GitHub Release: trufflesecurity/trufflehog v3.99.8 (02.11.2026)

What's Changed

• Skip GitHub comment errors when issues or PRs are off by @kashifkhan0771 in #5467


• [SCAN-180]: Populate SecretParts for custom detector results by @casey-tran in #5470


• Clean up S3 source logging for per-source debug by @kashifkhan0771 in #5481


• Clean up GitHub source logging for per-source debug by @kashifkhan0771 in #5457


• feat(detectors): add Composio API key detector by @groovyBugify in #5322


• Clean up Docker source logging for per-source debug by @kashifkhan0771 in #5494


• Add source fields to Init logs in single-source CLI commands by @kashifkhan0771 in #5466


• Close Couchbase clusters after verification and honor the context by @unsmith in #5489


• [SCAN-317] Recover from detector panics in the verification overlap worker by @dipto-truffle in #5495


• Cap 7z LZMA and LZMA2 dictionary sizes and keep scanning past refused entries by @bryanbeverly in #5483


• Update module github.com/go-git/go-git/v5 to v5.19.3 by @renovate[bot] in #5480


• Update module github.com/jlaffaye/ftp to v0.2.4 by @renovate[bot] in #5365


• Update module github.com/mattn/go-isatty to v0.0.24 by @renovate[bot] in #5366


• Clean up GitLab source logging for per-source debug by @kashifkhan0771 in #5485


• Verify BoxOauth credentials only when Box issues a token for a subject by @unsmith in #5498

New Contributors

• @groovyBugify made their first contribution in #5322

Full Changelog: v3.99.7...v3.99.8