chore(deps): update dependency stix-shifter to v8.1.2 (master)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
stix-shifter	==8.0.2 → ==8.1.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

opencybersecurityalliance/stix-shifter (stix-shifter)

v8.1.2

Compare Source

v8.1.1

Compare Source

v8.1.0

Compare Source

Breaking changes:

• None

Deprecations:

• None

Changes:

• Modernised core dependencies and applied security updates (contribution by @​toliver-hb) to address known vulnerabilities and improve STIX pattern parsing reliability. #​1776
  • Upgraded antlr4-python3-runtime to 4.13.2 and regenerated STIX pattern grammar files.
  • Added a runtime compatibility workaround for the stix_bundle connector to mitigate an upstream issue in stix2-matcher==3.0.0 that caused "'datetime.datetime' object is not iterable" errors.
  • Removed incorrect timestamp manipulation logic that affected STIX 2.0 pattern handling.
• Removed unused NumPy dependency from core requirements (still required by the Azure Log Analytics connector module). #​1781

Fixes:

• Patched multiple security vulnerabilities via updated dependencies. #​1782, #​1778, and #​1776

Dependency update:

• Bump pyOpenSSL → 25.3.0
• Bump antlr4-python3-runtime → 4.13.2
• Bump aioboto3 → >=15.2.0,<16.0.0
• Constrain aiomysql → >=0.3.2,<0.4.0
• Bump attrs → 24.2.0
• Bump flask → 3.1.3
• Bump numpy (Azure Log Analytics module only) → >=2.1.0,<3.0.0
• Bump stix2-patterns → 2.1.2
• Bump urllib3 → >=2.6.3,<3.0.0
• Bump pandas (Azure Log Analytics module) → 2.2.2

---

v8.0.4

Compare Source

Breaking changes:

• None

Deprecations:

• None

Changes:

• Resolved incompatibility with newer pip (v26) caused by a non-PEP517-compliant transient dependency (aiosonic) affecting the Datadog connector. #​1774

Fixes:

• Addressed security vulnerability related to aiomysql dependency constraints. #​1775

Dependency update:

• Bump datadog_api_client[async] → >=2.40.0,<3.0.0
• Constrain aiomysql → >=0.3.2,<0.4.0

---

v8.0.3

Compare Source

Breaking changes:

• None

Deprecations:

• None

Changes:

• Increased default connection timeout to 10 seconds to improve reliability for slower or high-latency environments. #​1772

Fixes:

• None

Dependency update:

• None

---

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • "after 10pm every weekday,every weekend,before 5am every weekday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

⚠️ Unused dependencies detected

The following packages appear to be unused:

• validators in stream/sekoia-intel/src/requirements.txt
• stix-shifter in stream/webhook/src/requirements.txt

How to fix: (1) if the package is used but under a different import name (e.g. PyYAML → yaml), add a mapping line to .github/deptry-package-map.txt. (2) if truly unused, remove it from the connector's requirements.txt.

[github-actions]

🔴 Connector Linter errors detected

• VC308: No main.py found in src/ (stream/splunk:1)
• VC325: No tests/ directory found (stream/splunk:1)
• VC402: Dockerfile uses entrypoint.sh at line 17 (stream/splunk/Dockerfile:17)
• VC503: uses deprecated helper.log_info() (stream/splunk/src/splunk.py:256)
• VC503: uses deprecated helper.log_error() (stream/splunk/src/splunk.py:331)
• VC503: uses deprecated helper.log_info() (stream/splunk/src/splunk.py:344)
• VC503: uses deprecated helper.log_info() (stream/splunk/src/splunk.py:278)
• VC503: uses deprecated helper.log_info() (stream/splunk/src/splunk.py:306)
• VC503: uses deprecated helper.log_warning() (stream/splunk/src/splunk.py:308)
• VC503: uses deprecated helper.log_info() (stream/splunk/src/splunk.py:382)
• VC503: uses deprecated helper.log_error() (stream/splunk/src/splunk.py:268)
• VC503: uses deprecated helper.log_error() (stream/splunk/src/splunk.py:269)
• VC503: uses deprecated helper.log_info() (stream/splunk/src/splunk.py:281)
• VC503: uses deprecated helper.log_info() (stream/splunk/src/splunk.py:289)
• VC503: uses deprecated helper.log_info() (stream/splunk/src/splunk.py:294)
• VC503: uses deprecated helper.log_info() (stream/splunk/src/splunk.py:298)
• VC504: CONNECTOR_CONFIDENCE_LEVEL=80 — confidence level in config is deprecated (stream/splunk/docker-compose.yml:13)

