chore(deps): bump GitGuardian/ggshield from 1.53.0 to 1.54.0

[dependabot]

Bumps GitGuardian/ggshield from 1.53.0 to 1.54.0.

Release notes

Sourced from GitGuardian/ggshield's releases.

1.54.0

• pip/pipx installs now ship the native Rust ggshield on common platforms (Linux x86-64/aarch64 for glibc and musl, macOS universal2, Windows x86-64); the Python implementation is installed alongside as ggshield-py. Platforms without a native wheel fall back to the pure-Python wheel, where ggshield is the Python entry point — as does Homebrew, which builds from the source distribution.

Added

• Add secret-scanning hook support for Mistral Vibe 2.21 and later. Global and project installation preserves existing hooks.toml content and configures Vibe's pre_tool and post_tool events.

• A native ggshield-hook binary implements ggshield secret scan ai-hook, removing the interpreter startup cost the hook paid twice per tool call. It resolves the instance's scan limits from the same places ggshield does (GG_MAX_DOC_SIZE / GG_MAX_DOCS, the on-disk auth-check cache, then /v1/metadata), so a document or a batch the instance would reject is split or skipped instead of failing the scan. It caches what it learns from /v1/metadata for five minutes, so a hook path where only the native binary runs does not pay that round trip on every scan.

• The native hook now honours the GITGUARDIAN_INSTANCE, GITGUARDIAN_API_URL and GITGUARDIAN_API_KEY settings a .env file provides, instead of declining to scan when it found one. It reads the file from the same places ggshield does (GITGUARDIAN_DOTENV_PATH, then the working directory, then the repository root), and gives it the same precedence: a value in the .env overrides the same variable already exported in the environment. A self-hosted instance configured through a .env is therefore scanned against, rather than left unscanned. Two caveats: an unbraced $ in a value is expanded as a variable reference (so GITGUARDIAN_API_KEY=abc$def resolves to abc — quote it as 'abc$def' to keep the $), and a GITGUARDIAN_* line the parser rejects still leaves the action unscanned, with a message naming the variable.

• AI discovery now reports, per agent, the email of the assistant subscription that agent is signed into, so a personal subscription can be told apart from a company one. Read locally from Claude Code, Codex and Cursor. Mistral Vibe and VSCode keep no account on disk and report nothing.

• GGSHIELD_NO_NOTIFICATION suppresses the AI hook's desktop notification. The secret is still detected and the tool call still blocked; only the banner is withheld.

Changed

• Release binaries are now built with Python 3.14 instead of 3.10, ahead of Python 3.10's end-of-life. This also updates the SQLite bundled in the released binaries, fixing CVE-2025-6965 and CVE-2025-7709.

• AI hooks no longer call the API twice for the same document. An unambiguously clean scan result is cached locally for 15 minutes, keyed on the exact document sent and on

... (truncated)

Changelog

Sourced from GitGuardian/ggshield's changelog.

1.54.0 — 2026-08-26

• pip/pipx installs now ship the native Rust ggshield on common platforms (Linux x86-64/aarch64 for glibc and musl, macOS universal2, Windows x86-64); the Python implementation is installed alongside as ggshield-py. Platforms without a native wheel fall back to the pure-Python wheel, where ggshield is the Python entry point — as does Homebrew, which builds from the source distribution.

Added

• Add secret-scanning hook support for Mistral Vibe 2.21 and later. Global and project installation preserves existing hooks.toml content and configures Vibe's pre_tool and post_tool events.

• A native ggshield-hook binary implements ggshield secret scan ai-hook, removing the interpreter startup cost the hook paid twice per tool call. It resolves the instance's scan limits from the same places ggshield does (GG_MAX_DOC_SIZE / GG_MAX_DOCS, the on-disk auth-check cache, then /v1/metadata), so a document or a batch the instance would reject is split or skipped instead of failing the scan. It caches what it learns from /v1/metadata for five minutes, so a hook path where only the native binary runs does not pay that round trip on every scan.

• The native hook now honours the GITGUARDIAN_INSTANCE, GITGUARDIAN_API_URL and GITGUARDIAN_API_KEY settings a .env file provides, instead of declining to scan when it found one. It reads the file from the same places ggshield does (GITGUARDIAN_DOTENV_PATH, then the working directory, then the repository root), and gives it the same precedence: a value in the .env overrides the same variable already exported in the environment. A self-hosted instance configured through a .env is therefore scanned against, rather than left unscanned. Two caveats: an unbraced $ in a value is expanded as a variable reference (so GITGUARDIAN_API_KEY=abc$def resolves to abc — quote it as 'abc$def' to keep the $), and a GITGUARDIAN_* line the parser rejects still leaves the action unscanned, with a message naming the variable.

• AI discovery now reports, per agent, the email of the assistant subscription that agent is signed into, so a personal subscription can be told apart from a company one. Read locally from Claude Code, Codex and Cursor. Mistral Vibe and VSCode keep no account on disk and report nothing.

• GGSHIELD_NO_NOTIFICATION suppresses the AI hook's desktop notification. The secret is still detected and the tool call still blocked; only the banner is withheld.

Changed

• Release binaries are now built with Python 3.14 instead of 3.10, ahead of Python 3.10's end-of-life. This also updates the SQLite bundled in the released binaries, fixing CVE-2025-6965 and CVE-2025-7709.

• AI hooks no longer call the API twice for the same document. An unambiguously clean

... (truncated)

Commits

• efc667f chore(release): 1.54.0
• 72cefee Merge pull request #1433 from GitGuardian/nathanriviere/remove-banner-from-re...
• d77414b docs: remove banner from readme
• eaa3e43 Merge pull request #1416 from GitGuardian/dependabot/github_actions/actions/c...
• 8a9d36c Merge pull request #1415 from GitGuardian/dependabot/github_actions/docker/bu...
• 2df51fd Merge pull request #1414 from GitGuardian/dependabot/github_actions/actions/u...
• ebd4174 Merge pull request #1413 from GitGuardian/dependabot/github_actions/actions/c...
• 5c10eae Merge pull request #1404 from GitGuardian/amascia/ai-hook-ignored-paths
• ca4ec50 build(deps): bump actions/checkout from 4 to 7
• 1dabd7b build(deps): bump docker/build-push-action from 6 to 7
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)