<li>Fix incorrect minimum required Git version for <a
href="https://redirect.github.com/github/roadmap/issues/1158">improved
incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a
href="https://redirect.github.com/github/codeql-action/pull/3781">#3781</a></li>
</ul>
<h2>4.35.0 - 27 Mar 2026</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/87557b9c84dde89fdd9b10e88954ac2f4248e463"><code>87557b9</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3940">#3940</a>
from github/update-v4.36.1-2a1689ed4</li>
<li><a
href="https://github.com/github/codeql-action/commit/94310119648b77e2153bf970fd244062806781de"><code>9431011</code></a>
Update changelog for v4.36.1</li>
<li><a
href="https://github.com/github/codeql-action/commit/2a1689ed43ccdf7eea07e03a75371ce6801d28e6"><code>2a1689e</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3939">#3939</a>
from github/henrymercer/skip-overlay-revert-when-exp...</li>
<li><a
href="https://github.com/github/codeql-action/commit/524532393a46071bdfc81527a811ffa69e16723a"><code>5245323</code></a>
Disable missing diff-ranges fallback when overlay enabled manually</li>
<li><a
href="https://github.com/github/codeql-action/commit/d1eb1207b45130d2edf64a0aa1c93be23510592f"><code>d1eb120</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3933">#3933</a>
from github/update-supported-enterprise-server-versions</li>
<li><a
href="https://github.com/github/codeql-action/commit/115001ba8d0198846992657731666b08686c8ded"><code>115001b</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3934">#3934</a>
from github/dependabot/npm_and_yarn/npm-minor-86fb5c...</li>
<li><a
href="https://github.com/github/codeql-action/commit/cef2e7a910879f4626a24b251504bde16bfe4e76"><code>cef2e7a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3925">#3925</a>
from github/dependabot/github_actions/dot-github/wor...</li>
<li><a
href="https://github.com/github/codeql-action/commit/5e6adf70ed0299cdf20f90e4e37ac5dd30ab7501"><code>5e6adf7</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3936">#3936</a>
from github/dependabot/npm_and_yarn/tmp-0.2.7</li>
<li><a
href="https://github.com/github/codeql-action/commit/ad170e6c4eaf671895978420267d6cb49b66b706"><code>ad170e6</code></a>
Merge branch 'main' into
dependabot/github_actions/dot-github/workflows/actio...</li>
<li><a
href="https://github.com/github/codeql-action/commit/6a37b3a57ac457a679b84930a67c233c15f5ac41"><code>6a37b3a</code></a>
Rebuild</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/7211b7c8077ea37d8641b6271f6a365a22a5fbfa...87557b9c84dde89fdd9b10e88954ac2f4248e463">compare
view</a></li>
</ul>
</details>
<br />

