chore(deps): update dependency mongodb/kingfisher to v2 - #8879
Open
renovate[bot] wants to merge 1 commit into
Open
chore(deps): update dependency mongodb/kingfisher to v2#8879renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
requested review from
Kurt-von-Laven,
bdovaz and
echoix
as code owners
September 2, 2026 10:33
Contributor
✅
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.113.0→2.0.0v2.1.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
mongodb/kingfisher (mongodb/kingfisher)
v2.0.0Compare Source
generic-credential-urirule withoutchanging its detector: PostgreSQL, MySQL/MariaDB, and MongoDB URI captures now use the
corresponding live validator and feed validated credentials into blast-radius mapping, while
unsupported URI schemes remain detected with validation not attempted. JDBC strings containing
a credential-bearing PostgreSQL/MySQL URI are handled through that inner URI, and direct
CredentialUrivalidation also dispatches supportedjdbc:inputs.169.254.169.254), CGNAT, and other non-public addresses, turning the scan report into an internal-network reachability oracle. Every host in a Postgres multi-host URL and every MongoDB seed — including hosts resolved viamongodb+srv://SRV records — is now checked, and blocked targets report a constant message instead of the driver's connection error. Use--allow-internal-ipsto opt back in.validate_mongodb,validate_mysql,validate_postgres, andvalidate_jdbctake an additionalallow_internal_ips: boolargument.tls_modefor built-in rules. The imported-rule capability overlay now acceptstls_mode: strict | lax | off, andbetterleaks.mongodb-connection-stringandbetterleaks.jwtdeclarelaxso self-managed clusters and self-hosted IdPs presenting private-CA or self-signed certificates validate again. This remains opt-in on both sides: it takes effect only when the operator also runs--tls-mode lax(or--tls-mode off). The build rejects an unknowntls_modevalue, or atls_modeon a rule with no validator.--rule,--exclude-rule, andrules.disabledentries namingkingfisher.*IDs now resolve to their 2.x replacements through a new alias table, with a one-time deprecation warning naming the selector to migrate to, instead of failing the scan. Exactkingfisher.*IDs still win when the 1.x catalog is loaded via--rules-path, and an unknownkingfisher.*selector is still an error.crates/kingfisher-rules/data/legacy-rule-aliases.ymlmapsmigrated Kingfisher 1.x families with known 2.x replacements, and a test asserts each alias target
still resolves against the built-in catalog, so an upstream release that drops a replacement fails
the build instead of silently breaking that compatibility path.
Veles detectors filling gaps, giving the community a well-designed shared format and a common
place to develop generally useful rules.
time; the Kingfisher 1.x YAML custom-rule format remains supported for custom rules.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.