chore(deps): update dependency mongodb/kingfisher to v1.82.0#7137
Merged
chore(deps): update dependency mongodb/kingfisher to v1.82.0#7137
Conversation
renovate
bot
requested review from
Kurt-von-Laven,
bdovaz,
echoix and
nvuillam
as code owners
Contributor
✅
|
renovate
bot
force-pushed
the
renovate/mongodb-kingfisher-1.x
branch
from
aa5b5ad to
1308a09
Compare
echoix
approved these changes
Feb 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.76.0→1.82.0Release Notes
mongodb/kingfisher (mongodb/kingfisher)
v1.82.0Compare Source
vcp_(personal access),vci_(integration),vca_(app access),vcr_(app refresh),vck_(AI Gateway API key). All use CRC32/Base62 checksum validation. Legacy 24-char format retained askingfisher.vercel.1.vca_,vcr_) viahttps://api.vercel.com/login/oauth/token/revoke. RequiresVERCEL_APP_CLIENT_ID(orNEXT_PUBLIC_VERCEL_APP_CLIENT_ID) andVERCEL_APP_CLIENT_SECRET.BODY,CHECKSUM) when they are not used by validation/revocation templates, so rules like Vercel no longer produce unnecessary--var BODY=...arguments.JsonValid,WordMatch, etc.) now run against the full response; only the stored preview remains truncated for reporting.--validation-rps(global) and repeatable--validation-rps-rule <RULE_SELECTOR=RPS>(per-rule override) for bothscanandvalidate. Throttling now applies across built-in validator types (HTTP/gRPC plus AWS, GCP, Coinbase, MongoDB, Postgres, MySQL, JDBC, JWT, and Azure Storage). Rule selectors support the short form (for example,github=2matcheskingfisher.github.*) with longest-prefix precedence when multiple selectors apply.kingfisher.temporal.1rule for Temporal Cloud API keys (namespace-scoped and user-scoped JWT formats) with Temporal-specific pattern matching.GET https://saas-api.tmprl.cloud/cloud/current-identityusing bearer auth, so Temporal keys validate against provider APIs instead of generic OIDC discovery.iss: "temporal.io") as HTTPS URLs during discovery, avoiding low-level URL builder failures.crates/kingfisher-rules/build.rsto ensure embedded rule assets rebuild when files undercrates/kingfisher-rules/datachange.v1.81.0Compare Source
rules checkconsistently.validation: type: Grpc(e.g., Modal administrative keys).v1.80.0Compare Source
--full-validation-responseflag to include complete validation response bodies without truncation. By default, validation responses are still truncated to 512 characters for readability. When enabled, users can parse and present full validation responses as needed (e.g., for GitHub token validation responses that include user metadata beyond the first 512 characters).v1.79.0Compare Source
docs/TOKEN_REVOCATION_SUPPORT.mdwith detailed revocation implementation guide and testing examples.kingfisher-scannercrate to eliminate code duplication. Validators for AWS, Azure, Coinbase, GCP, JWT, JDBC, MongoDB, MySQL, Postgres, and HTTP are now maintained in a single location with proper feature gating.v1.78.0Compare Source
kingfisher validatecommand when rules require dependent variables fromdepends_onsections. Now clearly explains which variables are needed and from which dependent rules they are normally captured.validate_commandandrevoke_commandgeneration in scan output to include all required--vararguments for rules withdepends_onsections (e.g., PubNub, Azure Storage). Commands now include dependent variables like--var SUBSCRIPTIONTOKEN=<value>or--var AZURENAME=<value>.AZURENAMEvariable (matching thedepends_on_ruleconfiguration) withSTORAGE_ACCOUNTmaintained as a backward-compatible alias.dependent_capturesfield to match records to preserve variables from dependent rules through the validation pipeline for accurate command generation.--tls-mode <strict|lax|off>global flag to control TLS certificate validation behavior during credential validation:strict(default): Full WebPKI certificate validation with trusted CA chains, hostname verification, and expiration checkslax: Accept self-signed or unknown CA certificates, useful for database connections (PostgreSQL, MySQL, MongoDB) and services using private CAs (e.g., Amazon RDS)off: Disable all TLS validation (equivalent to legacy--ignore-certs)tls_modefield allowing individual rules to opt into relaxed TLS validation when appropriate. Rules for PostgreSQL, MySQL, MongoDB, JDBC, and JWT now includetls_mode: laxby default.--ignore-certsflag remains supported as a deprecated alias for--tls-mode=offfor backward compatibility.commitstage name in.pre-commit-hooks.yamlto usepre-commitstage name, eliminating pre-commit framework warnings.v1.77.0Compare Source
kingfisher revokesubcommand for revoking leaked credentials directly with the provider.revocationsection to rules to support credential revocation (currently supporting AWS, GCP, GitHub, GitLab, Slack, and Buildkite).kingfisher validatesubcommand to validate credentials without running a full scan.validate_commandandrevoke_commandfields to scan output (pretty, JSON, JSONL, BSON, SARIF formats) showing the exactkingfisher validateorkingfisher revokecommand to run for each finding. Thevalidate_commandis included for all findings with validation support;revoke_commandis included only for active credentials with revocation support. These fields are omitted when--redactis used since they contain the secret value.kingfisher-autopre-commit hook that automatically downloads and caches the appropriate binary for your platform (no Docker or manual installation required).install-husky.shhelper script and documentation fclearor Node.js projects.kingfisher-pre-commit-auto.shandkingfisher-pre-commit-auto.ps1scripts for automatic binary download in Git hooks (Linux, macOS, Windows support).Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.
Note
Low Risk
Simple version bump of the bundled
kingfishersecrets-scanner; main risk is unexpected behavior changes in scanning/validation from the upstream tool update.Overview
Updates the bundled
mongodb/kingfisherlinter version from1.76.0to1.82.0across the mainDockerfile,flavors/security/Dockerfile, the standalonelinters/repository_kingfisher/Dockerfile, and therepositorydescriptor install snippet so all images install the same newerkingfisherrelease.Written by Cursor Bugbot for commit 1308a09. This will update automatically on new commits. Configure here.