[dependabot]

Bumps github.com/betterleaks/betterleaks/v2 from 2.0.0-rc.2 to 2.0.0-rc.3.

Release notes

Sourced from github.com/betterleaks/betterleaks/v2's releases.

v2.0.0-rc.3

What's New

A few big changes in this RC. First, we are no longer shelling out any commands. That means no more git or docker in cmd.Run(). Seemed messy to expose that to folks using Betterleaks as a library so we moved to go-git and some container libs instead. Git scanning is faster as a result of this change.

Repo	rc.2	rc.3
django	5.6s	4.4s
rails	10.1s	4.5s
ruby	12.8s	9.6s
gitlab	485s	104s

Part of that is because merge commits aren't diffed by default anymore (more on that below). Even with --include=merges turned back on, rails and gitlab are still about 2x faster.

Git Related Changes

• --log-opts, --staged, --unstaged, --pre-receive, and --pre-receive-error-message are gone. If you want git to pick what gets scanned, pipe it in: git log -p ... | betterleaks stdin --git-diff. The pre-commit hooks already do this.
• Merge commits aren't diffed by default. use --include=merges to enable merge commit scanning.
• Remote scans (git <url>, github, gitlab, huggingface) don't fetch PR/MR refs anymore. rc.2 mirrored everything, so you were scanning other people's unmerged PRs. octocat/Spoon-Knife has 3 commits and its mirror pulls 652k... not great. Use --clone-all-refs for the old behavior or --clone-ref=refs/pull/123/head for a single PR.
• More things to scan with --include: merges, commit-messages, tag-messages, notes, reflogs, objects, unreachable-objects.
• Commit filters: --revision=A..B, --since, --until, --author, --committer, --max-commits.

Fixes and other stuff

• AWS access keys are always reported now (#410), thanks @​rgmz
• crates.io tokens validate against the right API route (#411), thanks @​rgmz
• Docker credential helpers are opt-in now (--credential-helpers), since they're binaries we'd have to run.
• SDK folks need Go 1.26 (go-git v6 requires it).
• --daemon-host to point at a specific Docker or Podman engine.

Changelog

• 30c423ca44170ba08f72d13034e5970b6f3a7ca7 Add Veridox link to README (#399)
• c613797a684337a014168063577bb6fa6e3b6296 fix(aws): always report access keys (#410)
• b601aecf9bca6f8861aba2e0b16c61e8ee6196a5 fix(cratesio): validate against API route (#411)
• 22ae2f41a70d759e83e832a6a1b205fac729223b go-git new best friend again (#412)
• 43f0ee932d05ef2bd79b2e530994b9c9851127bc moar "who uses bl"
• f2852fe7ec478681717538e62b63efbe9f5bc436 rm shelling out docker and podman (#403)

Commits

• 22ae2f4 go-git new best friend again (#412)
• c613797 fix(aws): always report access keys (#410)
• b601aec fix(cratesio): validate against API route (#411)
• f2852fe rm shelling out docker and podman (#403)
• 43f0ee9 moar "who uses bl"
• 30c423c Add Veridox link to README (#399)
• See full diff in compare view