Updates `trufflesecurity/trufflehog` from 3.95.3 to 3.95.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/trufflesecurity/trufflehog/releases">trufflesecurity/trufflehog's
releases</a>.</em></p>
<blockquote>
<h2>v3.95.5</h2>
<h2>What's Changed</h2>
<ul>
<li>[INS-461] Add test to ensure new detectors are registered in
defaults.go by <a
href="https://github.com/mustansir14"><code>@​mustansir14</code></a> in
<a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4915">trufflesecurity/trufflehog#4915</a></li>
<li>[INS-455] Unify common logic in Atlassian Data Center detectors by
<a href="https://github.com/mustansir14"><code>@​mustansir14</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4907">trufflesecurity/trufflehog#4907</a></li>
<li>fix(github): cache repo info under original URL on redirect by <a
href="https://github.com/kashifkhan0771"><code>@​kashifkhan0771</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4958">trufflesecurity/trufflehog#4958</a></li>
<li>Added GitLab OAuth Detector by <a
href="https://github.com/shahzadhaider1"><code>@​shahzadhaider1</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4729">trufflesecurity/trufflehog#4729</a></li>
<li>Box Detector: Extract Subject ID for Analyzer Integration by <a
href="https://github.com/shahzadhaider1"><code>@​shahzadhaider1</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4761">trufflesecurity/trufflehog#4761</a></li>
<li>[INS-346] SpectralOps Personal API Key Detector by <a
href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4770">trufflesecurity/trufflehog#4770</a></li>
<li>[INS-335] Added AWS Appsync Detector by <a
href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4803">trufflesecurity/trufflehog#4803</a></li>
<li>fix(twilio): deduplicate matches to prevent O(N×M) result explosion
by <a
href="https://github.com/kashifkhan0771"><code>@​kashifkhan0771</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4954">trufflesecurity/trufflehog#4954</a></li>
<li>Automate corpora testing in CI by <a
href="https://github.com/mustansir14"><code>@​mustansir14</code></a> in
<a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4927">trufflesecurity/trufflehog#4927</a></li>
<li>Enable errcheck and staticcheck for golangci-lint v2 and resolve all
issues by <a
href="https://github.com/amanfcp"><code>@​amanfcp</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4924">trufflesecurity/trufflehog#4924</a></li>
<li>feat: add host, db and username to ExtraData for database detectors
by <a href="https://github.com/mariocj89"><code>@​mariocj89</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4849">trufflesecurity/trufflehog#4849</a></li>
<li>Remove over speculation from Corpora CI workflow by <a
href="https://github.com/mustansir14"><code>@​mustansir14</code></a> in
<a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4974">trufflesecurity/trufflehog#4974</a></li>
<li>Fix line numbers for duplicate secrets within a chunk by <a
href="https://github.com/amanfcp"><code>@​amanfcp</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4910">trufflesecurity/trufflehog#4910</a></li>
<li>Add feature flags for Pinecone, Cloudinary, and GitLab OAuth
detectors by <a
href="https://github.com/camgunz"><code>@​camgunz</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4961">trufflesecurity/trufflehog#4961</a></li>
<li>Update Go security dependencies by <a
href="https://github.com/cursor"><code>@​cursor</code></a>[bot] in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4986">trufflesecurity/trufflehog#4986</a></li>
<li>Pin GitHub Actions to SHA digests by <a
href="https://github.com/bryanbeverly"><code>@​bryanbeverly</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4985">trufflesecurity/trufflehog#4985</a></li>
<li>Update CODEOWNERS: replace 5 slugs with scanning + integrations by
<a
href="https://github.com/bryanbeverly"><code>@​bryanbeverly</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4983">trufflesecurity/trufflehog#4983</a></li>
<li>Added source config flags to sharepoint proto by <a
href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4972">trufflesecurity/trufflehog#4972</a></li>
<li>[SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by <a
href="https://github.com/mustansir14"><code>@​mustansir14</code></a> in
<a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4981">trufflesecurity/trufflehog#4981</a></li>
<li>adds some debugging info for APKs and fixes issues parsing
obfuscated APKs by <a
href="https://github.com/johannestaas-trufflesec"><code>@​johannestaas-trufflesec</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4991">trufflesecurity/trufflehog#4991</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/mariocj89"><code>@​mariocj89</code></a>
made their first contribution in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4849">trufflesecurity/trufflehog#4849</a></li>
<li><a href="https://github.com/cursor"><code>@​cursor</code></a>[bot]
made their first contribution in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4986">trufflesecurity/trufflehog#4986</a></li>
<li><a
href="https://github.com/johannestaas-trufflesec"><code>@​johannestaas-trufflesec</code></a>
made their first contribution in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4991">trufflesecurity/trufflehog#4991</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/trufflesecurity/trufflehog/compare/v3.95.3...v3.95.5">https://github.com/trufflesecurity/trufflehog/compare/v3.95.3...v3.95.5</a></p>
<h2>v3.95.4</h2>
<h2>What's Changed</h2>
<ul>
<li>[INS-461] Add test to ensure new detectors are registered in
defaults.go by <a
href="https://github.com/mustansir14"><code>@​mustansir14</code></a> in
<a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4915">trufflesecurity/trufflehog#4915</a></li>
<li>[INS-455] Unify common logic in Atlassian Data Center detectors by
<a href="https://github.com/mustansir14"><code>@​mustansir14</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4907">trufflesecurity/trufflehog#4907</a></li>
<li>fix(github): cache repo info under original URL on redirect by <a
