preparing for v2.17.0 by mickgmdb · Pull Request #574 · mongodb/kingfisher

mickgmdb · 2026-11-05T06:10:36Z

Added

Add explicit, credential-scoped revocation for Notion OAuth, Resend, Twilio key SIDs,
Vercel AI Gateway, GCP API keys, Anthropic ordinary keys, OpenAI project/admin keys,
and GitHub App user-token reports. Owner-ID actions are operator-assisted: supply
management credentials, IDs and exact full-token mappings via CLI --var or SDK
globals; env.get does not read OS environment variables. Document unsupported
families and accepted-versus-completed results with
first-party contracts.
Existing GitHub, Slack, Hugging Face and Vercel primary actions are unchanged.
Add the native kingfisher-secret-scanner JavaScript/TypeScript SDK 0.1.0 as a
preview of npm support, with typed subpaths for rules, scanning, local inputs,
Git, validation, analysis and explicit revocation. Reuse the Rust engine and
catalog, original credential snapshots and redacted reporting. See the
Node SDK guide. The SDK supports CommonJS and ESM
named/default imports on Node 22.13+, 24 and 26; bounded, cancellable
regular-file reads; filesystem onWarning callbacks (unreadable roots still
throw); and archive expansion that passes non-archives through unread.
Add exact workspace-wide third-party notices generation and verification
(make notices, npm run check:notices) across all features/targets, including
normal/build dependencies and proc macros. Reject stale or incomplete Cargo
attribution while preserving independent rule and Vectorscan notices.
Include allowlisted identity metadata in successful AWS, Hugging Face, GitHub,
GitLab, CircleCI, and Fastly validation responses. AWS includes the caller ARN,
account ID, and user ID. Reuse existing validation evidence without additional
requests or permission analysis; keep authentication tokens and other private
evidence out of reports. Preserve GCP and Azure's existing identity metadata.

Changed

Refresh Betterleaks to v2.0.0-rc.7, adding structured Mapbox secret-token detection
and updated Mapbox validation/scope analysis and Harness PAT/SAT identity analysis.
The catalog now has 502 rules; all 22 selected Veles rules remain bundled.
Prepare scanner 3.0.2 and Python SDK 1.6.2 for shared validation identity reporting
and Send validation/revocation futures, without changing public signatures or
high-level SDK result serialization. Strict budgeted archive behavior visibly
tightens: malformed/unsafe TAR/ZIP/ASAR members and staging failures reject the
whole root before returning any members. Legacy best-effort CLI defaults are unchanged.
Prepare rules 3.1.0 with additive public literal expression-input discovery, exact
Vectorscan pins, engine-aware compiled-cache identities, package documentation and
regenerated bundle provenance; the catalog retains 42 revocation bindings.
Pin Vectorscan binding/sys crates to published 0.1.4, adding MSVC x64/ARM64
embedding support with a VS 2022 / MSVC 14.44 runtime baseline and updating
compiled-rule cache build identities. Node Windows builds use checksum-verified
Vectorscan MSVC archives without a local override. Existing GNU/LLVM CLI release
targets are unchanged.
Add protected, tag-only npm OIDC publishing with complete platform checks,
native-package-first ordering, archive integrity checks and safe partial-release
retries. Development manifests remain private and unchanged by release staging.
Name the supported Kingfisher, Gitleaks and TruffleHog report imports in the
report viewer's upload instructions.

Fixed

Evaluate upstream fromBase64 finding filters with bounded UTF-8 decoding, preserving
Mapbox payload checks and compatibility with existing custom YAML/TOML rules.
Preserve both filtering and revocation for Heroku/Slack overlay entries, rejecting
duplicate rule IDs. Limit Veles precedence filters to covered Git URLs,
case-sensitive OpenRouter formats, and Heroku suffixes so unrelated Betterleaks
findings are retained.
Do not mistake IAM identity IDs in AWS validation responses for access keys when
generating revocation commands. Keep validation status visible in response previews.
Keep shared validation and AWS revocation futures Send for multithreaded async
embedders without changing request ordering, retries or provider behavior.

Copilot

🟡 Changes recommended

The stale fuzz-workspace lockfile causes locked builds to fail, while the archive documentation incorrectly describes unsafe entries as skipped rather than rejecting the entire root.

