chore(deps-dev): Bump @secretlint/secretlint-rule-preset-recommend from 11.4.0 to 13.0.0

[dependabot]

Bumps @secretlint/secretlint-rule-preset-recommend from 11.4.0 to 13.0.0.

Release notes

Sourced from @​secretlint/secretlint-rule-preset-recommend's releases.

v13.0.0

Highlights

v13 changes how files are discovered on disk and adds three credential detection rules.

.gitignore is respected by default

Nested .gitignore files now apply to file discovery with ripgrep semantics: rules from each directory cascade into its subtree, and a negation rule in a deeper file can flip an earlier verdict.

Files excluded by any .gitignore on the path are no longer scanned. Repositories that previously relied on Secretlint scanning ignored files (such as dist/ or generated artefacts) will see fewer files in the output. .secretlintignore is unchanged and continues to apply alongside .gitignore.

To restore the v12 behaviour:

secretlint --no-gitignore "**/*"

If a file is matched by a .gitignore rule but still appears in Secretlint's output, please open an issue at https://github.com/secretlint/secretlint/issues.

Glob-shaped paths that exist on disk are treated literally

--no-glob and "globs by default" both existed in v12. What changed in v13 is the fallback for inputs that contain glob metacharacters but resolve to a real file or directory.

In v12, an input like src/(group)/page.tsx was always parsed as a glob, so SvelteKit / Next.js routes whose names contain (), [], {}, or ? required --no-glob. v13 runs a single stat per glob-shaped input: if it exists, the input is treated literally; otherwise it stays a glob.

Pattern	On disk	v12 default	v13 default
src/(group)/page.tsx	exists	parsed as glob, no match	matched literally
src/(missing)/page.tsx	absent	parsed as glob	parsed as glob
src/[a-z]ormal.tsx	normal.tsx exists	matched via glob	matched via glob

Pass --no-glob to skip the probe and force literal interpretation.

New and promoted rules

Added to preset-recommend:

Rule	Detects
@secretlint/secretlint-rule-tailscale	Tailscale API keys (new package)
@secretlint/secretlint-rule-stripe	Stripe API keys (new package)
@secretlint/secretlint-rule-cloudflare	Cloudflare API tokens (promoted from preset-canary)

What's Changed

Breaking Changes

• feat!: respect .gitignore by default via @​secretlint/walker by @​azu in secretlint/secretlint#1530
• feat(secretlint-rule-preset-recommend): promote cloudflare, stripe, tailscale from canary by @​azu in secretlint/secretlint#1538

Features

• Add Tailscale API key detection rule by @​azu in secretlint/secretlint#1536
• feat(secretlint-rule-stripe): add Stripe API key detection rule by @​azu in secretlint/secretlint#1537

... (truncated)

Commits

• 873b507 v13.0.0 (#1539)
• 44d79b3 feat(secretlint-rule-preset-recommend): promote cloudflare, stripe, tailscale...
• eedb444 feat(secretlint-rule-stripe): add Stripe API key detection rule (#1537)
• 8061491 Add Tailscale API key detection rule (#1536)
• 14c0de7 Update dependency turbo to ^2.9.7 (#1535)
• 256754d Update dependency picomatch to ^4.0.4 (#1534)
• 5aa8a72 Update dependency Bun to v1.3.13 (#1526)
• 9c205f8 Update Node.js to v24.15.0 (#1514)
• 86ca775 feat!: respect .gitignore by default via @​secretlint/walker (#1530)
• be23e9a Update textlint to ^15.6.0 (minor) (#1529)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.