href="https://github.com/kashifkhan0771"><code>@​kashifkhan0771</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4958">trufflesecurity/trufflehog#4958</a></li>
<li>Added GitLab OAuth Detector by <a
href="https://github.com/shahzadhaider1"><code>@​shahzadhaider1</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4729">trufflesecurity/trufflehog#4729</a></li>
<li>Box Detector: Extract Subject ID for Analyzer Integration by <a
href="https://github.com/shahzadhaider1"><code>@​shahzadhaider1</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4761">trufflesecurity/trufflehog#4761</a></li>
<li>[INS-346] SpectralOps Personal API Key Detector by <a
href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4770">trufflesecurity/trufflehog#4770</a></li>
<li>[INS-335] Added AWS Appsync Detector by <a
href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4803">trufflesecurity/trufflehog#4803</a></li>
<li>fix(twilio): deduplicate matches to prevent O(N×M) result explosion
by <a
href="https://github.com/kashifkhan0771"><code>@​kashifkhan0771</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4954">trufflesecurity/trufflehog#4954</a></li>
<li>Automate corpora testing in CI by <a
href="https://github.com/mustansir14"><code>@​mustansir14</code></a> in
<a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4927">trufflesecurity/trufflehog#4927</a></li>
<li>Enable errcheck and staticcheck for golangci-lint v2 and resolve all
issues by <a
href="https://github.com/amanfcp"><code>@​amanfcp</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4924">trufflesecurity/trufflehog#4924</a></li>
<li>feat: add host, db and username to ExtraData for database detectors
by <a href="https://github.com/mariocj89"><code>@​mariocj89</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4849">trufflesecurity/trufflehog#4849</a></li>
<li>Remove over speculation from Corpora CI workflow by <a
href="https://github.com/mustansir14"><code>@​mustansir14</code></a> in
<a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4974">trufflesecurity/trufflehog#4974</a></li>
<li>Fix line numbers for duplicate secrets within a chunk by <a
href="https://github.com/amanfcp"><code>@​amanfcp</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4910">trufflesecurity/trufflehog#4910</a></li>
<li>Add feature flags for Pinecone, Cloudinary, and GitLab OAuth
detectors by <a
href="https://github.com/camgunz"><code>@​camgunz</code></a> in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4961">trufflesecurity/trufflehog#4961</a></li>
<li>Update Go security dependencies by <a
href="https://github.com/cursor"><code>@​cursor</code></a>[bot] in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4986">trufflesecurity/trufflehog#4986</a></li>
<li>Pin GitHub Actions to SHA digests by <a
href="https://github.com/bryanbeverly"><code>@​bryanbeverly</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4985">trufflesecurity/trufflehog#4985</a></li>
<li>Update CODEOWNERS: replace 5 slugs with scanning + integrations by
<a
href="https://github.com/bryanbeverly"><code>@​bryanbeverly</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4983">trufflesecurity/trufflehog#4983</a></li>
<li>Added source config flags to sharepoint proto by <a
href="https://github.com/MuneebUllahKhan222"><code>@​MuneebUllahKhan222</code></a>
in <a
href="https://redirect.github.com/trufflesecurity/trufflehog/pull/4972">trufflesecurity/trufflehog#4972</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/d411fff7b8879a62509f3fa98c07f247ac089a51"><code>d411fff</code></a>
feat(apk): adds some debugging info for APKs and fixes issues parsing
obfusca...</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/26eae1f2969f4240acfd3fc363b504b1b43255d4"><code>26eae1f</code></a>
[SCAN-795] HTML decoder: ASPX and entity-encoded HTML support (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4981">#4981</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/6c8f64071ba92640f5cc6f4177a91e9a09b0db12"><code>6c8f640</code></a>
Added source config flags to sharepoint proto (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4972">#4972</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/9f0b97f1600cd5f51e5ecb8380087807acb790f9"><code>9f0b97f</code></a>
Update CODEOWNERS: replace 5 slugs with scanning + integrations (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4983">#4983</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/36f6f697079e637bccb1e05561a481d8b4016862"><code>36f6f69</code></a>
Pin GitHub Actions to SHA digests (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4985">#4985</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/52ebebb9b0a762ad5b84a8c2205d38dcf471bd2d"><code>52ebebb</code></a>
Update Go security dependencies (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4986">#4986</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/ec67ff26cdeb5c8600a2ca83992d9347975c172a"><code>ec67ff2</code></a>
Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors
(<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4961">#4961</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/0ec3634f6cf66a61912a923fee9d20cc45633a67"><code>0ec3634</code></a>
Fix line numbers for duplicate secrets within a chunk (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4910">#4910</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/79acbf4703fe7eebd5f190073bd89b16456da7d4"><code>79acbf4</code></a>
Remove over speculation from Corpora CI workflow (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4974">#4974</a>)</li>
<li><a
href="https://github.com/trufflesecurity/trufflehog/commit/d86254ee022cc6533192c5601c143a42706c1004"><code>d86254e</code></a>
feat: add host, db and username to ExtraData for database detectors (<a
href="https://redirect.github.com/trufflesecurity/trufflehog/issues/4849">#4849</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/trufflesecurity/trufflehog/compare/37b77001d0174ebec2fcca2bd83ff83a6d45a3ab...d411fff7b8879a62509f3fa98c07f247ac089a51">compare
view</a></li>
</ul>
</details>
<br />

