What's Changed

• Fix --include-wikis help typo and huggingface README description by @protonnegativo in #5471
• fix(detectors/anypointoauth2): stop treating HTTP 422 as verified by @jamesgol in #5386
• Add xAI analyzer by @serval-frenchie in #5456
• ci(lint): pin the semgrep container image by digest by @Portll in #5245
• feat(detectors): add Fireworks AI API key detector by @sudo-a-man in #5447
• feat(detectors): add Infisical service token detector by @Varshith-Kali in #5445
• Fix 7z and rar panics in the archive handler and log recovered panic stacks by @dustin-decker in #5474

New Contributors

• @protonnegativo made their first contribution in #5471
• @serval-frenchie made their first contribution in #5456
• @Portll made their first contribution in #5245
• @sudo-a-man made their first contribution in #5447
• @Varshith-Kali made their first contribution in #5445

Full Changelog: v3.99.6...v3.99.7

v3.99.5 was tagged but never published because its release build failed. v3.99.6 supersedes it and includes all of the changes below.

What's Changed

• Update github-actions by @renovate[bot] in #5414
• Prefer nearest client/tenant IDs for Azure SP secrets by @kashifkhan0771 in #5449
• Clean up Filesystem source logging for per-source debug by @kashifkhan0771 in #5465
• security: bump andybalholm/brotli to v1.2.7 (CVE-2026-111497) by @dustin-decker in #5472
• Keep GoReleaser temp files off the tmpfs /tmp in releases by @dustin-decker in #5473

Full Changelog: v3.99.4...v3.99.6

What's Changed

• Add per-source debug option and hide sensitive data in debug logs by @kashifkhan0771 in #5446
• Mark results whose verification was skipped by @unsmith in #5448
• Clean up Git source logging for per-source debug by @kashifkhan0771 in #5451
• Add Lambda Cloud API key detector by @lukem-ts in #5435
• Update github.com/trufflesecurity/ldap-verify digest to 4a15faf by @renovate[bot] in #5441
• Update dependency trufflesecurity/.github to v1.0.5 by @renovate[bot] in #5442
• Update module golang.org/x/crypto to v0.56.0 [SECURITY] by @renovate[bot] in #5462
• Update module golang.org/x/net to v0.60.0 [SECURITY] by @renovate[bot] in #5464
• Update module github.com/yuin/goldmark to v1.7.17 [SECURITY] by @renovate[bot] in #5460
• github: check App installation grants before listing comments by @unsmith in #5454

Full Changelog: v3.99.3...v3.99.4

What's Changed

• Add stdin source documentation by @kashifkhan0771 in #5397
• Add syslog source documentation by @kashifkhan0771 in #5398
• Add travisci source documentation by @kashifkhan0771 in #5401
• Changed GithubOauth2 detector to only rotate on particular error message by @jordanTunstill in #5396
• Update dependency golangci/golangci-lint to v2.14.0 by @renovate[bot] in #5408
• Update alpine Docker tag to v3.24 by @renovate[bot] in #5407
• Update github.com/trufflesecurity/ldap-verify digest to 4964a20 by @renovate[bot] in #5406
• Update module github.com/rabbitmq/amqp091-go to v1.14.0 [SECURITY] by @renovate[bot] in #5410
• Update github-actions (major) by @renovate[bot] in #5409
• Update module github.com/moby/go-archive to v0.3.0 [SECURITY] by @renovate[bot] in #5423
• Update module go.opentelemetry.io/otel/sdk to v1.45.0 [SECURITY] by @renovate[bot] in #5425
• Update module filippo.io/edwards25519 to v1.1.1 [SECURITY] by @renovate[bot] in #5421
• Replace deprecated google.CredentialsFromJSON with CredentialsFromJSONWithType by @bryanbeverly in #5428
• Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace to v1.45.0 [SECURITY] by @renovate[bot] in #5424
• Update module google.golang.org/grpc to v1.83.1 [SECURITY] by @renovate[bot] in #5426
• Fix GitHub comment scans stopping early on large repositories by @unsmith in #5405
• fix(github): use a single "app client registry" by @mariduv in #5427
• Add SonarQube Server token detector by @kashifkhan0771 in #5419
• Add per-logger debug level override for source logging by @kashifkhan0771 in #5432
• Update module google.golang.org/grpc to v1.83.2 [SECURITY] by @renovate[bot] in #5431
• github: name the missing permission when a comment listing is refused by @unsmith in #5438

