chore(deps): update dependency betterleaks/betterleaks to v1.8.0

[renovate]

This PR contains the following updates:

Package	Update	Change	Pending
betterleaks/betterleaks	minor	v1.7.4 → v1.8.0	v1.8.1

---

Release Notes

betterleaks/betterleaks (betterleaks/betterleaks)

v1.8.0

Compare Source

What's New

More Generic Rules

Previously, generic-api-key also handled password-like identifiers. In v1.8.0, generic credential detection is separated into focused rules:

Rule	Detects	Confidence behavior
generic-api-key	API keys, tokens, and other opaque machine secrets without a known provider	Starts at low and can move to medium when stronger context is present
generic-password	Hardcoded password assignments and passwords passed to authentication calls	Starts at low and can move to medium when nearby identity or authentication context strengthens the finding
generic-credential-uri	Passwords embedded in HTTP, database, messaging, directory, mail, FTP, and SSH URIs	Starts at medium and drops to low for test, documentation, or example-like contexts

The password rule uses nearby authentication, connection, and username fields as supporting evidence. A hidden generic-username component supplies that context without producing standalone username findings.

The credential URI rule reports the embedded password rather than the entire URI. Provider-specific rules continue to take precedence when a more precise match is available.

Filter findings by confidence

Every bundled rule now assigns a low, medium, or high confidence level based on how strongly its pattern indicates a real secret.

Use the new --confidence flag to set the minimum level included in a scan:

betterleaks dir . --confidence medium

Suppressed findings are removed before live validation, so they do not generate validation requests or affect reports, finding counts, or exit codes.

Customize confidence

Custom rules can assign a static confidence level:

[[rules]]
id = "internal-api-key"
confidence = "low"
regex = '''...'''

Rule filters can also change confidence based on context using filter.setConfidence:

let level = hasStrongContext ? "medium" : "low";
let _ = filter.setConfidence(level);
false

It's a bit hacky and should be used sparingly, but it's better than not being able to update confidence in config.

Rules without an assigned confidence remain included when a confidence threshold is used, preserving compatibility with existing custom configurations.

More control over individual rules

This release also adds dedicated flags for disabling or isolating rules:

# Disable a noisy rule
betterleaks dir . --disable-rule generic-password

# Run only the generic rules
betterleaks dir . \
  --isolate-rule generic-api-key \
  --isolate-rule generic-password \
  --isolate-rule generic-credential-uri

Both flags are repeatable and also support -dr and -ir aliases. The existing --enable-rule flag remains available as a compatibility alias for --isolate-rule.

Other improvements

• Added detection for GitLab incoming-mail address tokens.
• Fixed incorrect finding column positions in file scans.
• Improved handling of malformed compressed files.
• Filtered a known deactivated Flickr token from the generic API-key rule.
• Updated rule confidence classifications across the bundled rule set.
• Updated the Go toolchain and dependencies.

Full changelog: v1.7.4...v1.8.0

Changelog

• 706dbe2 Chore/demote linkedin (#​299)
• ecea1f6 Fix incorrect column value being returned for files (#​258)
• c4a792a Ignore deactivated Flickr token in Dojo Toolkit (#​296)
• f3c0490 Rule/generic uri (#​304)
• 23b73e4 Rules/new username pw (#​289)
• 6cf4f1a Rules/update w confidence (#​297)
• d4fe93b additional gitlab incoming mail token detection (#​288)
• 3601d77 chore: Bumping Go to 1.25.10 and update x/text library (#​294)
• 5e8ec7f disable and isolate rules (#​303)
• c8a3750 fix (#​306)
• 6ed638a fix path to CONTRIBUTING.md (#​292)
• 49f3292 rule confidence + attribute (#​293)
• 6fa83dd updating confidence for a few rules (#​298)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.