Updates
`hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml`
from edbfcffec120a63fbf4cc393f1439d32589248d7 to
2dc1393c0ac982dbad98ba07f78a580d319456a5
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/hyperpolymath/panic-attack/blob/main/CHANGELOG.md">hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>[Unreleased]</h2>
<h2>[2.5.5] — 2026-06-02</h2>
<p>Release of the v2.5.5 cohort that landed across 11 PRs in
panic-attack + wiki + gitbot-fleet on 2026-06-02 PM. Tagged 2026-06-02
PM-evening.</p>
<h3>Added (2026-06-02 PM) — v2.5.5 context-awareness cohort + v3.0.0
Chapel→VeriSimDB push + PROOF-PROGRAMME</h3>
<p>Eight PRs landed in one cohort closing the v2.5.5 ROADMAP section, a
v3.0.0 item, and opening the first proof slice of the new
PROOF-PROGRAMME.</p>
<p><strong>v2.5.5 — Attack Surface Widening (false-positive
reduction)</strong></p>
<ul>
<li><strong><code>test_context</code> foundation</strong> (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/102">#102</a>):
new <code>src/test_context.rs</code> module with cross-language
test-path classification (Rust / Python / Go / JavaScript / Julia / Zig
/ Elixir / docs-examples). New <code>WeakPoint.test_context:
Option&lt;TestContext&gt;</code> field (Production / TestOnly / Doc)
plumbed through 137 construction sites. Content-based promotion via
<code>use ExUnit.Case</code> / <code>unittest.TestCase</code> /
<code>pytest.fixture</code> / <code>@testset</code> markers.</li>
<li><strong><code>comment_marker</code> inline suppression</strong> (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/105">#105</a>):
new <code>src/comment_marker.rs</code> module recognising <code>//
panic-attack: accepted [- reason]</code> on the same or preceding line.
Cross-language comment leaders: <code>//</code> mid-line for C-family;
<code>#</code> / <code>--</code> / <code>;</code> / <code>%</code> /
<code>///</code> / <code>//!</code> start-of-line for
Python/Haskell/Lisp/Erlang/Rust-doc/Rust-inner-doc. String-literal
aware. Shebang <code>#!</code> excluded.</li>
<li><strong><code>ffi_kind</code> subtyping</strong> (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/106">#106</a>):
new <code>src/ffi_kind.rs</code> module subtyping
<code>WeakPointCategory::UnsafeFFI</code> (PA013) into BuildSystem /
RuntimeAbi / TestMock / Unknown. <code>classify_by_path</code>
distinguishes <code>build.zig</code> / <code>build.rs</code>
(BuildSystem, audit-accepted by default) from <code>bindings/</code> /
<code>ffi/</code> / <code>sys/</code> / <code>cdef.zig</code>
(RuntimeAbi, audit-significant) from <code>tests/mocks/</code> /
<code>tests/stubs/</code> (TestMock, also audit-accepted). New
<code>is_audited_boundary(audit_text, file_path)</code> parses
<code>audits/audit-ffi-unsafe.md</code> <code>## Approved
boundaries</code> markdown.</li>
<li><strong><code>jit_context</code> classifier</strong> (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/107">#107</a>):
new <code>src/jit_context.rs</code> module classifying JIT frameworks —
Cranelift / Llvm / Wasm / Javascript / None. Factors existing inline
Cranelift detection at <code>analyzer.rs:1117..1129</code> into reusable
surface. <code>transmute_targets_fn_ptr</code> made tolerant of <code>=
unsafe { ... transmute(..) }</code> wrappers.</li>
<li><strong>Phase 2 analyzer wire-up</strong> (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/110">#110</a>):
new <code>apply_v255_context_suppression(&amp;mut report)</code> runs
after the kanren-based rule pass and (a) marker-flips
<code>WeakPoint.suppressed = true</code> when <code>panic-attack:
accepted</code> is on or above the line, (b) auto-suppresses
<code>PanicPath</code> in TestOnly/Doc context, (c) auto-suppresses
<code>UnsafeFFI</code> in BuildSystem/TestMock context. Sets
<code>test_context</code> metadata on every finding with a known file
path.</li>
</ul>
<p><strong>v3.0.0 — Distributed Scanning (HTTP push from
Chapel)</strong></p>
<ul>
<li><strong><code>panic-attack verisim-push &lt;hexad&gt;</code>
subcommand</strong> (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/108">#108</a>):
new <code>Commands::VerisimPush</code> gated on the <code>http</code>
Cargo feature. Reads a JSON hexad (typically what Chapel
<code>takeSnapshot</code> just wrote), POSTs to
<code>$VERISIMDB_URL</code> (default <code>http://localhost:8080</code>)
via the existing <code>storage::push_hexad_http_with_retry</code>.
<code>--fallback-dir</code> writes a JSON copy on HTTP failure for
offline replay.</li>
<li><strong>Chapel <code>takeSnapshot</code> overload</strong> (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/108">#108</a>):
new 6-arg form accepting <code>verisimPushUrl</code> +
<code>panicAttackBin</code> parameters. Spawns <code>panic-attack
verisim-push --url &lt;url&gt; --retry &lt;hexad&gt;</code> after local
hexad write. Local writes remain authoritative; push is additive. Closes
the <code>[ ]</code> ROADMAP item.</li>
</ul>
<p><strong>PROOF-PROGRAMME — first-principles soundness</strong></p>
<ul>
<li><strong><code>PROOF-PROGRAMME.md</code></strong> (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/104">#104</a>):
3-layer landscape (Surface / Engine / Persistence) covering all 25
PA-code soundness proofs + miniKanren correctness + bridge reachability
+ attestation chain unforgeability. 9-phase sequencing (~16 weeks).
Identifies <code>proven</code> cross-fit candidates: only
<code>SafePath</code> + <code>SafeUrl</code> qualify as port-to-Rust
(perf-neutral, semantic-equivalent); <code>SafeJson</code> /
<code>SafeRegex</code> / <code>SafeDateTime</code> /
<code>SafeCommand</code> / <code>SafeEnv</code> / <code>SafeUUID</code>
marked skip (already total / semantic mismatch).</li>
<li><strong>Layer 1.0 partial</strong> (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/111">#111</a>):
new <code>src/abi/Stripping.idr</code> Qed-closing the foundation lemmas
for line-comment stripping — <code>stripBodyProducesStrippedShape</code>
(every body output satisfies <code>IsStrippedBody</code>) + base cases
of <code>stripLineCommentsIdempotent</code> (empty + non-slash-headed
input). Open: the slash-slash inductive closure
<code>stripIsIdentityOnStrippedBody</code> (recorded as the next
Layer-1.0 slice in <code>PROOF-NEEDS.md</code>).</li>
</ul>
<h3>Changed (2026-06-02) — truthfulness audit (humans + machines)</h3>
<ul>
<li><strong>README badge + Status block</strong> corrected: 402 →
<strong>782 runnable tests</strong>
(per <code>cargo test --release -- --list</code>; the underlying 539
<code>#[test]</code>
annotations expand via doctests + integration tiers). The badge had
not tracked actual count for several releases. Wiki Home was
<code>282+</code>.</li>
<li><strong>chapel-ci <code>chapel-multilocale</code> gate</strong>
robustified (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/100">#100</a>
collateral):
pinned <code>CHPL_UNWIND=system</code> explicitly + moved
<code>libunwind-dev</code> install
to always-run (not gated on cache-hit). On cache-hit runs without
libunwind-dev, chpl auto-inferred <code>CHPL_UNWIND=bundled</code> and
aborted
with &quot;no runtime for bundled&quot; because the cached runtime was
