chore(deps): update pre-commit hook mongodb/kingfisher to v1.108.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
mongodb/kingfisher	repository	minor	v1.106.0 → v1.108.0

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

mongodb/kingfisher (mongodb/kingfisher)

v1.108.0

Compare Source

• Fixed Disqus API key and secret detection and validation by using the documented pages/list endpoint and requiring a successful response envelope.
• Fixed Sentry token detection and validation false negatives by supporting documented user and organization token formats and treating authenticated 403 responses without org:read as active.
• Refreshed built-in rule documentation to reflect the current rule and provider counts.
• Improvements and refinements to detection rules and validation across several providers.

v1.107.0

Compare Source

• Fixed Windows self-updates for Deflate-compressed ZIP releases.
• Security: fixed validation redaction bypasses, redacted webhook report metadata, and bounded TAR extraction.
• Added detection and validation rules for 25+ new provider families: Anthropic, Airtable, Browserbase, Cartesia, Cielo, Civo, Exoscale, Greptile, Infomaniak, Kimi (Moonshot AI), LightOn, Mailgun, MessageBird, Nango, New Relic, Novu, OVHcloud, PlanetScale, Polymarket, Silicon Flow, Twitter/X, Turso, Upstage, Yandex — plus expanded Slack, Volcengine, JWT, Linear, and Pinecone coverage. Built-in coverage is now 1,006 rules (876 standalone detectors + 130 dependent rules), with 511 standalone detectors supporting live validation.
• Migrated the TLS and JWT-signing crypto backend from ring to aws-lc-rs across all validators (GCP, Postgres, raw), the main binary's default provider installation, the MongoDB driver, and gcloud-storage, consolidating on a single FIPS-eligible crypto provider.
• Reduced dependency footprint and binary size: removed include_dir and color-backtrace; trimmed clap to default-features = false and tokio from "full" to specific features; added per-package opt-level = "z" for cold crates in the release profile. Viewer assets and builtin rules are now gzip-compressed at build time via build.rs and lazily decompressed at runtime, replacing include_dir directory embedding.
• Improved Docker builds in the Makefile: added SKIP_TESTS=1 to skip tests, a separate CARGO_TARGET_DIR=target-docker to avoid clobbering host build artifacts, and bash to the Alpine package list.
• Reworked --access-map provider parsing from clap ValueEnum to a custom FromStr parser with flexible aliases (mongo, hf, wandb, msteams, brevo, do, ibm, tfc, etc.) and clearer error messages.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Saturday (* * * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.