[Copilot]

Pull request overview

This PR updates the stix-shifter dependency version used by several stream connectors, aiming to pick up upstream fixes and security/compatibility updates in the STIX-Shifter library.

Changes:

• Bump stix-shifter from 8.0.2 to 8.1.2 in multiple connector requirements.txt files.
• Keep existing pins for other dependencies in those connectors unchanged.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
stream/webhook/src/requirements.txt	Bumps stix-shifter pin to 8.1.2.
stream/splunk/src/requirements.txt	Bumps stix-shifter pin to 8.1.2 (while other stix-shifter-related pins remain at 8.0.2).
stream/sekoia-intel/src/requirements.txt	Bumps stix-shifter pin to 8.1.2 (while other stix-shifter-related pins remain at 8.0.2).
stream/qradar/src/requirements.txt	Bumps stix-shifter pin to 8.1.2 (while other stix-shifter-related pins remain at 8.0.2).
stream/pan-cortex-xsoar-intel/src/requirements.txt	Bumps stix-shifter pin to 8.1.2 (while other stix-shifter-related pins remain at 8.0.2).
stream/harfanglab-intel/src/requirements.txt	Bumps stix-shifter pin to 8.1.2 (while other stix-shifter-related pins remain at 8.0.2).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

❌ 4 Tests Failed:

Tests completed	Failed	Passed	Skipped
5185	4	5181	153

View the top 3 failed test(s) by shortest run time

stream.harfanglab-intel.tests.tests_harfanglab_connector.cti_converter_test::test_cti_converter_create_ioc_rule_should_have_none_type

Stack Traces | 0.005s run time

stix_pattern = "[fake-type:value = '172.86.102.98']"

    def parse_stix_pattern(stix_pattern: str) -> list[dict]:
        """
        Parse observation expressions of a STIX pattern.
        :param stix_pattern: STIX pattern to parse
        :return: List of parsed observation expressions
        """
        try:
            translation_result = stix_translater.translate(
                "splunk",
                "parse",
                None,
                stix_pattern,
            )
            if translation_result:
>               parsed_patterns = translation_result["parsed_stix"]
                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
E               KeyError: 'parsed_stix'

.../src/harfanglab_intel_connector/utils.py:21: KeyError

During handling of the above exception, another exception occurred:

mock_config = <Mock id='139919435009200'>

    def test_cti_converter_create_ioc_rule_should_have_none_type(mock_config):
        # Given an instance of CTI converter
        # and invalid STIX pattern
        cti_converter = CTIConverter(config=mock_config)
>       indicator = opencti.Indicator(
            {
                "entity_type": "Indicator",
                "id": "opencti-uuid",
                "standard_id": "stix-uuid",
                "name": "fake_stix_indicator",
                "description": "a fake stix indicator",
                "pattern_type": "stix",
                "pattern": "[fake-type:value = '172.86.102.98']",
            }
        )

.../tests/tests_harfanglab_connector/cti_converter_test.py:129: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
.../harfanglab_intel_connector/models/opencti.py:36: in __init__
    self.observables = self._parse_observables(data)
                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
.../harfanglab_intel_connector/models/opencti.py:45: in _parse_observables
    parsed_patterns = parse_stix_pattern(self.pattern)
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

stix_pattern = "[fake-type:value = '172.86.102.98']"

    def parse_stix_pattern(stix_pattern: str) -> list[dict]:
        """
        Parse observation expressions of a STIX pattern.
        :param stix_pattern: STIX pattern to parse
        :return: List of parsed observation expressions
        """
        try:
            translation_result = stix_translater.translate(
                "splunk",
                "parse",
                None,
                stix_pattern,
            )
            if translation_result:
                parsed_patterns = translation_result["parsed_stix"]
                return parsed_patterns
        except:
>           raise RuntimeError(f"Cannot parse STIX pattern {stix_pattern}")
E           RuntimeError: Cannot parse STIX pattern [fake-type:value = '172.86.102.98']

.../src/harfanglab_intel_connector/utils.py:24: RuntimeError

stream.sekoia-intel.src.sekoia_intel_tests.cti_converter_test::test_cti_converter_create_ioc_rule_should_have_none_type

Stack Traces | 0.005s run time

stix_pattern = "[fake-type:value = '172.86.102.98']"

    def parse_stix_pattern(stix_pattern: str) -> list[dict]:
        """
        Parse observation expressions of a STIX pattern.
        :param stix_pattern: STIX pattern to parse
        :return: List of parsed observation expressions
        """
        try:
            translation_result = stix_translater.translate(
                "splunk",
                "parse",
                None,
                stix_pattern,
            )
            if translation_result:
>               parsed_patterns = translation_result["parsed_stix"]
                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
E               KeyError: 'parsed_stix'

.../src/sekoia_intel_connector/utils.py:20: KeyError

During handling of the above exception, another exception occurred:

mock_config = <Mock id='140201936130736'>

    def test_cti_converter_create_ioc_rule_should_have_none_type(mock_config):
        # Given an instance of CTI converter
        # and invalid STIX pattern
        cti_converter = CTIConverter(config=mock_config)
        indicator = opencti.Indicator(
            {
                "entity_type": "Indicator",
                "id": "opencti-uuid",
                "standard_id": "stix-uuid",
                "name": "fake_stix_indicator",
                "description": "a fake stix indicator",
                "pattern_type": "stix",
                "pattern": "[fake-type:value = '172.86.102.98']",
            }
        )
        # when calling create_ioc_rule
>       ioc_rule = cti_converter.create_sekoia_ioc(indicator)
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

.../src/sekoia_intel_tests/cti_converter_test.py:60: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
.../src/sekoia_intel_connector/cti_converter.py:50: in create_sekoia_ioc
    parsed_pattern = parse_stix_pattern(indicator.pattern)
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

stix_pattern = "[fake-type:value = '172.86.102.98']"

    def parse_stix_pattern(stix_pattern: str) -> list[dict]:
        """
        Parse observation expressions of a STIX pattern.
        :param stix_pattern: STIX pattern to parse
        :return: List of parsed observation expressions
        """
        try:
            translation_result = stix_translater.translate(
                "splunk",
                "parse",
                None,
                stix_pattern,
            )
            if translation_result:
                parsed_patterns = translation_result["parsed_stix"]
                return parsed_patterns
            return []
        except Exception:
>           raise RuntimeError(f"Cannot parse STIX pattern {stix_pattern}")
E           RuntimeError: Cannot parse STIX pattern [fake-type:value = '172.86.102.98']

.../src/sekoia_intel_connector/utils.py:24: RuntimeError

stream.harfanglab-intel.tests.tests_harfanglab_connector.cti_converter_test::test_cti_converter_create_ioc_rule

Stack Traces | 0.093s run time

stix_pattern = "[ipv4-addr:value = '172.86.102.98']"

    def parse_stix_pattern(stix_pattern: str) -> list[dict]:
        """
        Parse observation expressions of a STIX pattern.
        :param stix_pattern: STIX pattern to parse
        :return: List of parsed observation expressions
        """
        try:
            translation_result = stix_translater.translate(
                "splunk",
                "parse",
                None,
                stix_pattern,
            )
            if translation_result:
>               parsed_patterns = translation_result["parsed_stix"]
                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
E               KeyError: 'parsed_stix'

.../src/harfanglab_intel_connector/utils.py:21: KeyError

During handling of the above exception, another exception occurred:

    @pytest.fixture
    def fake_stix_indicator():
>       return opencti.Indicator(
            {
                "entity_type": "Indicator",
                "id": "opencti-uuid",
                "standard_id": "stix-uuid",
                "name": "fake_stix_indicator",
                "description": "a fake stix indicator",
                "pattern_type": "stix",
                "pattern": "[ipv4-addr:value = '172.86.102.98']",
            }
        )

.../tests/tests_harfanglab_connector/cti_converter_test.py:15: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
.../harfanglab_intel_connector/models/opencti.py:36: in __init__
    self.observables = self._parse_observables(data)
                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
.../harfanglab_intel_connector/models/opencti.py:45: in _parse_observables
    parsed_patterns = parse_stix_pattern(self.pattern)
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

stix_pattern = "[ipv4-addr:value = '172.86.102.98']"

    def parse_stix_pattern(stix_pattern: str) -> list[dict]:
        """
        Parse observation expressions of a STIX pattern.
        :param stix_pattern: STIX pattern to parse
        :return: List of parsed observation expressions
        """
        try:
            translation_result = stix_translater.translate(
                "splunk",
                "parse",
                None,
                stix_pattern,
            )
            if translation_result:
                parsed_patterns = translation_result["parsed_stix"]
                return parsed_patterns
        except:
>           raise RuntimeError(f"Cannot parse STIX pattern {stix_pattern}")
E           RuntimeError: Cannot parse STIX pattern [ipv4-addr:value = '172.86.102.98']

.../src/harfanglab_intel_connector/utils.py:24: RuntimeError

stream.sekoia-intel.src.sekoia_intel_tests.cti_converter_test::test_cti_converter_create_ioc_rule

Stack Traces | 0.153s run time

stix_pattern = "[ipv4-addr:value = '172.86.102.98']"

    def parse_stix_pattern(stix_pattern: str) -> list[dict]:
        """
        Parse observation expressions of a STIX pattern.
        :param stix_pattern: STIX pattern to parse
        :return: List of parsed observation expressions
        """
        try:
            translation_result = stix_translater.translate(
                "splunk",
                "parse",
                None,
                stix_pattern,
            )
            if translation_result:
>               parsed_patterns = translation_result["parsed_stix"]
                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
E               KeyError: 'parsed_stix'

.../src/sekoia_intel_connector/utils.py:20: KeyError

During handling of the above exception, another exception occurred:

mock_config = <Mock id='140201937576032'>
fake_stix_indicator = <sekoia_intel_connector.models.opencti.Indicator object at 0x7f834eafa0c0>

    def test_cti_converter_create_ioc_rule(mock_config, fake_stix_indicator):
        # Given an instance of CTI converter
        # and a valid STIX indicator
        cti_converter = CTIConverter(config=mock_config)
        indicator = fake_stix_indicator
        # when calling create_ioc_rule
>       ioc_rule = cti_converter.create_sekoia_ioc(indicator)
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

.../src/sekoia_intel_tests/cti_converter_test.py:37: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
.../src/sekoia_intel_connector/cti_converter.py:50: in create_sekoia_ioc
    parsed_pattern = parse_stix_pattern(indicator.pattern)
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

stix_pattern = "[ipv4-addr:value = '172.86.102.98']"

    def parse_stix_pattern(stix_pattern: str) -> list[dict]:
        """
        Parse observation expressions of a STIX pattern.
        :param stix_pattern: STIX pattern to parse
        :return: List of parsed observation expressions
        """
        try:
            translation_result = stix_translater.translate(
                "splunk",
                "parse",
                None,
                stix_pattern,
            )
            if translation_result:
                parsed_patterns = translation_result["parsed_stix"]
                return parsed_patterns
            return []
        except Exception:
>           raise RuntimeError(f"Cannot parse STIX pattern {stix_pattern}")
E           RuntimeError: Cannot parse STIX pattern [ipv4-addr:value = '172.86.102.98']

.../src/sekoia_intel_connector/utils.py:24: RuntimeError

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (==8.1.2). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.