built
with <code>system</code>. Cache-gen counter bumped <code>v1</code> →
<code>v2</code> to discard the
inconsistent cache. Fifth Chapel-2.8.0 sharp edge from <a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/99">#99</a>
Wave 2.</li>
<li><strong>ROADMAP v2.2.0</strong>: downgraded &quot;Per-project
VeriSimDB instance:
<code>deploy/panic-attack/fly.toml</code> for
<code>verisim-panic-api</code>&quot; from <code>[x]</code> to
<code>[~]</code> — the API runs but the toml file is NOT in this repo
(lives in
the <code>verisimdb</code> deployment tree). The <code>[x]</code>
checkbox previously
pointed at a path that didn't exist on <code>main</code>.</li>
<li><strong>ROADMAP front matter + Wiki Home</strong>: &quot;500+
repositories&quot; replaced
with the empirically verifiable &quot;303-repo hyperpolymath estate
(2026-04-12)&quot; — the number that appears in</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/2dc1393c0ac982dbad98ba07f78a580d319456a5"><code>2dc1393</code></a>
feat(safe_path): port proven SafePath as pure-Rust + add traversal guard
(<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/11">#11</a>...</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/833f3949500040bb860bc85fd7084fa61401765f"><code>833f394</code></a>
proofs(Layer 1.0): close slash-slash inductive case via mutual recursion
(<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/11">#11</a>...</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/d5f3a4ff497c3ab7b77585662e702ac7ef602e07"><code>d5f3a4f</code></a>
release(v2.5.5): tag the 11-PR context-awareness cohort (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/118">#118</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/2fc73bd6f3b087effdf61428a20db1bfce00ab73"><code>2fc73bd</code></a>
docs(closeout): v2.5.5 cohort + v3.0.0 verisim-push + PROOF-PROGRAMME
compreh...</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/ad1faf63878c25a748f72c0fd7e58c3a8dd682cc"><code>ad1faf6</code></a>
proofs(Layer 1.0): Idris2 stripping foundation — base cases + shape
lemma (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/111">#111</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/ad72e0687b42183a283c735d2e5d87c47a881601"><code>ad72e06</code></a>
feat(suppression): v2.5.5 Phase 2 — analyzer wire-up (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/110">#110</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/600bf516653bab0d3d4b138599c85cae2968087b"><code>600bf51</code></a>
ci(codeql): cron weekly→monthly (cut 3, standards#288) (<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/109">#109</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/d25210da6521e5a716dd7df992e58aba667523f5"><code>d25210d</code></a>
feat(ffi_kind): v2.5.5 FFI subtyping (BuildSystem / RuntimeAbi /
TestMock) (#...</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/62c98cc2f49d8ec15226398eb3052090b9da166f"><code>62c98cc</code></a>
feat(v3.0.0): Chapel→VeriSimDB HTTP push via panic-attack verisim-push
(<a
href="https://redirect.github.com/hyperpolymath/panic-attacker/issues/108">#108</a>)</li>
<li><a
href="https://github.com/hyperpolymath/panic-attack/commit/f0b646385fa503c5324dd7bc5b6ae972b00b417c"><code>f0b6463</code></a>
feat(jit_context): v2.5.5 JIT-framework classifier
(Cranelift/LLVM/Wasm/JS) (...</li>
<li>Additional commits viewable in <a
href="https://github.com/hyperpolymath/panic-attacker/compare/edbfcffec120a63fbf4cc393f1439d32589248d7...2dc1393c0ac982dbad98ba07f78a580d319456a5">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>

