chore(deps): bump the github-actions group with 2 updates

[dependabot]

Bumps the github-actions group with 2 updates: shivammathur/setup-php and trufflesecurity/trufflehog.

Updates shivammathur/setup-php from 2.37.2 to 2.40.0

Release notes

Sourced from shivammathur/setup-php's releases.

2.40.0

Changelog

• Added support for PHP 8.7 nightly builds. This installs PHP builds from the master branch of php/php-src.

- name: Setup PHP 8.7
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.7'

• Added support for Ubuntu 26.04 (ubuntu-26.04). (#1083)

• Added support for pinning tools to SHA-256 and SHA-512 checksums. (#1098, #1099)

- name: Setup PHP with tools pinned to checksums
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: >
      composer:2.9.8@sha256:59b2c50e10cafa0d8efc19ede9a326d782f096c674a26baf98cf042ce23de890,
      phpunit:12.5.0@sha512:76430b433bd57f96e5fbbabaefc0c82e3a5b19b1a366bd836614344c441a7a87575d77faa07e0e58ecec52061af67584b036adc4311f0764bd4414bc62be4684

• Fixed support for Couchbase, Oracle, and IBM extensions on Ubuntu 26.04. (#1123)

• Added support for cpx. (#1104)

- name: Setup PHP with cpx
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: cpx

• Added support for Laravel Cloud CLI. (#1106)

- name: Setup PHP with Laravel Cloud CLI
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: laravel-cloud

• Added configurable verbose logging using the verbose environment variable. Set it to true or v to show command output, or vv or vvv to also enable tracing. Also, deprecated the verbose and more-verbose tags in favor of this environment variable. (#1077, #1118, #1119)

... (truncated)

Commits

• eb7c497 Bump version to 2.40.0
• 7d671ba Resolve PHP formula aliases before invoking Homebrew
• 57747c1 Allow opt-in builds cache on Blacksmith and Depot runners
• 421f97f Keep verbose tests in TypeScript
• dc7811a Bump Node.js dependencies
• 7932293 Bump the github-actions group with 3 updates (#1130)
• 87d00bd Default "Are you willing to submit a PR?" to "No" (#1126)
• f458a14 Remove macOS 14 from README runner listings
• bc12f5c Switch to homebrew-extensions for geos on macOS [skip ci]
• bbf0b63 Try Brew extension installs before refreshing Homebrew
• Additional commits viewable in compare view

Updates trufflesecurity/trufflehog from 3.97.9 to 3.99.2

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.99.2

What's Changed

• Copy over dedupe cache size into the engine from the config by @​camgunz in trufflesecurity/trufflehog#5402

Full Changelog: trufflesecurity/trufflehog@v3.99.1...v3.99.2

v3.99.1

What's Changed

• Update github-actions by @​renovate[bot] in trufflesecurity/trufflehog#5363
• [INT-1084] Make the results deduplication cache size configurable by @​camgunz in trufflesecurity/trufflehog#5399

Full Changelog: trufflesecurity/trufflehog@v3.99.0...v3.99.1

v3.99.0

What's Changed

• Fix Sumo Logic detector ignoring configured verifier endpoints by @​unsmith in trufflesecurity/trufflehog#5395
• Add OAuth2 (ROPC) auth for verification requests by @​unsmith in trufflesecurity/trufflehog#5392

Full Changelog: trufflesecurity/trufflehog@v3.98.1...v3.99.0

v3.98.1

What's Changed

• Add postman source documentation by @​kashifkhan0771 in trufflesecurity/trufflehog#5389
• Add a TruffleHog dectector for Kong Konnect Platform by @​mrwanny in trufflesecurity/trufflehog#5305
• Add api_timeout_seconds to Gerrit source proto by @​kashifkhan0771 in trufflesecurity/trufflehog#5394

New Contributors

• @​mrwanny made their first contribution in trufflesecurity/trufflehog#5305

Full Changelog: trufflesecurity/trufflehog@v3.98.0...v3.98.1

v3.98.0

What's Changed

• Int 595 verify asymmetry by @​shahzadhaider1 in trufflesecurity/trufflehog#5261
• return error body for fetchBearerToken by @​jordanTunstill in trufflesecurity/trufflehog#5301
• Update module github.com/charmbracelet/bubbletea to v1.3.10 by @​renovate[bot] in trufflesecurity/trufflehog#5281
• Update github.com/trufflesecurity/ldap-verify digest to 3142cc9 by @​renovate[bot] in trufflesecurity/trufflehog#5280
• [INT-1086] Don't reuse maps; editing them afterwards edits them for all results by @​camgunz in trufflesecurity/trufflehog#5351
• [INT-1091] Treat Square 403 as verified on INSUFFICIENT_SCOPES by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#5367
• feat: add --no-ignore-tag to report secrets on trufflehog:ignore lines by @​thiswillnevermatch in trufflesecurity/trufflehog#5293
• Fix failing TestGHCRListImages test in CI by @​MuneebUllahKhan222 in trufflesecurity/trufflehog#5368
• Revert duplicate --no-ignore-tag changes from #5293 by @​shahzadhaider1 in trufflesecurity/trufflehog#5369
• Show progress inside S3 buckets by @​shahzadhaider1 in trufflesecurity/trufflehog#5330
• fix(output): escape special characters in --github-actions output by @​kenanyararbas in trufflesecurity/trufflehog#5353
• fix(detectors): remove stray fmt.Printf in portainertoken by @​Gracy769 in trufflesecurity/trufflehog#5334
• resolve race condition in result deduplication cache by @​kvnphvm in trufflesecurity/trufflehog#5359
• added entropy filter and improved verification for gitlab v2/v3 by @​jordanTunstill in trufflesecurity/trufflehog#5358

... (truncated)

Commits

• e76dff8 Somehow forgot to pull the config value into the engine (#5402)
• 005b692 [INT-1084] Make the results deduplication cache size configurable (#5399)
• f6499ff Update github-actions (#5363)
• b2b0a92 Add OAuth2 (ROPC) auth for verification requests (#5392)
• ab5ee07 Fix Sumo Logic detector ignoring configured verifier endpoints (#5395)
• 4c282f5 Add api_timeout_seconds to Gerrit source proto (#5394)
• c95844e Add a TruffleHog dectector for Kong Konnect Platform (#5305)
• cc79781 Add postman source documentation (#5389)
• 0186870 Add pkg/ssrf shared egress guard; use it for WithNoLocalIP and analyzer clien...
• bb9ed13 docs: point five internal links at files that exist (#5375)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions