Skip to content

chore(deps): update dependency betterleaks/betterleaks to v1.8.1 #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
enieuwy merged 3 commits into from
Sep 2, 2026
Merged

chore(deps): update dependency betterleaks/betterleaks to v1.8.1 #17

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
176b0e9
chore(deps): update dependency betterleaks/betterleaks to v1.8.1
renovate-orgmentem[bot] Aug 31, 2026
051f914
ci: pin betterleaks 1.8.1 checksum
enieuwy Sep 2, 2026
de69800
ci: accept betterleaks 1.8.x generic findings in redaction fixtures
enieuwy Sep 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions .betterleaksignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
# Accepted findings for `betterleaks git .` (see .github/workflows/ci.yml `secrets`).
# betterleaks 1.8.0 split generic credential detection into `generic-password`
# and `generic-credential-uri`, which match three placeholder values in test
# fixtures. Each fixture exists to prove papio redacts credentials, so the
# literal placeholder is the point of the test and must stay in history.
# Do not quote those placeholders here — this file is scanned too.
#
# Institutional-gate detail redaction test.
9ef3b4fce70c7523f7a66311842d8a330248759e:internal/job/institutional_gates_test.go:generic-password:249
# Popup URL redaction test.
197924d76b97a2c846470bba1b3c84f812376ca0:extension/test/popup.test.ts:generic-credential-uri:2202
# Protocol fixture: a route carrying credentials must be rejected.
21e58b29620504396eafea21373eb5c6b6daa34e:testdata/protocol/invalid/acquisition-bundle-v2-route-with-credentials.json:generic-credential-uri:17
4 changes: 2 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,8 +82,8 @@ jobs:
- name: betterleaks
run: |
set -euo pipefail
BL_VERSION=1.7.4
BL_SHA256=9ed7739a39a26a2217f38726bff8a8f4fe079d3b21272caa7959823ccc444d96
BL_VERSION=1.8.1
BL_SHA256=efa407244e1ea8e35f582b8a42becdeac08bdead04f68eb752adda722d583c2a
TMP="$(mktemp -d)"
curl -sSL "https://github.com/betterleaks/betterleaks/releases/download/v${BL_VERSION}/betterleaks_${BL_VERSION}_linux_x64.tar.gz" -o "$TMP/bl.tar.gz"
echo "${BL_SHA256} $TMP/bl.tar.gz" | sha256sum -c -
Expand Down
Loading