Author: dependabot[bot]

.github/workflows/boj-build.yml

@@ -21,7 +21,7 @@ jobs:
     if: ${{ vars.BOJ_SERVER_URL != '' || secrets.BOJ_SERVER_URL != '' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Trigger BoJ Server (Casket/ssg-mcp)
         env:

.github/workflows/casket-pages.yml

@@ -20,10 +20,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
 
       - name: Checkout casket-ssg
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
         with:
           repository: hyperpolymath/casket-ssg
           path: .casket-ssg

.github/workflows/codeql.yml

@@ -27,15 +27,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.1.1
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4.1.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v3.28.1
+        uses: github/codeql-action/init@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v3.28.1
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v3.28.1
+        uses: github/codeql-action/analyze@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v3.28.1
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/dogfood-gate.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Check for A2ML files
         id: detect
@@ -69,7 +69,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Check for K9 files
         id: detect
@@ -118,7 +118,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Scan for invisible characters
         id: lint
@@ -182,7 +182,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Check for Groove manifest
         id: groove
@@ -242,7 +242,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Generate dogfooding scorecard
         run: |

.github/workflows/guix-nix-policy.yml

@@ -11,7 +11,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4.2.2
       - name: Enforce Guix primary / Nix fallback
         run: |
           # Check for package manager files

.github/workflows/npm-bun-blocker.yml

@@ -11,7 +11,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Block npm/bun
         run: |
           if [ -f "package-lock.json" ] || [ -f "bun.lockb" ] || [ -f ".npmrc" ]; then

.github/workflows/quality.yml

@@ -12,14 +12,14 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4.2.2
 
       - name: Check file permissions
         run: |
           find . -type f -perm /111 -name "*.sh" | head -10 || true
       
       - name: Check for secrets
-        uses: trufflesecurity/trufflehog@37b77001d0174ebec2fcca2bd83ff83a6d45a3ab # v3.95.3
+        uses: trufflesecurity/trufflehog@d411fff7b8879a62509f3fa98c07f247ac089a51 # v3.95.5
         with:
           path: ./
           base: ${{ github.event.pull_request.base.sha || github.event.before }}
@@ -44,7 +44,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4.2.2
       - name: Check documentation
         run: |
           MISSING=""

.github/workflows/rsr-antipattern.yml

@@ -23,7 +23,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Check for TypeScript
         run: |

.github/workflows/scorecard-enforcer.yml

@@ -37,7 +37,7 @@ jobs:
       security-events: write
       id-token: write  # For OIDC
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -49,7 +49,7 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
+        uses: github/codeql-action/upload-sarif@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4
         with:
           sarif_file: results.sarif
 
@@ -89,7 +89,7 @@ jobs:
   check-critical:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Check SECURITY.md exists
         run: |

.github/workflows/security-policy.yml

@@ -11,7 +11,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4.2.2
       - name: Security checks
         run: |
           FAILED=false