2 open issues

What changed in this PR

Prepares Kingfisher v2.17.0 with a native JavaScript/TypeScript SDK preview, expanded credential revocation, refreshed detection rules and native dependencies, and updated release tooling and documentation.

Changes:

Add typed CJS/ESM SDK entrypoints, examples, and six-platform native npm packaging.
Refresh Betterleaks and Vectorscan; prepare independently versioned Rust and Python packages.
Improve validation identity reporting, revocation-input discovery, async compatibility, and archive regression coverage.
Expand license attribution, publishing guidance, and SDK/viewer documentation.

This pull request requires changes.

Outstanding comments:

Moderate — .gitignore:51 (1 vote): The required scripts/license-overrides/index.json is absent and ignored, causing npm run check:notices to fail with ENOENT. Allowlist and commit the populated checksum/provenance index.
Moderate — fuzz/Cargo.lock:2059 (3 votes): The nested lockfile retains rules 3.0.2 while the scanner requires 3.1.0, preventing locked fuzz builds. Regenerate the fuzz-workspace lockfile.
Nit — crates/kingfisher-scanner/README.md:474 (3 votes): Distinguish strict budgeted archive rejection from legacy best-effort extraction; unsafe members now discard the root’s results.
Nit — python/README.md:272 (3 votes): Document that an unsafe TAR/ZIP member rejects the entire root before yielding members, rather than being skipped.

Verification was limited to static inspection and lockfile consistency checks. Builds, project tests, package verification, and the MkDocs rebuild were not run; Windows x64/ARM64 verification remains pending.

