chore(deps): bump the everything group with 3 updates

[dependabot]

Bumps the everything group with 3 updates: ossf/scorecard-action, KineticCafe/actions-dco and trufflesecurity/trufflehog.

Updates ossf/scorecard-action from 2.4.3 to 2.4.4

Release notes

Sourced from ossf/scorecard-action's releases.

v2.4.4

What's Changed

This update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the Scorecard v5.4.0 release notes and the Scorecard v5.5.0 release notes.

• log POST failures instead of failing entire action by @​spencerschrock in ossf/scorecard-action#1625

Full Changelog: ossf/scorecard-action@v2.4.3...v2.4.4

Commits

• 2d11466 Bump action tag for v2.4.4 release (#1688)
• 1bd3285 🌱 Bump the docker-images group across 1 directory with 2 updates (#1...
• 913edce 🌱 Bump github.com/containerd/containerd from 1.7.32 to 1.7.33 (#1671)
• 0957b8f 🌱 Bump golang.org/x/net from 0.56.0 to 0.57.0 (#1680)
• f0061eb 🌱 Bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#1687)
• 20ee732 🌱 Bump github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4 (#1685)
• 9f295ef 🌱 Bump the github-actions group with 6 updates (#1686)
• 69bf556 🌱 Bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.0 (#1681)
• 94e8b96 🌱 Bump github.com/sigstore/rekor from 1.5.0 to 1.5.2 (#1673)
• c7a1b37 🌱 Bump github.com/sigstore/fulcio from 1.8.5 to 1.8.6 (#1675)
• Additional commits viewable in compare view

Updates KineticCafe/actions-dco from 3.1.0 to 3.2.0

Release notes

Sourced from KineticCafe/actions-dco's releases.

v3.2.0: Prefer Default Branch Configuration

• Added a test case to detect regression of #216 or similar parsing errors.
• Modified the error handling of JSON response decoding to include a more meaningful error.
• Added support for reading .github/dco-check.toml or .dco-check.toml from the repo root on the default branch. If present, this takes precedence over any inline configuration (config:) key. This prevents a PR from "accidentally" changing the DCO check policy. See the configuration documentation for details.
• Added a configuration report to the output logs so that transient configurations are still reported for review.

What's Changed

• deps: bump the actions group with 2 updates by @​dependabot[bot] in KineticCafe/actions-dco#214
• deps: bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @​dependabot[bot] in KineticCafe/actions-dco#215
• chore: Default branch configuration by @​halostatue in KineticCafe/actions-dco#218
• feat: Support default branch config file by @​halostatue in KineticCafe/actions-dco#219

Full Changelog: KineticCafe/actions-dco@v3.1.1...v3.2.0

v3.1.1: Fix author parsing when null

What's Changed

• fix: Fix author parsing when null by @​halostatue in KineticCafe/actions-dco#217

Full Changelog: KineticCafe/actions-dco@v3.1.0...v3.1.1

Changelog

Sourced from KineticCafe/actions-dco's changelog.

KineticCafe/actions-dco Changelog

3.2.0 / 2026-07-25

• Added a test case to detect regression of #216[issue-216] or similar parsing errors.

• Modified the error handling of JSON response decoding to include a more meaningful error.

• Added support for reading .github/dco-check.toml or .dco-check.toml from the repo root on the default branch. If present, this takes precedence over any inline configuration (config:) key. This prevents a PR from "accidentally" changing the DCO check policy. See the configuration documentation for details.

• Added a configuration report to the output logs so that transient configurations are still reported for review.

3.1.1 / 2026-07-25

• Resolved #216[issue-216] with a fix to the OpenAPI generator oaspec.

3.1.0 / 2026-05-15

• Reshaped the sign-off summary written to the action and optionally as a commit comment. The message as added with 3.0.0 was accurate but meaningless. It has now be modified to produce meaningful summaries.

