# What changed in kingfisher-bin > 39 changes in kingfisher-bin 2 from its official release notes, upgrade guides and advisories: 5 breaking, 2 security, 14 new APIs and options. Each one cited. Sources checked 2026-10-22. HTML: https://unstale.sh/pypi/kingfisher-bin/ To see which of these apply to a repository, run `npx @unstale/cli init` in it. ## kingfisher-bin 2 ### Breaking changes - Jira API requests no longer follow redirects, including same-origin redirects. (2.14.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.14.0) - The Rust rules crate is prepared for 2.0.0, with public rules types and re-exports; Rust scanner consumers must use rules 2.x types. (2.14.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.14.0) - Jira API requests no longer follow redirects; reverse-proxy installations must supply the final canonical URL, including its context path. (2.14.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.14.0) - HTTP revocation defaults to no retries; HTTP 429 is retried only for read-only lookup steps, never for custom mutations. (2.12.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.12.0) - Mutating HTTP 429 responses are reported with unknown outcomes rather than treated as safely retryable. (2.12.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.12.0) ### Security - Resolves the IAM username explicitly, rejects temporary ASIA credentials, and reports indeterminate mutation outcomes as unknown. (2.12.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.12.0) - HTTP revocation errors no longer expose secret-bearing URLs. (2.12.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.12.0) ### New APIs and options - Adds Azure Blob Storage scanning with SAS, account-key, Entra-token, and anonymous authentication. (2.14.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.14.0) - With this option set to false, repository links, commit IDs, and file paths remain available while author, committer, and date details are hidden. (2.14.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.14.0) - A new offline Liquid checksum filter validates IBAN checksums. (2.14.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.14.0) - A new offline Liquid checksum filter validates Luhn checksums. (2.14.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.14.0) - This option lifts content caps but preserves timeouts. (2.14.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.14.0) - Adds an option to disable scan operation deadlines independently of content caps. (2.14.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.14.0) - Custom HTTP validators can use OAuth2 password-grant authentication with environment-backed credentials, token reuse and refresh, failure cooldowns, and fixed-origin delivery. (2.14.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.14.0) - Adds Liquid signing for RS256 JWT validation with PKCS#1 and PKCS#8 PEM keys. (2.14.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.14.0) - AWS blast-radius mapping now provides bounded, read-only regional foundation-model and inference-profile visibility, preserving region and model context without invoking or enabling models. (2.13.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.13.0) - Adds opt-in responder credentials via a named profile or default credential chain, plus explicit target usernames, regions, and deactivate or delete actions; deletion is never an automatic fallback. (2.12.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.12.0) - Adds local image scanning through the Docker Engine API, with active-context support, Docker CLI/OCI fallbacks, and cleanup of failed local attempts. (2.12.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.12.0) - Adds offline preparation by exact rule IDs or names, or deterministic provider families, with candidate validation and advisory-only typo suggestions. (2.12.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.12.0) - Adds SMTP credential validation using STARTTLS or implicit TLS without sending email, with credential URIs and accepted, rejected, or inconclusive outcomes. (2.12.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.12.0) - Adds preparation from source text or files, structured missing-input diagnostics, and explicit batch revocation with complete-input deduplication and retained interruption outcomes. (2.12.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.12.0) ### Performance - Eligible unbounded regex rules scan dense newline-separated findings faster without changing findings. (2.12.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.12.0) ### Behavior and default changes - Shared path and extension selection now applies across files, Git sources, and archive members; supported storage scans filter before downloading. (2.14.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.14.0) - The command now checks negative examples and applies scan-time selection, entropy, safe-list, pattern, checksum, and rule-filter checks to positive and negative examples. (2.14.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.14.0) - SDK rule execution is aligned with the CLI, including typed URI checks, compact full-match context, bounded candidate verification, and grouped validation requests. (2.14.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.14.0) - Storage scans support resumable listings and incremental caching with complete reports. (2.14.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.14.0) - Downloads are capped before excess bytes are written to disk, while explicit unlimited mode is preserved. (2.12.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.12.0) - Image output directories are isolated without deleting existing files supplied by the caller. (2.12.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.12.0) - Adds resolved credential inputs and result-based revocation, automatically reusing validated AWS pairs and other supporting values. (2.12.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.12.0) - The stable Rust credential URI API is preserved. (2.12.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.12.0) ### Fixes and other changes - Startup segfaults in dynamically linked Linux builds, including nixpkgs with glibc 2.44, are fixed by disabling mimalloc's native allocator overrides while retaining it for Rust allocations. (2.13.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.13.0) - GitHub usernames ending in - are no longer rejected when supplied with --user. (2.13.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.13.0) - GitHub usernames ending in - are no longer rejected when supplied with --user-file. (2.13.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.13.0) - AWS IAM mutations retry definitive throttling without repeating failures whose outcomes are ambiguous. (2.12.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.12.0) - Docker host selection precedence is corrected. (2.12.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.12.0) - Image handling now preserves files named layer.tar. (2.12.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.12.0) - Failures during local image export are surfaced to the caller. (2.12.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.12.0) - Prepared validation outcomes now match, scan state is preserved during credential preparation, and completed revocation evidence survives cancellation. (2.12.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.12.0) - Avoids redundant regex confirmation widening in the CLI and SDK while preserving matches when iterator alignment shifts. (2.12.0) — [release notes](https://github.com/mongodb/kingfisher/releases/tag/v2.12.0)