chore(deps): update ghcr.io/gitleaks/gitleaks docker tag to v8.23.1

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
ghcr.io/gitleaks/gitleaks	stage	minor	v8.21.2 -> v8.23.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

gitleaks/gitleaks (ghcr.io/gitleaks/gitleaks)

v8.23.1

Compare Source

Changelog

• 7bad9f7 chore(gcp): add firebase example keys to the gcp-api-key allowlists (#​1635)
• 977236c fix: unaligned 64-bit atomic operation panic (#​1696)
• a211b16 force push to master everyday
• 0e5f644 feat(config): disable extended rule (#​1535)
• f320a60 style: prevent globbing and word splitting (#​1543)
• c4526b2 refactor(generic-api-key): remove hard-coded 'magic' (#​1600)
• 748076d chore(generate): add failing test case (#​1690)

v8.23.0

Compare Source

Changelog

• db8e5e6 feat(generate): use multiple allowlists (#​1691)
• 973c794 chore(rules): include fps in reference (#​1471)
• f0d4499 Add comma as operator for GenerateSemiGenericRegex (#​1679)
• ab38a46 refactor: central logger (#​1692)
• b022d1c friendship ended with tines

READ THIS!!! The default gitleaks config now uses [[rules.allowlists]]

##### ⚠️ In v8.21.0 `[rules.allowlist]` was replaced with `[[rules.allowlists]]`.
##### This change was backwards-compatible: instances of `[rules.allowlist]` still  work.
    #

##### You can define multiple allowlists for a rule to reduce false positives.
##### A finding will be ignored if _ANY_ `[[rules.allowlists]]` matches.
    [[rules.allowlists]]
    description = "ignore commit A"

##### When multiple criteria are defined the default condition is "OR".
##### e.g., this can match on |commits| OR |paths| OR |stopwords|.
    condition = "OR"
    commits = [ "commit-A", "commit-B"]
    paths = [
      '''go\.mod''',
      '''go\.sum'''
    ]

##### note: stopwords targets the extracted secret, not the entire regex match
##### like 'regexes' does. (stopwords introduced in 8.8.0)
    stopwords = [
      '''client''',
      '''endpoint''',
    ]

    [[rules.allowlists]]

##### The "AND" condition can be used to make sure all criteria match.
##### e.g., this matches if |regexes| AND |paths| are satisfied.
    condition = "AND"

##### note: |regexes| defaults to check the _Secret_ in the finding.
##### Acceptable values for |regexTarget| are "secret" (default), "match", and "line".
    regexTarget = "match"
    regexes = [ '''(?i)parseur[il]''' ]
    paths = [ '''package-lock\.json''' ]

v8.22.1

Compare Source

Changelog

• b69b515 Entropy trace (#​1659)
• 7357adc build: add 'toolchain' to go.mod (#​1682)
• 4c3da6e refactor(detect): create readUntilSafeBoundary + add tests (#​1676)
• dbe3746 twitter really does suck ass now
• 7edfc6b chore(tests): test cases for generate.go (#​1623)
• efe40ca fix: only use non-empty secret groups (#​1632)
• 7cb5f6f build: upgrade sprig v2->v3 (#​1674)
• 2930537 fix: generate report file even if no findings (#​1673)

v8.22.0

Compare Source

Changelog

• a91c671 replace std library regex engine with go-re2 (#​1669)

---

This bumps the gitleaks binary size from around 8.5MB to 15MB but yields 2-4x speedup. Worth it imo. If you feel strongly against this change feel free to open an issue where we can discuss the tradeoffs in more depth. Credit to @​ahrav

v8.21.4

Compare Source

Changelog

• 906085f Update golang version to 1.23 (#​1672)
• 8a83062 log bytes (#​1670)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.