[renovate]

This PR contains the following updates:

Package	Type	Update	Change
mongodb/kingfisher		minor	v2.14.0 → v2.16.0
mongodb/kingfisher	repository	minor	v2.14.0 → v2.16.0

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

mongodb/kingfisher

v2.16.0

Compare Source

Added

• Embed five detection-only connection-string password rules
  by default in the CLI, kingfisher-rules, and Python SDK, including PostgreSQL/MySQL/MariaDB
  JDBC query passwords and SQL Server JDBC properties. The catalog now has 501 rules;
  broad generic Betterleaks rules remain excluded.
  #​558

Changed

• Refresh Betterleaks to v2.0.0-rc.5 with eight new Labelbox, NuGet, and Tailscale
  content detectors. Filename-only rules remain excluded;
  selected Veles rules are unchanged.
• Detect AWS access IDs without a nearby secret key; validation and revocation
  still require a matching secret.
• Refresh API-compatible Rust, Python, documentation, and CI dependencies, including
  Vectorscan 0.1.2, Rustls 0.23.46 for the four open Rustls security advisories,
  ZIP 9.1.3 for extraction security fixes, and BIP32 0.6.0 for updated key-derivation crypto.
  Prepare core 1.0.6 for updated dependency minimums; public Rust APIs remain unchanged.

Fixed

• Detect each connection-string password when multiple connections share a source line,
  including Base64-encoded input, rather than skipping the first password.
• Keep GCS authentication and JWT validation on the same crypto backend after dependency
  updates, avoiding an uninitialized-provider panic while retaining legacy RSA verification.
• Parse local let declarations and expression sequences inside Betterleaks
  predicates, including rc.5's generic XML filters. Existing rules need no edits.
• Keep generated validation and revocation commands concise while preserving required
  component values and named captures, including AWS access-key revocation bindings.
  Omit AWS validation commands when the matching secret component is absent.
• Reject malformed private-key fixtures with short or numbered placeholder bodies, and
  stop private-key findings at their END marker without consuming nearby source or keys.
  Preserve real private keys pasted with cat -n or editor line-number prefixes.
• Reject PEM source wrappers without a plausibly encoded key payload using bounded
  structural checks shared by the CLI and SDKs, without matching placeholder or method names.
• Prepare rules/scanner 3.0.1 and Python SDK 1.6.1 for the shared private-key detection fix.
• Log PDF extraction failures and limits at DEBUG while continuing to scan raw bytes.
  Hide lopdf reader warnings and errors unless --debug/--verbose is enabled.
• Show finding details when clicking Investigate in the Overview's Investigation
  Queue, and restore page scrolling and focus when closing the dialog.

v2.15.0

Compare Source

Added

• Support Betterleaks v2 validation, analysis, and explicit revocation programs,
  including inheritance, custom path-only rules, keywords, specificity, and named
  component captures. Kingfisher YAML also accepts Expr source.
  #​562
• Add jwt_sign to construct complete RS256 JWTs from JSON claims and PEM keys.
  #​552
• Add offline, resource-bounded PDF page-text extraction for CLI file, Git-history,
  and archive scans alongside raw-byte scanning. Rust exposes PDF extraction APIs;
  Python users opt in with expand_content(..., pdf=True). See
  extraction scope, limits, and fallback behavior.
• Add versioned blast-radius assessments with capability risk, authorization
  evidence, coverage limitations, and collection-time timestamps, separate from
  legacy severity. The report viewer provides an investigation-focused workspace
  with searchable policy, role, and resource evidence and system-aware themes.
• Include provider-issued repository IDs in Git metadata and TOON reports across
  supported SCMs, keeping fork findings distinct. Discovery reuses API metadata;
  explicit remote targets use best-effort, instance-scoped lookups. Local checkout
  scans remain offline. #​564
• Add KF_GITHUB_MAX_RETRY_WAIT_SECS to configure how long scans wait through
  GitHub quota resets. #​560

Changed

• Add up to two opt-in HTTP fallback environments through --fallbacks (CLI),
  http_fallbacks=True (Python), or .http_fallbacks(true) (Rust). Validation and
  revocation logic reuse are independent, default to false, and require explicit
  replacement URLs; primary target URLs are never inherited. CLI
  revoke --fallbacks validates to select one environment, while SDK result-based
  revocation retains its validated snapshot. Mutations never fail over.
  Behavior change: legacy HTTP request.url: [primary, secondary, ...] lists
  now use only the primary by default; enabling fallbacks tries at most the primary
  and two alternatives. Existing YAML/TOML rule files still load without edits.
  #​553
• Behavior change: apply --max-file-size (default 256 MB) to Git-history
  blobs before reading their content. --max-file-size 0 and --no-limits disable
  this size limit without disabling timeouts.
  #​567,
  #​568
• Behavior change: HTTP revocation no longer follows redirects, including for
  legacy direct-primary rules. Anthropic, Terraform, and DigitalOcean access-map
  requests also refuse redirects; configure final canonical URLs instead.
• Prepare Python SDK 1.6.0 with explicit analysis and source-attribute scanning,
  and rules/scanner crates 3.0.0 for public Rust schema changes. Existing
  YAML/TOML rule files and Python APIs remain compatible; core uses the compatible 1.0.5 patch.
  Rust callers should follow the 3.0 migration guide.

Improvements

• Correct crates.io release metadata for the packaged core regression tests and
  verify the regenerated rules-manifest hash during crates-only recovery. Verified
  metadata-only recovery does not require another Python SDK release.
• Reduce malformed-container and recognized-placeholder false positives with
  conservative, bounded offline private-key checks shared by the CLI and SDKs.
  These checks do not establish cryptographic or live validity. See the
  private-key filter scope.
• Improve Git file links for punctuation, spaces, Unicode, and literal backslashes
  while preserving directory separators and line anchors.
  #​565,
  #​566
• Strip clone credentials from reported Git remote URLs and redact OAuth2
  service-authentication credentials from rule-inspection output.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Saturday (* * * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.