Full Changelog: v3.99.2...v3.99.3

What's Changed

• Copy over dedupe cache size into the engine from the config by @camgunz in #5402

Full Changelog: v3.99.1...v3.99.2

What's Changed

• Update github-actions by @renovate[bot] in #5363
• [INT-1084] Make the results deduplication cache size configurable by @camgunz in #5399

Full Changelog: v3.99.0...v3.99.1

What's Changed

• Fix Sumo Logic detector ignoring configured verifier endpoints by @unsmith in #5395
• Add OAuth2 (ROPC) auth for verification requests by @unsmith in #5392

Full Changelog: v3.98.1...v3.99.0

What's Changed

• Add postman source documentation by @kashifkhan0771 in #5389
• Add a TruffleHog dectector for Kong Konnect Platform by @mrwanny in #5305
• Add api_timeout_seconds to Gerrit source proto by @kashifkhan0771 in #5394

New Contributors

• @mrwanny made their first contribution in #5305

Full Changelog: v3.98.0...v3.98.1

What's Changed

• Int 595 verify asymmetry by @shahzadhaider1 in #5261
• return error body for fetchBearerToken by @jordanTunstill in #5301
• Update module github.com/charmbracelet/bubbletea to v1.3.10 by @renovate[bot] in #5281
• Update github.com/trufflesecurity/ldap-verify digest to 3142cc9 by @renovate[bot] in #5280
• [INT-1086] Don't reuse maps; editing them afterwards edits them for all results by @camgunz in #5351
• [INT-1091] Treat Square 403 as verified on INSUFFICIENT_SCOPES by @MuneebUllahKhan222 in #5367
• feat: add --no-ignore-tag to report secrets on trufflehog:ignore lines by @thiswillnevermatch in #5293
• Fix failing TestGHCRListImages test in CI by @MuneebUllahKhan222 in #5368
• Revert duplicate --no-ignore-tag changes from #5293 by @shahzadhaider1 in #5369
• Show progress inside S3 buckets by @shahzadhaider1 in #5330
• fix(output): escape special characters in --github-actions output by @kenanyararbas in #5353
• fix(detectors): remove stray fmt.Printf in portainertoken by @Gracy769 in #5334
• resolve race condition in result deduplication cache by @kvnphvm in #5359
• added entropy filter and improved verification for gitlab v2/v3 by @jordanTunstill in #5358
• Update Okta domain pat to account for mil and fedramp by @kvnphvm in #5355
• Corpora bench reports clean when a detector produces zero matches on both sides by @kvnphvm in #5357
• Add huggingface source documentation by @kashifkhan0771 in #5373
• Add Gitlab source documentation by @kashifkhan0771 in #5371
• Add Github source documentation by @kashifkhan0771 in #5370
• fix(detectors/auth0oauth): match Auth0 Private Cloud auth0app.com domains by @saghaulor in #5354
• List only the include prefixes in S3 scans by @shahzadhaider1 in #5377
• fix(github): switch back to fetching access token through apiClient, by @mariduv in #5380
• Fix NetSuite detector running out of memory on dense input by @shahzadhaider1 in #5383
• Add Jenkins source documentation by @kashifkhan0771 in #5388
• docs: point five internal links at files that exist by @CalvinTjoaquinn in #5375
• Add pkg/ssrf shared egress guard; use it for WithNoLocalIP and analyzer clients by @bill-rich in #5288

New Contributors

• @thiswillnevermatch made their first contribution in #5293
• @kenanyararbas made their first contribution in #5353
• @Gracy769 made their first contribution in #5334
• @CalvinTjoaquinn made their first contribution in #5375

Full Changelog: v3.97.9...v3.98.0

What's Changed

• [SCAN-162] Add Err() to JobProgress and JobProgressRef by @dipto-truffle in #5346
• ci: scope Smoke timeouts to trufflehog runs, not the build by @bryanbeverly in #5317
• Update module github.com/aymanbagabas/go-osc52 to v1.2.2 by @renovate[bot] in #5252
• Update module github.com/gabriel-vasile/mimetype to v1.4.15 by @renovate[bot] in #5283
• make 401s for Basic auth verified false. by @jordanTunstill in #5290
• [INT-1088] Add version and comment_number lines to SharePoint source metadata by @camgunz in #5348
• Int 595 auth errors by @shahzadhaider1 in #5259
• Spruce up Makefile a little by @camgunz in #5347

Full Changelog: v3.97.8...v3.97.9