chore(deps): update github actions (version updates)

[wandb-renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/checkout (changelog)	action	digest	df4cb1c → d23441a
openclaw/clawhub	action	patch	v0.23.1 → v0.23.3
trufflesecurity/trufflehog	action	minor	v3.95.9 → v3.97.1	v3.97.4 (+2)

---

Release Notes

openclaw/clawhub (openclaw/clawhub)

v0.23.3: clawhub 0.23.3

Compare Source

0.23.3 - 2026-08-03

Fixes

• CLI/API: stage skill files directly in Convex storage before publishing metadata, so bundles within the documented 50MB total limit no longer hit Vercel's smaller request-body limit.

Release Proof

• npm: https://www.npmjs.com/package/clawhub/v/0.23.3
• tarball: https://registry.npmjs.org/clawhub/-/clawhub-0.23.3.tgz
• integrity: sha512-VwM6FQrZVarFRDiEqG42npUeyCu/iLhPnpO+b7kKIGRXv+TA6Lb8pboHnIgT6cmjFEnW3j/pTbshWeDQMQ7QWQ==
• npm preflight: https://github.com/openclaw/clawhub/actions/runs/30876040558
• npm publish: https://github.com/openclaw/clawhub/actions/runs/30876129147

v0.23.2: clawhub 0.23.2

Compare Source

0.23.2 - 2026-08-03

Changes

• CLI/API: add owner-authorized clawhub skill tag <skill> <version> --yes so personal owners and organization owner/admin members can safely repoint latest to an existing public version.

Fixes

• API: reject version-bearing requests on the legacy whole-skill delete route instead of silently soft-deleting the entire skill.

Release Proof

• npm: https://www.npmjs.com/package/clawhub/v/0.23.2
• tarball: https://registry.npmjs.org/clawhub/-/clawhub-0.23.2.tgz
• integrity: sha512-PR759dn+HCvZoi3JVwudehzg2hRS/zPGDfskTrSK0+upJMW1/ZTfApHEuvx9frBucMp4fdO4mBXsOZkIoozEDg==
• npm preflight: https://github.com/openclaw/clawhub/actions/runs/30873042709
• npm publish: https://github.com/openclaw/clawhub/actions/runs/30873117751

trufflesecurity/trufflehog (trufflesecurity/trufflehog)

v3.97.1

Compare Source

What's Changed

• Update module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] by @​renovate[bot] in #​5196
• Fix GHEC with Data Residency (*.ghe.com) base URL by @​shahzadhaider1 in #​4777
• docs: add generic config-secret custom detector example by @​pgmpofu in #​5195
• fix(detectors/docker): don't greedy match in keyPat by @​mariduv in #​5214
• [SCAN-1020] neon scram pgx by @​alafiand in #​5217
• Raised MongoDB detector timeout value by @​jordanTunstill in #​5222
• preallocate bindings capacity in dockerhub and groq, with unit tests by @​jordanTunstill in #​5213
• [SCAN-101] S3 Source accept persisted unit envelopes in UnmarshalSourceUnit by @​amanfcp in #​5224
• Refine SECURITY.md by @​bradlarsen in #​5216
• Carry GitHub App installation ID on repo units by @​bill-rich in #​5215

