pypi / kingfisher-bin
kingfisher-bin
What changed in kingfisher-bin 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-22.
5 breaking2 security14 new APIs and options1 performance8 behavior and defaults9 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initkingfisher-bin 239 changes
Breaking changes 5
Jira API requests no longer follow redirects, including same-origin redirects.
The Rust rules crate is prepared for 2.0.0, with public rules types and re-exports; Rust scanner consumers must use rules 2.x types.
Jira API requests no longer follow redirects; reverse-proxy installations must supply the final canonical URL, including its context path.
HTTP revocation defaults to no retries; HTTP 429 is retried only for read-only lookup steps, never for custom mutations.
Mutating HTTP 429 responses are reported with unknown outcomes rather than treated as safely retryable.
Security 2
Resolves the IAM username explicitly, rejects temporary ASIA credentials, and reports indeterminate mutation outcomes as unknown.
HTTP revocation errors no longer expose secret-bearing URLs.
New APIs and options 14
Adds Azure Blob Storage scanning with SAS, account-key, Entra-token, and anonymous authentication.
With this option set to false, repository links, commit IDs, and file paths remain available while author, committer, and date details are hidden.
A new offline Liquid checksum filter validates IBAN checksums.
A new offline Liquid checksum filter validates Luhn checksums.
This option lifts content caps but preserves timeouts.
Adds an option to disable scan operation deadlines independently of content caps.
Custom HTTP validators can use OAuth2 password-grant authentication with environment-backed credentials, token reuse and refresh, failure cooldowns, and fixed-origin delivery.
Adds Liquid signing for RS256 JWT validation with PKCS#1 and PKCS#8 PEM keys.
AWS blast-radius mapping now provides bounded, read-only regional foundation-model and inference-profile visibility, preserving region and model context without invoking or enabling models.
Adds opt-in responder credentials via a named profile or default credential chain, plus explicit target usernames, regions, and deactivate or delete actions; deletion is never an automatic fallback.
Adds local image scanning through the Docker Engine API, with active-context support, Docker CLI/OCI fallbacks, and cleanup of failed local attempts.
Adds offline preparation by exact rule IDs or names, or deterministic provider families, with candidate validation and advisory-only typo suggestions.
Adds SMTP credential validation using STARTTLS or implicit TLS without sending email, with credential URIs and accepted, rejected, or inconclusive outcomes.
Adds preparation from source text or files, structured missing-input diagnostics, and explicit batch revocation with complete-input deduplication and retained interruption outcomes.
Performance 1
Eligible unbounded regex rules scan dense newline-separated findings faster without changing findings.
Behavior and default changes 8
Shared path and extension selection now applies across files, Git sources, and archive members; supported storage scans filter before downloading.
The command now checks negative examples and applies scan-time selection, entropy, safe-list, pattern, checksum, and rule-filter checks to positive and negative examples.
SDK rule execution is aligned with the CLI, including typed URI checks, compact full-match context, bounded candidate verification, and grouped validation requests.
Storage scans support resumable listings and incremental caching with complete reports.
Downloads are capped before excess bytes are written to disk, while explicit unlimited mode is preserved.
Image output directories are isolated without deleting existing files supplied by the caller.
Adds resolved credential inputs and result-based revocation, automatically reusing validated AWS pairs and other supporting values.
The stable Rust credential URI API is preserved.
Fixes and other changes 9
Startup segfaults in dynamically linked Linux builds, including nixpkgs with glibc 2.44, are fixed by disabling mimalloc's native allocator overrides while retaining it for Rust allocations.
GitHub usernames ending in - are no longer rejected when supplied with --user.
GitHub usernames ending in - are no longer rejected when supplied with --user-file.
AWS IAM mutations retry definitive throttling without repeating failures whose outcomes are ambiguous.
Docker host selection precedence is corrected.
Image handling now preserves files named layer.tar.
Failures during local image export are surfaced to the caller.
Prepared validation outcomes now match, scan state is preserved during credential preparation, and completed revocation evidence survives cancellation.
Avoids redundant regex confirmation widening in the CLI and SDK while preserving matches when iterator alignment shifts.