chore(deps): update dependency mongodb/kingfisher to v2 - #8879
Merged
Conversation
renovate
Bot
requested review from
Kurt-von-Laven,
bdovaz and
echoix
as code owners
September 2, 2026 10:33
Contributor
✅
|
renovate
Bot
force-pushed
the
renovate/mongodb-kingfisher-2.x
branch
from
September 3, 2026 22:48
35c20f1 to
b8e8345
Compare
kingfisher v2 loads new detector rules and reports the AWS Bedrock pattern stored in megalinter/descriptors/additional/betterleaks-default.toml as a real secret. That file is a detection ruleset, not credentials, so exclude it exactly as gitleaks-default.toml already is.
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.113.0→2.0.0v2.1.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
mongodb/kingfisher (mongodb/kingfisher)
v2.0.0Compare Source
generic-credential-urirule withoutchanging its detector: PostgreSQL, MySQL/MariaDB, and MongoDB URI captures now use the
corresponding live validator and feed validated credentials into blast-radius mapping, while
unsupported URI schemes remain detected with validation not attempted. JDBC strings containing
a credential-bearing PostgreSQL/MySQL URI are handled through that inner URI, and direct
CredentialUrivalidation also dispatches supportedjdbc:inputs.169.254.169.254), CGNAT, and other non-public addresses, turning the scan report into an internal-network reachability oracle. Every host in a Postgres multi-host URL and every MongoDB seed — including hosts resolved viamongodb+srv://SRV records — is now checked, and blocked targets report a constant message instead of the driver's connection error. Use--allow-internal-ipsto opt back in.validate_mongodb,validate_mysql,validate_postgres, andvalidate_jdbctake an additionalallow_internal_ips: boolargument.tls_modefor built-in rules. The imported-rule capability overlay now acceptstls_mode: strict | lax | off, andbetterleaks.mongodb-connection-stringandbetterleaks.jwtdeclarelaxso self-managed clusters and self-hosted IdPs presenting private-CA or self-signed certificates validate again. This remains opt-in on both sides: it takes effect only when the operator also runs--tls-mode lax(or--tls-mode off). The build rejects an unknowntls_modevalue, or atls_modeon a rule with no validator.--rule,--exclude-rule, andrules.disabledentries namingkingfisher.*IDs now resolve to their 2.x replacements through a new alias table, with a one-time deprecation warning naming the selector to migrate to, instead of failing the scan. Exactkingfisher.*IDs still win when the 1.x catalog is loaded via--rules-path, and an unknownkingfisher.*selector is still an error.crates/kingfisher-rules/data/legacy-rule-aliases.ymlmapsmigrated Kingfisher 1.x families with known 2.x replacements, and a test asserts each alias target
still resolves against the built-in catalog, so an upstream release that drops a replacement fails
the build instead of silently breaking that compatibility path.
Veles detectors filling gaps, giving the community a well-designed shared format and a common
place to develop generally useful rules.
time; the Kingfisher 1.x YAML custom-rule format remains supported for custom rules.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.