New Contributors

• @​pgmpofu made their first contribution in #​5195

Full Changelog: trufflesecurity/trufflehog@v3.97.0...v3.97.1

v3.97.0

Compare Source

What's Changed

• fix(detectors/privatekey): report encrypted keys with uncrackable passphrases by @​genisis0x in #​5127
• Update module go.mongodb.org/mongo-driver to v1.17.7 [SECURITY] by @​renovate[bot] in #​5058
• Remove url tag from common HTTP client metrics by @​mcastorina in #​5158
• Update github.com/avast/apkparser digest to 7fcaee4 by @​renovate[bot] in #​5037
• [INS-318] Add New Relic License Key Detector by @​mustansir14 in #​4760
• [INS-348] Add New Relic Browser Key detector by @​mustansir14 in #​4769
• [INS-339] Add New Relic User Key detector by @​mustansir14 in #​4794
• [INS-345] Add New Relic Insights Query Key detector by @​mustansir14 in #​4781
• fix(sources): stop UnitHook Close racing in-flight Finish sends by @​bill-rich in #​5154
• There are now 3 CircleCI projects by @​trufflesteeeve in #​5166
• Update github.com/shurcooL/githubv4 digest to 2402fdf by @​renovate[bot] in #​5038
• Update github-actions by @​renovate[bot] in #​5036
• Update aws-sdk-go-v2 monorepo by @​renovate[bot] in #​4890
• [INS-344] Add New Relic Mobile App Token Detector by @​mustansir14 in #​4810
• Give each clone its own directory under --clone-path by @​shahzadhaider1 in #​5175
• feat(output): add SARIF output format for GitHub code scanning by @​kashifkhan0771 in #​5165
• [SCAN-1018] Treat SlackWebhook invalid_token (HTTP 400) as determinate not-live by @​alafiand in #​5177
• make cwd-changing normalization tests non-parallel to fix flaky clone failures by @​jordanTunstill in #​5178
• [INS-456] Add Microsoft Teams Webhook V2 detector by @​mustansir14 in #​4902
• surface git clone errors at v(0) by @​jordanTunstill in #​5162
• Add Figma Personal Access Token v3 Detector by @​shahzadhaider1 in #​4790
• fix(github): fallback resource Name to avoid empty-string proto validation failure by @​kashifkhan0771 in #​5182
• [INT-643] Update Protos definition to cater bitbucket Api token authentication by @​MuneebUllahKhan222 in #​5171
• Update regex pattern and 403 handling in the Lob detector to fix false positives by @​MachiavelliII in #​5188
• Deprecate AppOptics detector by @​Ahsan-Sarbaz in #​5198
• Anthropic detector: surface API error detail on non-2xx verification by @​Ahsan-Sarbaz in #​5180
• Deprecated bingsubscriptionkey detector by @​Ahsan-Sarbaz in #​5179
• Add SolarWinds Observability detector by @​Ahsan-Sarbaz in #​5199
• fix(jiratoken): stop 202 reverification retry loop by @​Ahsan-Sarbaz in #​5200
• Add custom endpoint support to the S3 source by @​shahzadhaider1 in #​5202
• fix(blogger): anchor regex to AIzaSy prefix to eliminate false positives by @​unsmith in #​5203
• fix(huggingface): move unscoped fine-grained models to UnboundedResources by @​unsmith in #​5204
• Add AWS Secrets Manager metadata type by @​rosecodym in #​5210
• fix(detectors/harness): allow underscore in PAT account segment by @​mattbrady-1 in #​5153

New Contributors

• @​MachiavelliII made their first contribution in #​5188
• @​Ahsan-Sarbaz made their first contribution in #​5198
• @​unsmith made their first contribution in #​5203

Full Changelog: trufflesecurity/trufflehog@v3.96.0...v3.97.0

v3.96.0

Compare Source

What's Changed

• [INS-355] Added Hashicorp vault token detector by @​MuneebUllahKhan222 in #​4819
• Tighten JiraToken v1 verification by @​shahzadhaider1 in #​5122
• [INT-718] Add TargetNotFoundError for targeted scan targets missing from the source by @​bill-rich in #​5123
• Fix GitLab project metadata cache and switch to LRU by @​kashifkhan0771 in #​4727
• Log analyze errors for Anthropic Analyzer by @​kashifkhan0771 in #​5120
• Add metrics for chunks and results by @​mcastorina in #​5128
• Update Cloudflare detectors for 2026+ prefixed credential formats (include upstream PR changes) by @​kashifkhan0771 in #​5111
• [INS-312] Duo API Secret Key Detector by @​MuneebUllahKhan222 in #​4771
• [Feature] Added SonarQube Cloud "Scoped Organization Token" Detector by @​nabeelalam in #​4739
• [INS-255] Updated datadog detector to set verificationError in case of a verification error by @​MuneebUllahKhan222 in #​4661
• Log analyze errors for Postgres analyzer by @​kashifkhan0771 in #​5131
• Log analyze errors for HuggingFace analyzer by @​kashifkhan0771 in #​5130
• Engine - Config.SourceManager doc by @​amanfcp in #​5002
• Update module github.com/go-git/go-git/v5 to v5.19.1 [SECURITY] by @​renovate[bot] in #​5034
• Retry git clone on transient network errors by @​shahzadhaider1 in #​5132
• Fix scan_all_installations Rejecting Org Member Personal Repos by @​shahzadhaider1 in #​5142
• updated detector to include underscore char by @​mattbrady-1 in #​5121
• [chore] Change job_id in metric to source_type by @​mcastorina in #​5149
• Posthog regex update by @​mattbrady-1 in #​5133
• fix(handlers): apk handler now doesnt check for apk extension since json-enumerator and other byte stream methods wouldnt have it by @​johannestaas-trufflesec in #​5151

New Contributors

• @​mattbrady-1 made their first contribution in #​5121

Full Changelog: trufflesecurity/trufflehog@v3.95.9...v3.96.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}