chore(deps): update pre-commit hook mongodb/kingfisher to v1.89.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
mongodb/kingfisher	repository	minor	v1.87.0 → v1.89.0

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

mongodb/kingfisher (mongodb/kingfisher)

v1.89.0

Compare Source

• Added TOON output for scan, validate, and revoke, optimized for LLM/agent workflows; prefer --format toon when calling Kingfisher from an LLM.
• Expanded built-in revocation support with new YAML revocation flows for Cloudflare, Confluent, Doppler, Mapbox, Particle.io, Twitch, and additional Vercel token formats.
• Added revocation coverage documentation: new docs/REVOCATION_PROVIDERS.md matrix and README links highlighting supported revocation providers/rule IDs.
• Access Map: added Microsoft Teams provider. Parses Incoming Webhook URLs (legacy and workflow-based) to extract tenant and webhook identity, probes for active status, and reports channel-level blast radius. Supports standalone access-map microsoftteams (alias msteams) and automatic mapping for validated kingfisher.msteams.* and kingfisher.microsoftteamswebhook.* findings.
• Added Microsoft Teams scan target: kingfisher scan teams "QUERY" searches Teams messages via Microsoft Graph Search API and scans them for secrets, mirroring the Slack integration.
• Requires KF_TEAMS_TOKEN environment variable (Microsoft Graph access token with ChannelMessage.Read.All or Chat.Read permissions).
• Findings reference Teams message URLs in reports; see docs/USAGE.md and docs/INTEGRATIONS.md for authentication setup.

v1.88.0

Compare Source

• Tree-sitter fallback behavior changed to be strictly additive: when parser context is unavailable, findings now fall back to Hyperscan/Vectorscan matches instead of being suppressed.
• Fixed dependent-rule reporting gaps (for example Algolia API keys) by preserving regex findings when tree-sitter is unavailable, while still marking validation as skipped when dependency inputs are missing.
• Expanded parser queries for C, Go, Java, JavaScript, and TypeScript to improve assignment/literal capture coverage (including template/raw string handling in JS/TS/Go).
• Added parser query quality gates: compile-time query validation tests plus fixture-based capture-count regression tests backed by testdata/parsers/tree_sitter_capture_baseline.json.
• Added inline-ignore coverage for directives placed on the line immediately before a single-line secret match.
• Updated tree-sitter documentation wording to align with --turbo terminology.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.