File	Description
`tools/rule-bundle/src/main.rs`	Pin Betterleaks RC7 and its digest.
`tests/viewer_investigation.cjs`	Cover upload instructions and import notices.
`src/reporter.rs`	Preserve validation status in long previews.
`src/direct_revoke.rs`	Discover literal expression inputs for revocation.
`src/azure.rs`	Decode repository names for exclusion matching.
`scripts/tests/test_release_makefile.py`	Cover npm release routing.
`scripts/tests/test_prepare_docs.py`	Cover SDK and provenance-link rewriting.
`scripts/license-overrides/schemafy-MIT.txt`	Archive schemafy MIT attribution.
`scripts/license-overrides/napi-rs-MIT.txt`	Archive napi-rs MIT notices.
`scripts/license-overrides/license-fea1d5bf3dd71605ce5d.txt`	Archive JNI MIT attribution.
`scripts/license-overrides/license-f97daf1a0124413dccf3.txt`	Archive Taffy MIT attribution.
`scripts/license-overrides/license-f7c6ddf9d84fd7b8ad59.txt`	Archive MIT attribution.
`scripts/license-overrides/license-f1b2855ae21da69e0a02.txt`	Archive lebe BSD attribution.
`scripts/license-overrides/license-efa1224931b98468f500.txt`	Archive MIT attribution.
`scripts/license-overrides/license-ee868fed90a90ad13be5.txt`	Archive MIT attribution.
`scripts/license-overrides/license-e353f37b12aefbb9f9b2.txt`	Archive MIT attribution.
`scripts/license-overrides/license-d6fde6c28ecbccfc7f6d.txt`	Archive MIT attribution.
`scripts/license-overrides/license-d64f878c89bd5f1e5ada.txt`	Archive MIT attribution.
`scripts/license-overrides/license-c8167fdeeed46d3f244d.txt`	Archive MIT attribution.
`scripts/license-overrides/license-c6ffbb829ec778804591.txt`	Archive MIT attribution.
`scripts/license-overrides/license-c0c56f26d9c051cac4d2.txt`	Archive Dropbox BSD attribution.
`scripts/license-overrides/license-a5c61b93b6ee1d104af9.txt`	Archive MIT attribution.
`scripts/license-overrides/license-a11232911aa0d746688b.txt`	Archive schemafy MIT attribution.
`scripts/license-overrides/license-838118388fe5c2e7f1db.txt`	Archive WHATWG BSD attribution.
`scripts/license-overrides/license-824f627ec8266fa82057.txt`	Archive MIT attribution.
`scripts/license-overrides/license-80f275e90d799911ed38.txt`	Archive MIT attribution.
`scripts/license-overrides/license-7e98bed7f100747aaae7.txt`	Archive MIT attribution.
`scripts/license-overrides/license-71674605ec4c087fe9eb.txt`	Archive MIT attribution.
`scripts/license-overrides/license-6d7c9e9d7d12c8d3753b.txt`	Archive MIT license-template evidence.
`scripts/license-overrides/license-5ef8fcfb6cccec8fcae0.txt`	Archive MIT attribution.
`scripts/license-overrides/license-56da04ec9e925e3a9539.txt`	Archive MIT attribution.
`scripts/license-overrides/license-508a77d2e7b51d98adee.txt`	Archive MIT permission text.
`scripts/license-overrides/license-3fa4ca83dcc9237839b1.txt`	Archive Mozilla MIT attribution.
`scripts/license-overrides/license-3f1ce66533302df3a32e.txt`	Archive napi-rs MIT notices.
`scripts/license-overrides/license-3d180008e36922a4e8da.txt`	Archive Brotli MIT attribution.
`scripts/license-overrides/license-3a7c3f0b887abb7c638f.txt`	Archive HarfBuzz-related MIT attribution.
`scripts/license-overrides/license-23f18e03dc49df91622f.txt`	Archive MIT permission text.
`scripts/license-overrides/license-1d85bd754b04ceec93e9.txt`	Archive rust-jni-sys MIT attribution.
`scripts/license-overrides/license-1c7cf76689c837a68ed8.txt`	Archive 1Password MIT attribution.
`scripts/license-overrides/license-1299b4d9d15e9d67e4ac.txt`	Archive MIT attribution.
`scripts/license-overrides/license-0621878e61f0d0fda054.txt`	Archive Rust Project MIT attribution.
`scripts/license-overrides/license-03d1bd5bfbee8d44651e.txt`	Archive Inflector BSD attribution.
`scripts/license-overrides/Inflector-BSD-2-Clause.txt`	Preserve named Inflector license text.
`scripts/license-overrides/evidence-f5f002712c93e06fe939.txt`	Archive dwrote manifest evidence.
`scripts/license-overrides/evidence-f3da162dd3818fcdf23c.txt`	Archive zune-inflate manifest evidence.
`scripts/license-overrides/evidence-f17f6cc26f19643dbada.txt`	Archive eventsource-stream licensing evidence.
`scripts/license-overrides/evidence-eba8f5b9bc021bfaaf84.txt`	Archive dispatch2 README evidence.
`scripts/license-overrides/evidence-e980a74b88a62193f790.txt`	Archive objc2-encode README evidence.
`scripts/license-overrides/evidence-e870d7fd7819a9f0453c.txt`	Archive zune-image license header.
`scripts/license-overrides/evidence-de022877415d090896cc.txt`	Archive leaky-cow README evidence.
`scripts/license-overrides/evidence-dd7274968556f3f3309d.txt`	Archive hexf-parse manifest evidence.
`scripts/license-overrides/evidence-dab3dfa2ffc2b5c938f2.txt`	Archive wasite manifest evidence.
`scripts/license-overrides/evidence-da145d375986071fdf83.txt`	Archive objc2-app-kit README evidence.
`scripts/license-overrides/evidence-d87624d9d117489bd49d.txt`	Archive malloc_buf manifest evidence.
`scripts/license-overrides/evidence-d69d75705e2582721cbf.txt`	Archive dwrote README evidence.
`scripts/license-overrides/evidence-d55a05ffe37725dade51.txt`	Archive objc2-metal README evidence.
`scripts/license-overrides/evidence-cf9a8cc812710344d7fe.txt`	Archive objc2-encode manifest evidence.
`scripts/license-overrides/evidence-cd5e595a4b4eede02b0c.txt`	Archive leaky-cow manifest evidence.
`scripts/license-overrides/evidence-c6dff146a9f31848ac29.txt`	Archive zune-image licensing evidence.
`scripts/license-overrides/evidence-c02a9b113d8855df956d.txt`	Archive Core Foundation binding evidence.
`scripts/license-overrides/evidence-bf35fcf69351a2b3e027.txt`	Archive CloudKit binding evidence.
`scripts/license-overrides/evidence-b8530041248261c908b3.txt`	Archive dependency licensing evidence.
`scripts/license-overrides/evidence-b55424493f4bc8689e35.txt`	Archive bitcoin_hashes README evidence.
`scripts/license-overrides/evidence-b495047bd93a9b069135.txt`	Archive Lucide and Feather notices.
`scripts/license-overrides/evidence-b45e89caebbf87207861.txt`	Archive User Notifications binding evidence.
`scripts/license-overrides/evidence-b3a669f64604f19acae6.txt`	Archive eventsource-stream manifest evidence.
`scripts/license-overrides/evidence-ac16063358afa8c2c6ba.txt`	Archive Core Media binding evidence.
`scripts/license-overrides/evidence-ab0b33a8c5c0f12a3ce8.txt`	Archive wasite licensing evidence.
`scripts/license-overrides/evidence-a88605a11db5def9b6cf.txt`	Archive Windows import-library metadata.
`scripts/license-overrides/evidence-99073a83cfe6ee090546.txt`	Archive block2 README evidence.
`scripts/license-overrides/evidence-9652222664ffc7e2a26f.txt`	Archive Windows import-library metadata.
`scripts/license-overrides/evidence-8fa62897326b6111c957.txt`	Archive zune-jpeg manifest evidence.
`scripts/license-overrides/evidence-8edb7a912d295acf1e1c.txt`	Archive mac README evidence.
`scripts/license-overrides/evidence-8c72608cd345f059df31.txt`	Archive gpu-descriptor manifest evidence.
`scripts/license-overrides/evidence-8800b6172da0ce015fdc.txt`	Archive leak manifest evidence.
`scripts/license-overrides/evidence-7f976f7e9cb2d87df723.txt`	Archive objc2 licensing policy.
`scripts/license-overrides/evidence-7c5d495d3f42d8535758.txt`	Archive ScreenCaptureKit binding evidence.
`scripts/license-overrides/evidence-6d465c5e5a4b3e197049.txt`	Archive mac manifest evidence.
`scripts/license-overrides/evidence-65d39b608d230ee0a4d3.txt`	Archive zune-core manifest evidence.
`scripts/license-overrides/evidence-655e91cca9d73db675f3.txt`	Archive QuartzCore binding evidence.
`scripts/license-overrides/evidence-64c30d7808e763add513.txt`	Archive IOKit binding evidence.
`scripts/license-overrides/evidence-6361def881598a3b6d19.txt`	Archive Core Graphics binding evidence.
`scripts/license-overrides/evidence-5da56f1508a87b982a23.txt`	Archive objc2 README evidence.
`scripts/license-overrides/evidence-54164c8c1352852cce6f.txt`	Archive gpu-descriptor-types manifest evidence.
`scripts/license-overrides/evidence-50be6f8e1214bd644cdc.txt`	Archive Foundation binding evidence.
`scripts/license-overrides/evidence-4916e3fca1c9674d2235.txt`	Archive System Configuration binding evidence.
`scripts/license-overrides/evidence-3f518095b802873d6a85.txt`	Archive Core Location binding evidence.
`scripts/license-overrides/evidence-38357210ef69a97bf985.txt`	Archive SeaHash README evidence.
`scripts/license-overrides/evidence-2cef613ac1602bf07cb9.txt`	Archive OpenDirectory binding evidence.
`scripts/license-overrides/evidence-24df2f33b48c9e756a4f.txt`	Archive block manifest evidence.
`scripts/license-overrides/evidence-23283d5bdd4ef362cc5f.txt`	Archive gpu-descriptor licensing evidence.
`scripts/license-overrides/evidence-2134b8f37e904ca9ed6a.txt`	Archive rsqlite-vfs manifest evidence.
`scripts/license-overrides/evidence-1d610f6d1bce065add6e.txt`	Archive SeaHash manifest evidence.
`scripts/license-overrides/evidence-1adae359f289c130fe2b.txt`	Archive zune-core README evidence.
`scripts/license-overrides/evidence-141871f41ab4ac7af854.txt`	Archive pathfinder_geometry manifest evidence.
`scripts/license-overrides/evidence-11789f45bb180841cd36.txt`	Archive encoding_rs licensing evidence.
`scripts/license-overrides/evidence-0c1eb9e88be7d15cd7af.txt`	Archive Core Video binding evidence.
`scripts/license-overrides/evidence-0aeee0313c19d398e809.txt`	Archive dependency licensing evidence.
`scripts/license-overrides/evidence-055ed475047a90839828.txt`	Archive zune-image license header.
`scripts/license-overrides/evidence-01c56329fa14f48ea1c9.txt`	Archive block API licensing evidence.
`python/tests/test_inputs.py`	Require whole-root rejection of unsafe archives.
`python/tests/test_betterleaks_v2.py`	Cover identity evidence and serialization privacy.
`python/README.md`	Update SDK documentation; archive wording needs correction.
`llms.txt`	Add Node SDK and publishing references.
`javascript/validation.mjs`	Expose ESM validation APIs.
`javascript/validation.d.ts`	Declare validation subpath exports.
`javascript/validation.cjs`	Expose CommonJS validation APIs.
`javascript/tsconfig.json`	Configure strict SDK type checks.
`javascript/tests/types.cts`	Check CommonJS exports and input constraints.
`javascript/tests/package-fixture.cjs`	Create isolated packaging fixtures.
`javascript/scripts/targets.cjs`	Define six native release targets.
`javascript/scripts/prepare-platforms.cjs`	Generate guarded platform manifests.
`javascript/scripts/prepare-package.cjs`	Check native versions and copy legal files.
`javascript/scripts/check-npm-names.cjs`	Add read-only registry-name checks.
`javascript/scripts/check-linux-abi.cjs`	Audit Linux dependencies and runtime symbols.
`javascript/scripts/build.cjs`	Wrap locked native SDK builds.
`javascript/scanner.mjs`	Expose ESM scanner APIs.
`javascript/scanner.d.ts`	Declare scanner subpath exports.
`javascript/scanner.cjs`	Expose CommonJS scanner APIs.
`javascript/rules.mjs`	Expose ESM rule APIs.
`javascript/rules.d.ts`	Declare rules subpath exports.
`javascript/rules.cjs`	Expose CommonJS rule APIs.
`javascript/revocation.mjs`	Expose ESM revocation APIs.
`javascript/revocation.d.ts`	Declare revocation subpath exports.
`javascript/revocation.cjs`	Expose CommonJS revocation APIs.
`javascript/npm/win32-x64-msvc/README.md`	Document Windows x64 prerequisites.
`javascript/npm/win32-x64-msvc/package.json`	Define guarded Windows x64 package.
`javascript/npm/win32-arm64-msvc/README.md`	Document Windows ARM64 prerequisites.
`javascript/npm/win32-arm64-msvc/package.json`	Define guarded Windows ARM64 package.
`javascript/npm/linux-x64-gnu/README.md`	Document Linux x64 ABI requirements.
`javascript/npm/linux-x64-gnu/package.json`	Define guarded Linux x64 package.
`javascript/npm/linux-arm64-gnu/README.md`	Document Linux ARM64 ABI requirements.
`javascript/npm/linux-arm64-gnu/package.json`	Define guarded Linux ARM64 package.
`javascript/npm/darwin-x64/README.md`	Document macOS Intel prerequisites.
`javascript/npm/darwin-x64/package.json`	Define guarded macOS Intel package.
`javascript/npm/darwin-arm64/README.md`	Document Apple Silicon prerequisites.
`javascript/npm/darwin-arm64/package.json`	Define guarded Apple Silicon package.
`javascript/LICENSE-VECTORSCAN-MIT`	Include Vectorscan binding attribution.
`javascript/inputs.mjs`	Expose ESM input APIs.
`javascript/inputs.d.ts`	Declare input and transform types.
`javascript/inputs.cjs`	Expose CommonJS input APIs.
`javascript/index.mjs`	Provide named and default ESM exports.
`javascript/index.cjs`	Expose the CommonJS SDK facade.
`javascript/git.mjs`	Expose ESM Git APIs.
`javascript/git.d.ts`	Declare Git input types.
`javascript/git.cjs`	Expose CommonJS Git APIs.
`javascript/examples/validate-revoke.cjs`	Demonstrate explicitly authorized provider operations.
`javascript/examples/typed-scan.mts`	Demonstrate typed scanning.
`javascript/examples/scan-project.mjs`	Compose bounded project-scanning stages.
`javascript/examples/rules-and-controls.mjs`	Demonstrate rules, policies, and cancellation.
`javascript/examples/quickstart.mjs`	Demonstrate offline scans and redacted reports.
`javascript/examples/inputs.cjs`	Demonstrate composable local inputs.
`javascript/examples/git.cjs`	Demonstrate local Git snapshot scanning.
`javascript/examples/git-scopes.mjs`	Demonstrate explicit Git scanning scopes.
`javascript/examples/fixtures/project/config.env`	Supply synthetic scan content.
`javascript/examples/fixtures/acme-token.yml`	Supply a YAML teaching detector.
`javascript/examples/fixtures/acme-token.toml`	Supply a TOML teaching detector.
`javascript/examples/custom-rules.mjs`	Demonstrate mixed custom-rule formats.
`javascript/examples/controlled-scan.mjs`	Demonstrate cancellation, limits, and reuse.
`javascript/examples/content.cjs`	Demonstrate basic offline scanning.
`javascript/examples/archive-content.mjs`	Demonstrate archive expansion and provenance.
`javascript/core.mjs`	Expose ESM core utilities.
`javascript/core.d.ts`	Declare core reporting types.
`javascript/core.cjs`	Expose CommonJS core utilities.
`fuzz/Cargo.lock`	Refresh dependencies; rules lock entry remains stale.
`docs/viewer/index.html`	Name supported report import tools.
`docs/USAGE.md`	Describe imported revocation expressions.
`docs/TOKEN_REVOCATION_SUPPORT.md`	Update revocation support and provenance.
`docs/PROJECT.md`	Add Node SDK architecture overview.
`docs/INSTALLATION.md`	Update bundled rule count.
`docs/INDEX.md`	Link Node guides and recipes.
`docs/DEPLOYMENT.md`	Add Node embedding guidance.
`docs/COMPARISON.md`	Refresh Betterleaks reference.
`docs/ADVANCED.md`	Update catalog and expression guidance.
`docs-site/mkdocs.yml`	Add Node SDK navigation.
`docs-site/docs/usage/deployment.md`	Synchronize Node deployment guidance.
`docs-site/docs/usage/basic-scanning.md`	Synchronize revocation usage guidance.
`docs-site/docs/usage/advanced.md`	Synchronize catalog and expression documentation.
`docs-site/docs/rules/imported-capabilities.md`	Document revocation contracts and precedence.
`docs-site/docs/reference/project.md`	Synchronize Node SDK overview.
`docs-site/docs/reference/documentation-index.md`	Add Node documentation links.
`docs-site/docs/reference/comparison.md`	Refresh Betterleaks reference.
`docs-site/docs/llms.txt`	Synchronize SDK discovery links.
`docs-site/docs/index.md`	Mention Node SDK embedding.
`docs-site/docs/getting-started/installation.md`	Synchronize bundled rule count.
`docs-site/docs/features/token-revocation-support.md`	Synchronize revocation support documentation.
`crates/kingfisher-scanner/tests/betterleaks_v2_api.rs`	Cover allowlisted identity metadata.
`crates/kingfisher-scanner/tests/async_send.rs`	Assert validation/revocation futures are `Send`.
`crates/kingfisher-scanner/src/validation/validator.rs`	Avoid borrowed-item future lifetime constraints.
`crates/kingfisher-scanner/src/validation/aws.rs`	Drop thread-local RNG before awaiting.
`crates/kingfisher-scanner/README.md`	Update SDK contracts; archive wording needs correction.
`crates/kingfisher-scanner/Cargo.toml`	Prepare scanner 3.0.2 with rules 3.1.0.
`crates/kingfisher-rules/README.md`	Document refreshed catalog and input discovery.
`crates/kingfisher-rules/generated/NOTICES.txt`	Refresh Betterleaks license source URL.
`crates/kingfisher-rules/data/imported-rules-capabilities.md`	Document revocation and filter constraints.
`crates/kingfisher-rules/data/betterleaks-words.md`	Refresh wordlist provenance reference.
`crates/kingfisher-rules/Cargo.toml`	Prepare rules 3.1.0 and Vectorscan pin.
`crates/kingfisher-python/Cargo.toml`	Prepare Python SDK 1.6.2.
`crates/kingfisher-node/src/lib.rs`	Register bridge modules and SDK version.
`crates/kingfisher-node/Cargo.toml`	Define native Node-API crate.
`crates/kingfisher-node/build.rs`	Initialize napi-rs build integration.
`Cargo.toml`	Update versions, Node workspace integration, and build profile.
`AGENTS.md`	Add Node SDK paths and contributor guidance.
`.gitignore`	Track SDK manifests; required notice index remains ignored.
`.github/workflows/release.yml`	Update Vectorscan version comments only.
`.github/RELEASING.md`	Document npm release and recovery workflow.
`.github/actionlint.yaml`	Recognize the Windows ARM64 runner label.
`.gitattributes`	Normalize release legal-file line endings.

_{Review effort: Balanced}

Keep the removed npm publishing guide absent and point maintained references at the canonical runbook. Remove its fixture dependency while retaining the forbidden-package-content regression. Track exact-version license override provenance and preserve upstream CRLF bytes across Git exports. Refresh notice and fuzz-lock references, use safe PyPI executable discovery, and select the installed MSVC 14.44 toolset. Exclude only the unsupported GNU Node bridge from Windows GNU workspace tests and explicitly test all supported native bridge targets. Stabilize bounded-timeout, OAuth cancellation, and Windows path/cleanup fixtures without changing production scanner behavior. Verified full Rust workspaces on macOS, Linux, and Windows GNU x64/ARM64; 36 SDK/runtime suites with 108 tests plus type checks each; the same seven sealed production npm archives in 36 compiler-free offline consumers; and installed production Python wheels on macOS, Linux, and both Windows architectures, including cache hit and cross-architecture fallback checks.

Copilot

🔵 Needs a closer look

The new native Node SDK requires packed-package runtime checks and Windows x64/ARM64 CI evidence that were unavailable, leaving cross-platform loading, compatibility, and release integrity unverified.

No open issues 🎉

2 resolved since last review

_{Review effort: Balanced}

Let Cargo and npm inherit the native runner shell so Git Bash cannot shadow the pinned MSVC linker. Guard both compilation steps and inherited shell defaults against regression. Avoid printing synthetic credential fixtures in rule-test failures without changing fixtures or predicates. Annotate four pre-existing synthetic MongoDB URI fixtures with literal-local scanner directives, keeping normal pre-commit validation enabled.

Copilot

🔵 Needs a closer look

The six-platform native Node SDK release requires maintainer verification of ABI compatibility, native loading, and packed-consumer installs, especially on Windows x64/ARM64, which source inspection alone cannot establish.

No open issues 🎉

_{Review effort: Balanced}

mickgmdb and others added 2 commits November 4, 2026 21:58

preparing for v2.17.0

35aaf17

Match Azure exclusions against decoded repository URLs

6914809

Copilot AI balanced review requested due to automatic review settings November 5, 2026 06:10

Copilot started reviewing on behalf of mickgmdb November 5, 2026 06:11

View session

Copilot AI reviewed Nov 5, 2026

View reviewed changes

Comment thread crates/kingfisher-scanner/README.md Resolved

Comment thread python/README.md Resolved

github-advanced-security Bot found potential problems Nov 5, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings November 5, 2026 12:12

Copilot started reviewing on behalf of mickgmdb November 5, 2026 12:12

View session

Copilot AI reviewed Nov 5, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings November 5, 2026 18:24

Copilot started reviewing on behalf of mickgmdb November 5, 2026 18:24

View session

Copilot AI reviewed Nov 5, 2026

View reviewed changes

mickgmdb merged commit 0cff70d into main Nov 5, 2026
68 checks passed

Navigation Menu

Repository navigation

preparing for v2.17.0 - #574

preparing for v2.17.0#574
mickgmdb merged 4 commits into
mainfrom
development

mickgmdb commented Nov 5, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

mickgmdb commented Nov 5, 2026

Added

Changed

Fixed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants