chore(deps): update dependency betterleaks/betterleaks to v1.8.1

[renovate-orgmentem]

This PR contains the following updates:

Package	Update	Change
betterleaks/betterleaks	minor	1.7.4 → 1.8.1

Manual step: update BL_SHA256 in .github/workflows/ci.yml to the new release's checksum. The secrets job fails until then (Renovate cannot recompute a release-asset hash).

---

Release Notes

betterleaks/betterleaks (betterleaks/betterleaks)

v1.8.1

Compare Source

What's New

Wow two big releases in a day!

1. Added a validate command to let you re-validate findings without doing a rescan:

# Revalidate a known credential without running detection
printf '%s\n' "$GITHUB_TOKEN" | betterleaks validate --rule-id github-pat

# Print only its status (for example, VALID)
printf '%s\n' "$GITHUB_TOKEN" | betterleaks validate --rule-id github-pat --simple

2. OOM issue fixed by @​gpflaum

Changelog

• 5eab483 clone strings before saving in findings, so fragment.Raw can be released (#​308) Thank you @​gpflaum!
• 1c1db0d quick update
• 8173e62 validate cmd (#​277)

v1.8.0

Compare Source

What's New

More Generic Rules

Previously, generic-api-key also handled password-like identifiers. In v1.8.0, generic credential detection is separated into focused rules:

Rule	Detects	Confidence behavior
generic-api-key	API keys, tokens, and other opaque machine secrets without a known provider	Starts at low and can move to medium when stronger context is present
generic-password	Hardcoded password assignments and passwords passed to authentication calls	Starts at low and can move to medium when nearby identity or authentication context strengthens the finding
generic-credential-uri	Passwords embedded in HTTP, database, messaging, directory, mail, FTP, and SSH URIs	Starts at medium and drops to low for test, documentation, or example-like contexts

The password rule uses nearby authentication, connection, and username fields as supporting evidence. A hidden generic-username component supplies that context without producing standalone username findings.

The credential URI rule reports the embedded password rather than the entire URI. Provider-specific rules continue to take precedence when a more precise match is available.

Filter findings by confidence

Every bundled rule now assigns a low, medium, or high confidence level based on how strongly its pattern indicates a real secret.

Use the new --confidence flag to set the minimum level included in a scan:

betterleaks dir . --confidence medium

Suppressed findings are removed before live validation, so they do not generate validation requests or affect reports, finding counts, or exit codes.

Customize confidence

Custom rules can assign a static confidence level:

[[rules]]
id = "internal-api-key"
confidence = "low"
regex = '''...'''

Rule filters can also change confidence based on context using filter.setConfidence:

let level = hasStrongContext ? "medium" : "low";
let _ = filter.setConfidence(level);
false

It's a bit hacky and should be used sparingly, but it's better than not being able to update confidence in config.

Rules without an assigned confidence remain included when a confidence threshold is used, preserving compatibility with existing custom configurations.

More control over individual rules

This release also adds dedicated flags for disabling or isolating rules:

# Disable a noisy rule
betterleaks dir . --disable-rule generic-password

# Run only the generic rules
betterleaks dir . \
  --isolate-rule generic-api-key \
  --isolate-rule generic-password \
  --isolate-rule generic-credential-uri

Both flags are repeatable and also support -dr and -ir aliases. The existing --enable-rule flag remains available as a compatibility alias for --isolate-rule.

Other improvements

• Added detection for GitLab incoming-mail address tokens.
• Fixed incorrect finding column positions in file scans.
• Improved handling of malformed compressed files.
• Filtered a known deactivated Flickr token from the generic API-key rule.
• Updated rule confidence classifications across the bundled rule set.
• Updated the Go toolchain and dependencies.

Full changelog: v1.7.4...v1.8.0

Changelog

• 706dbe2 Chore/demote linkedin (#​299)
• ecea1f6 Fix incorrect column value being returned for files (#​258)
• c4a792a Ignore deactivated Flickr token in Dojo Toolkit (#​296)
• f3c0490 Rule/generic uri (#​304)
• 23b73e4 Rules/new username pw (#​289)
• 6cf4f1a Rules/update w confidence (#​297)
• d4fe93b additional gitlab incoming mail token detection (#​288)
• 3601d77 chore: Bumping Go to 1.25.10 and update x/text library (#​294)
• 5e8ec7f disable and isolate rules (#​303)
• c8a3750 fix (#​306)
• 6ed638a fix path to CONTRIBUTING.md (#​292)
• 49f3292 rule confidence + attribute (#​293)
• 6fa83dd updating confidence for a few rules (#​298)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.