  Each commit that fails (up to X commits) will be included in a DCO failure table:

  | Commit     | Subject                       | Issue                    |
  | ---------- | ----------------------------- | ------------------------ |
  | `ff882225` | deps: Bump the actions group… | No Signed-off-by trailer |

  When commits are passed, skipped or exempt, they are included in a "pass" table grouped by the identity responsible that signed off:

  | Identity                | Commits                        |
  | ----------------------- | ------------------------------ |
  | dependabot[bot]         | 1 (bot, skipped)               |
  | Alice <al…@example.org> | 2 (signed off)                 |
  | Bob <bob@example.com>   | 1 (exempt domain @example.com) |

  The comment will be headed with a subject indicating that the check was

... (truncated)

Commits

• 5f160e3 feat: Add used configuration report
• b1fee4e chore: Build for release
• c963bcb chore: Remove inline config
• 5704499 chore: Bump release version and add changelog
• fc47443 feat: Support default branch config file
• 54e60fa chore: Carry decode errors up and present better errors.
• a171fbc chore: Clean up documentation
• cd84bf8 chore: Add regression test for unknown authors
• 15d7c62 chore: Update action dependencies
• 3ac7462 chore: Use oaspec 0.69.0
• Additional commits viewable in compare view

Updates trufflesecurity/trufflehog from 3.95.9 to 3.96.0

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.96.0

What's Changed

• [INS-355] Added Hashicorp vault token detector by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#4819
• Tighten JiraToken v1 verification by @​shahzadhaider1 in trufflesecurity/trufflehog#5122
• [INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @​bill-rich in trufflesecurity/trufflehog#5123
• Fix GitLab project metadata cache and switch to LRU by @​kashifkhan0771 in trufflesecurity/trufflehog#4727
• Log analyze errors for Anthropic Analyzer by @​kashifkhan0771 in trufflesecurity/trufflehog#5120
• Add metrics for chunks and results by @​mcastorina in trufflesecurity/trufflehog#5128
• Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @​kashifkhan0771 in trufflesecurity/trufflehog#5111
• [INS-312] Duo API Secret Key Detector by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#4771
• [Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by @​nabeelalam in trufflesecurity/trufflehog#4739
• [INS-255] Updated datadog detector to set verificationError in case of a verification error by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#4661
• Log analyze errors for Postgres analyzer by @​kashifkhan0771 in trufflesecurity/trufflehog#5131
• Log analyze errors for HuggingFace analyzer by @​kashifkhan0771 in trufflesecurity/trufflehog#5130
• Engine - Config.SourceManager doc by @​amanfcp in trufflesecurity/trufflehog#5002
• Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @​renovate[bot] in trufflesecurity/trufflehog#5034
• Retry git clone on transient network errors by @​shahzadhaider1 in trufflesecurity/trufflehog#5132
• Fix scan_all_installations Rejecting Org Member Personal Repos by @​shahzadhaider1 in trufflesecurity/trufflehog#5142
• updated detector to include underscore char by @​mattbrady-1 in trufflesecurity/trufflehog#5121
• [chore] Change job_id in metric to source_type by @​mcastorina in trufflesecurity/trufflehog#5149
• Posthog regex update by @​mattbrady-1 in trufflesecurity/trufflehog#5133
• fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @​johannestaas-trufflesec in trufflesecurity/trufflehog#5151

New Contributors

• @​mattbrady-1 made their first contribution in trufflesecurity/trufflehog#5121

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

Commits

• 6f3c981 fix(handlers): apk handler now doesnt check for apk extension since json-enum...
• 05a5832 fix(detectors/posthog): widen phx_ key body to {43,48} (#5133)
• a2ef4f5 [chore] Change job_id in metric to source_type (#5149)
• e74404a updated detector to include underscore char (#5121)
• 4d82f21 Fix scan_all_installations Rejecting Org Member Personal Repos (#5142)
• 38999f8 Retry git clone on transient network errors (#5132)
• 0eb1a81 Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] (#5034)
• ec20cb3 document Config.SourceManager (#5002)
• 4ecd7d5 Log analyze errors for HuggingFace analyzer (#5130)
• 1247638 Log analyze errors for Postgres analyzer (#5131)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions