chore(deps): update dependency mongodb/kingfisher to v2.13.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
mongodb/kingfisher		minor	v2.11.1 → v2.13.0
mongodb/kingfisher	repository	minor	v2.11.1 → v2.13.0

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

mongodb/kingfisher

v2.13.0

Compare Source

• Refreshed workspace Cargo dependencies to compatible releases and applied the AWS SDK's size-focused release setting to Bedrock.

• Added bounded, read-only Amazon Bedrock discovery to AWS blast-radius mapping: regional foundation-model and inference-profile visibility, per-model authorization/entitlement/agreement/region availability sampled across providers, and explicit partial-permission, timeout, and coverage limits. JSON and both HTML viewers retain region/model context without invoking or enabling models; the standalone graph uses model IDs as labels with full ARNs in the details.

• Fixed crates.io publication by bumping kingfisher-rules to 1.2.1 for the regex confirmation changes shipped in v2.12.0 and updating the CLI and scanner dependency requirements. The unchanged core remains at 1.0.3, and the unpublished scanner release remains at 1.4.0.

• Fixed rejection of GitHub usernames ending in - for --user and --user-file. #​547

• Fixed startup segfaults in dynamically linked Linux builds, including nixpkgs with glibc 2.44, by disabling mimalloc's native allocator overrides while retaining it for Rust allocations. Added a regression test for free(NULL) before process initialization. #​549

v2.12.0

Compare Source

• Avoided redundant regex confirmation widening in the CLI and SDK while preserving matches when iterator alignment shifts. #​545

• Fixed prepared validation outcome parity, preserved scan state during credential preparation, and retained completed revocation evidence across cancellation.

• Preserved per-rule revocation results after failures; HTTP revocation now defaults to no retries and retries HTTP 429 only on read-only lookup steps. Custom mutations are never retried, and mutating 429 responses have unknown outcomes. AWS IAM mutations retry definitive throttling without repeating ambiguous failures.

• Removed secret-bearing URLs from CLI HTTP revocation errors and capped Docker API export downloads before writing excess bytes to disk, preserving explicit unlimited mode.

• Isolated the Docker CLI test fixture from system executables on Windows.

• Fixed Docker host precedence, surfaced local image export failures, preserved files named layer.tar, and isolated image output directories without deleting existing caller files.

• Fixed Python source-package fixtures and Windows Docker test executables, preserved the stable Rust credential URI API, and distinguished revocation failures before mutation from unknown submitted outcomes.

• Enforced release tag ancestry, matching changelog notes and existing release commit identity; SDK publish retries now upload missing PyPI distributions.

• Added local image scanning through the Docker Engine API via Bollard, with active-context support, Docker CLI/OCI fallbacks, and cleanup of failed local attempts.

• Added SMTP credential validation through STARTTLS or implicit TLS without sending email, including credential URIs, a separate-field custom rule example, common-port fallback, and distinct accepted, rejected, and inconclusive outcomes. #​544

• Added offline Python revocation preparation with exact rule IDs/names or deterministic provider families, explicit candidate validation and advisory-only typo suggestions.

• Added source-text/file revocation preparation, structured missing-input diagnostics, and explicit batch revocation with complete-input deduplication and retained interruption outcomes.

• Documented custom YAML revocation actions in the Python SDK and added custom catalog options to the preparation and batch examples.

• Added resolved credential inputs and result-based Python revocation, automatically reusing validated AWS pairs and other supporting values.

• Fixed slow scans with dense newline-separated findings for eligible unbounded regex rules, including Auth0 domains and eBay client IDs, without changing findings. #​537

• Made AWS access-key revocation safer and more reliable by resolving the IAM username explicitly, rejecting temporary ASIA credentials, and reporting indeterminate mutation outcomes as unknown.

• Added opt-in AWS responder credentials through a named profile or the default credential chain, explicit target usernames and regions, and explicit deactivate or delete actions; deletion is never an automatic fallback.

• Released kingfisher-scanner 1.4.0 with the structured AWS revocation options and outcome API.

• Bumped the Python SDK to 1.4.0 for the new validation and revocation workflows and SMTP support.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Saturday (* * * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.