chore(deps): update dependency stix-shifter-utils to v8.1.2 (master) by renovate[bot] · Pull Request #7543 · OpenCTI-Platform/connectors

renovate · 2026-09-03T14:06:15Z

This PR contains the following updates:

Package	Change	Age	Confidence
stix-shifter-utils	`==8.0.2` → `==8.1.2`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

opencybersecurityalliance/stix-shifter (stix-shifter-utils)

Breaking changes:

None

Deprecations:

None

Changes:

Modernised core dependencies and applied security updates (contribution by @toliver-hb) to address known vulnerabilities and improve STIX pattern parsing reliability. #1776
- Upgraded antlr4-python3-runtime to 4.13.2 and regenerated STIX pattern grammar files.
- Added a runtime compatibility workaround for the stix_bundle connector to mitigate an upstream issue in stix2-matcher==3.0.0 that caused "'datetime.datetime' object is not iterable" errors.
- Removed incorrect timestamp manipulation logic that affected STIX 2.0 pattern handling.
Removed unused NumPy dependency from core requirements (still required by the Azure Log Analytics connector module). #1781

Fixes:

Patched multiple security vulnerabilities via updated dependencies. #1782, #1778, and #1776

Dependency update:

Bump pyOpenSSL → 25.3.0
Bump antlr4-python3-runtime → 4.13.2
Bump aioboto3 → >=15.2.0,<16.0.0
Constrain aiomysql → >=0.3.2,<0.4.0
Bump attrs → 24.2.0
Bump flask → 3.1.3
Bump numpy (Azure Log Analytics module only) → >=2.1.0,<3.0.0
Bump stix2-patterns → 2.1.2
Bump urllib3 → >=2.6.3,<3.0.0
Bump pandas (Azure Log Analytics module) → 2.2.2

`v8.0.4`

Compare Source

Breaking changes:

None

Deprecations:

None

Changes:

Resolved incompatibility with newer pip (v26) caused by a non-PEP517-compliant transient dependency (aiosonic) affecting the Datadog connector. #1774

Fixes:

Addressed security vulnerability related to aiomysql dependency constraints. #1775

Dependency update:

Bump datadog_api_client[async] → >=2.40.0,<3.0.0
Constrain aiomysql → >=0.3.2,<0.4.0

`v8.0.3`

Compare Source

Breaking changes:

None

Deprecations:

None

Changes:

Increased default connection timeout to 10 seconds to improve reliability for slower or high-latency environments. #1772

Fixes:

None

Dependency update:

None

Configuration

📅 Schedule: (in timezone Europe/Paris)

Branch creation
- "after 10pm every weekday,every weekend,before 5am every weekday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-09-03T14:06:34Z

⚠️ Unused dependencies detected

The following packages appear to be unused:

validators in stream/sekoia-intel/src/requirements.txt

How to fix: (1) if the package is used but under a different import name (e.g. PyYAML → yaml), add a mapping line to .github/deptry-package-map.txt. (2) if truly unused, remove it from the connector's requirements.txt.

github-actions · 2026-09-03T14:07:18Z

🔴 Connector Linter errors detected

VC308: No main.py found in src/ (stream/splunk:1)
VC325: No tests/ directory found (stream/splunk:1)
VC402: Dockerfile uses entrypoint.sh at line 17 (stream/splunk/Dockerfile:17)
VC503: uses deprecated helper.log_info() (stream/splunk/src/splunk.py:256)
VC503: uses deprecated helper.log_error() (stream/splunk/src/splunk.py:331)
VC503: uses deprecated helper.log_info() (stream/splunk/src/splunk.py:344)
VC503: uses deprecated helper.log_info() (stream/splunk/src/splunk.py:278)
VC503: uses deprecated helper.log_info() (stream/splunk/src/splunk.py:306)
VC503: uses deprecated helper.log_warning() (stream/splunk/src/splunk.py:308)
VC503: uses deprecated helper.log_info() (stream/splunk/src/splunk.py:382)
VC503: uses deprecated helper.log_error() (stream/splunk/src/splunk.py:268)
VC503: uses deprecated helper.log_error() (stream/splunk/src/splunk.py:269)
VC503: uses deprecated helper.log_info() (stream/splunk/src/splunk.py:281)
VC503: uses deprecated helper.log_info() (stream/splunk/src/splunk.py:289)
VC503: uses deprecated helper.log_info() (stream/splunk/src/splunk.py:294)
VC503: uses deprecated helper.log_info() (stream/splunk/src/splunk.py:298)
VC504: CONNECTOR_CONFIDENCE_LEVEL=80 — confidence level in config is deprecated (stream/splunk/docker-compose.yml:13)

Copilot

Pull request overview

This Renovate PR updates the pinned stix-shifter-utils dependency used by several stream connectors, aligning them with the latest 8.1.2 release to pick up upstream fixes/security dependency updates.

