chore(deps): Bump the actions group with 3 updates

[dependabot]

Bumps the actions group with 3 updates: github/codeql-action, trufflesecurity/trufflehog and Bogdanp/setup-racket.

Updates github/codeql-action from 4.38.0 to 4.38.1

Release notes

Sourced from github/codeql-action's releases.

v4.38.1

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

Changelog

Sourced from github/codeql-action's changelog.

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

Commits

• 1c5b675 Merge pull request #4152 from github/update-v4.38.1-a65b83a73
• a97cdca Add changelog entry for #4146
• cc6c691 Update changelog for v4.38.1
• a65b83a Merge pull request #4146 from github/henrymercer/per-language-bundles-pr
• 07fa87d Clarify the latest-nightly eligibility exception
• f18f353 Describe the bundle URL resolver
• ecec9b5 Share per-language telemetry fields without renaming
• 79fe3a1 Move download telemetry into the status-report directory
• ead1f7d Rename the platform module
• 549d498 Simplify per-language platform eligibility checks
• Additional commits viewable in compare view

Updates trufflesecurity/trufflehog from 3.97.4 to 3.97.5

Release notes

Sourced from trufflesecurity/trufflehog's releases.

v3.97.5

What's Changed

• Update module github.com/rabbitmq/amqp091-go to v1.13.0 [SECURITY] by @​renovate[bot] in trufflesecurity/trufflehog#5274
• Update github-actions by @​renovate[bot] in trufflesecurity/trufflehog#5250
• Update dependency golangci/golangci-lint to v2.13.2 by @​renovate[bot] in trufflesecurity/trufflehog#5251
• Make GitHub App installationId optional when scanning all installations by @​kashifkhan0771 in trufflesecurity/trufflehog#5275
• [INT-942] Add HumioAPIToken detector by @​unsmith in trufflesecurity/trufflehog#5258
• Object filtering in S3 by @​shahzadhaider1 in trufflesecurity/trufflehog#5286
• feat(detectors): add Resend detector by @​mwoss in trufflesecurity/trufflehog#5103
• Clean up use of wasilibs/go-re2 by @​bradlarsen in trufflesecurity/trufflehog#5273
• Low-memory Git Scanning by @​mariduv in trufflesecurity/trufflehog#5257
• Adding no-ignore flag to allow reporting of "ignored" secrets by @​jordanTunstill in trufflesecurity/trufflehog#5297
• Postgres: drop non-connection URI params before verifying by @​jordanTunstill in trufflesecurity/trufflehog#5296
• fix(detectors/ngrok): broaden valid bearer tokens matching by @​mattbrady-1 in trufflesecurity/trufflehog#5152
• ci: avoid Node 20 BuildPulse action by @​dustin-decker in trufflesecurity/trufflehog#5266
• Introduce a new optional detector interface that will allow us to verify credentials not in the cache by @​kvnphvm in trufflesecurity/trufflehog#5298
• perf(engine): lowercase prefilter chunks as ASCII in a pooled buffer by @​kashifkhan0771 in trufflesecurity/trufflehog#5291
• Add documentation for CircleCI source by @​kashifkhan0771 in trufflesecurity/trufflehog#5268
• Add filesystem source documentation by @​kashifkhan0771 in trufflesecurity/trufflehog#5285
• Add elasticsearch source documentation by @​kashifkhan0771 in trufflesecurity/trufflehog#5284
• [SCAN-177] Purge secret parts from verification cache by @​casey-tran in trufflesecurity/trufflehog#5318

New Contributors

• @​mwoss made their first contribution in trufflesecurity/trufflehog#5103
• @​kvnphvm made their first contribution in trufflesecurity/trufflehog#5298

Full Changelog: trufflesecurity/trufflehog@v3.97.4...v3.97.5

Commits

• f714bf4 [SCAN-177] Purge secret parts from verification cache (#5318)
• 4ecb5c6 Add elasticsearch source documentation (#5284)
• 8d77a9d Add filesystem source documentation (#5285)
• b8a71ee Add documentation for CircleCI source (#5268)
• b1d7dae perf(engine): lowercase prefilter chunks as ASCII in a pooled buffer (#5291)
• 07e3ac7 Introduce a new optional detector interface that will allow us to verify cred...
• 5a6944e ci: avoid Node 20 BuildPulse action (#5266)
• ce7b2b8 fix(detectors/ngrok): broaden valid bearer tokens matching (#5152)
• 58bf481 Postgres: drop non-connection URI params before verifying (#5296)
• 82fd19c Adding no-ignore flag to allow reporting of "ignored" secrets (#5297)
• Additional commits viewable in compare view

Updates Bogdanp/setup-racket from 1.9.1 to 1.15

Release notes

Sourced from Bogdanp/setup-racket's releases.

v1.15

• No user-visible changes. This change simply updates the action to run using Node 24, as Node 20 will be dropped by GitHub in June.

v1.14

Changed

• The snapshot sites have been updated to consolidate the set of builds provided between the Utah and Northwestern sites. BC snapshots are now no longer available, so if you currently use version: current with variant: BC, you'll have to change variant to CS to fix your builds going forward. Additionally, the "test" distribution from Northwestern is no longer available. In the highly unlikely case you were setting distribution to test, change it to full. The test option is rejected by the action as of this version.

v1.13

Added

• Support for more arm configurations. See the "ARM Builds" section of the README for details. (#81, #80, #9)

Changed

• The architecture flag no longer defaults to x64. Instead it defaults to the process arch. This may have an impact on macOS builds if you were using ARM runners and weren't specifying the arch.

v1.12

Added

• Support for Northwestern test distributions (distribution: test; Bogdanp/setup-racket#78)

Changed

• The version argument now defaults to stable

v1.11

Changed

• Bumped the Node.js runtime version from 16 to 20. (#70)

v1.10

Changed

• By default, snapshot versions are now installed from whichever snapshot site (between Utah and Northwestern) finished building more recently. You can pick a specific snapshot site using the new snapshot_site option. (#63, #64)

Commits

• 2466913 doc: s/1.14/1.15 and s/8.18/9.1 [skip ci]
• 2d6a750 build: update dependencies and run on node 24
• 8823878 ci: drop macos-13
• 510c17a build(deps): bump js-yaml from 3.14.1 to 3.14.2 (#84)
• 0e4942f doc: s/8.17/8.18
• dff14a0 build(deps): bump form-data from 3.0.1 to 3.0.4 (#83)
• fda0f4d doc: update version [skip ci]
• e321cc4 ci: drop deprecated windows-2019 environment
• b45ffad core: drop "test" Distribution
• 2c52f9b ci: drop BC variant and "test" distribution from Northwestern tests
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 719a99d1-c40a-4f99-aeea-c7cf929c18c6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}