Changes:

Bump stix-shifter-utils from 8.0.2 to 8.1.2 in stream connector requirements.txt files.
Keep other stix-shifter-related pins unchanged (stix-shifter==8.0.2, stix-shifter-modules-splunk==8.0.2).

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
stream/splunk/src/requirements.txt	Pins `stix-shifter-utils` to `8.1.2` for the Splunk stream connector.
stream/sekoia-intel/src/requirements.txt	Pins `stix-shifter-utils` to `8.1.2` for the Sekoia stream connector.
stream/qradar/src/requirements.txt	Pins `stix-shifter-utils` to `8.1.2` for the QRadar stream connector.
stream/pan-cortex-xsoar-intel/src/requirements.txt	Pins `stix-shifter-utils` to `8.1.2` for the Cortex XSOAR stream connector.
stream/harfanglab-intel/src/requirements.txt	Pins `stix-shifter-utils` to `8.1.2` for the HarfangLab stream connector.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

codecov · 2026-09-03T14:08:15Z

❌ 4 Tests Failed:

Tests completed	Failed	Passed	Skipped
5185	4	5181	153

View the top 3 failed test(s) by shortest run time

stream.harfanglab-intel.tests.tests_harfanglab_connector.cti_converter_test::test_cti_converter_create_ioc_rule_should_have_none_type

Stack Traces | 0.005s run time

stix_pattern = "[fake-type:value = '172.86.102.98']"

    def parse_stix_pattern(stix_pattern: str) -> list[dict]:
        """
        Parse observation expressions of a STIX pattern.
        :param stix_pattern: STIX pattern to parse
        :return: List of parsed observation expressions
        """
        try:
            translation_result = stix_translater.translate(
                "splunk",
                "parse",
                None,
                stix_pattern,
            )
            if translation_result:
>               parsed_patterns = translation_result["parsed_stix"]
                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
E               KeyError: 'parsed_stix'

.../src/harfanglab_intel_connector/utils.py:21: KeyError

During handling of the above exception, another exception occurred:

mock_config = <Mock id='140189497844672'>

    def test_cti_converter_create_ioc_rule_should_have_none_type(mock_config):
        # Given an instance of CTI converter
        # and invalid STIX pattern
        cti_converter = CTIConverter(config=mock_config)
>       indicator = opencti.Indicator(
            {
                "entity_type": "Indicator",
                "id": "opencti-uuid",
                "standard_id": "stix-uuid",
                "name": "fake_stix_indicator",
                "description": "a fake stix indicator",
                "pattern_type": "stix",
                "pattern": "[fake-type:value = '172.86.102.98']",
            }
        )

.../tests/tests_harfanglab_connector/cti_converter_test.py:129: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
.../harfanglab_intel_connector/models/opencti.py:36: in __init__
    self.observables = self._parse_observables(data)
                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
.../harfanglab_intel_connector/models/opencti.py:45: in _parse_observables
    parsed_patterns = parse_stix_pattern(self.pattern)
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

stix_pattern = "[fake-type:value = '172.86.102.98']"

    def parse_stix_pattern(stix_pattern: str) -> list[dict]:
        """
        Parse observation expressions of a STIX pattern.
        :param stix_pattern: STIX pattern to parse
        :return: List of parsed observation expressions
        """
        try:
            translation_result = stix_translater.translate(
                "splunk",
                "parse",
                None,
                stix_pattern,
            )
            if translation_result:
                parsed_patterns = translation_result["parsed_stix"]
                return parsed_patterns
        except:
>           raise RuntimeError(f"Cannot parse STIX pattern {stix_pattern}")
E           RuntimeError: Cannot parse STIX pattern [fake-type:value = '172.86.102.98']

.../src/harfanglab_intel_connector/utils.py:24: RuntimeError

stream.sekoia-intel.src.sekoia_intel_tests.cti_converter_test::test_cti_converter_create_ioc_rule_should_have_none_type

Stack Traces | 0.005s run time

stix_pattern = "[fake-type:value = '172.86.102.98']"

    def parse_stix_pattern(stix_pattern: str) -> list[dict]:
        """
        Parse observation expressions of a STIX pattern.
        :param stix_pattern: STIX pattern to parse
        :return: List of parsed observation expressions
        """
        try:
            translation_result = stix_translater.translate(
                "splunk",
                "parse",
                None,
                stix_pattern,
            )
            if translation_result:
>               parsed_patterns = translation_result["parsed_stix"]
                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
E               KeyError: 'parsed_stix'

.../src/sekoia_intel_connector/utils.py:20: KeyError

During handling of the above exception, another exception occurred:

mock_config = <Mock id='140449928141888'>

    def test_cti_converter_create_ioc_rule_should_have_none_type(mock_config):
        # Given an instance of CTI converter
        # and invalid STIX pattern
        cti_converter = CTIConverter(config=mock_config)
        indicator = opencti.Indicator(
            {
                "entity_type": "Indicator",
                "id": "opencti-uuid",
                "standard_id": "stix-uuid",
                "name": "fake_stix_indicator",
                "description": "a fake stix indicator",
                "pattern_type": "stix",
                "pattern": "[fake-type:value = '172.86.102.98']",
            }
        )
        # when calling create_ioc_rule
>       ioc_rule = cti_converter.create_sekoia_ioc(indicator)
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

.../src/sekoia_intel_tests/cti_converter_test.py:60: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
.../src/sekoia_intel_connector/cti_converter.py:50: in create_sekoia_ioc
    parsed_pattern = parse_stix_pattern(indicator.pattern)
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

stix_pattern = "[fake-type:value = '172.86.102.98']"

    def parse_stix_pattern(stix_pattern: str) -> list[dict]:
        """
        Parse observation expressions of a STIX pattern.
        :param stix_pattern: STIX pattern to parse
        :return: List of parsed observation expressions
        """
        try:
            translation_result = stix_translater.translate(
                "splunk",
                "parse",
                None,
                stix_pattern,
            )
            if translation_result:
                parsed_patterns = translation_result["parsed_stix"]
                return parsed_patterns
            return []
        except Exception:
>           raise RuntimeError(f"Cannot parse STIX pattern {stix_pattern}")
E           RuntimeError: Cannot parse STIX pattern [fake-type:value = '172.86.102.98']

.../src/sekoia_intel_connector/utils.py:24: RuntimeError

stream.harfanglab-intel.tests.tests_harfanglab_connector.cti_converter_test::test_cti_converter_create_ioc_rule

Stack Traces | 0.064s run time

stix_pattern = "[ipv4-addr:value = '172.86.102.98']"

    def parse_stix_pattern(stix_pattern: str) -> list[dict]:
        """
        Parse observation expressions of a STIX pattern.
        :param stix_pattern: STIX pattern to parse
        :return: List of parsed observation expressions
        """
        try:
            translation_result = stix_translater.translate(
                "splunk",
                "parse",
                None,
                stix_pattern,
            )
            if translation_result:
>               parsed_patterns = translation_result["parsed_stix"]
                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
E               KeyError: 'parsed_stix'

.../src/harfanglab_intel_connector/utils.py:21: KeyError

During handling of the above exception, another exception occurred:

    @pytest.fixture
    def fake_stix_indicator():
>       return opencti.Indicator(
            {
                "entity_type": "Indicator",
                "id": "opencti-uuid",
                "standard_id": "stix-uuid",
                "name": "fake_stix_indicator",
                "description": "a fake stix indicator",
                "pattern_type": "stix",
                "pattern": "[ipv4-addr:value = '172.86.102.98']",
            }
        )

.../tests/tests_harfanglab_connector/cti_converter_test.py:15: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
.../harfanglab_intel_connector/models/opencti.py:36: in __init__
    self.observables = self._parse_observables(data)
                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
.../harfanglab_intel_connector/models/opencti.py:45: in _parse_observables
    parsed_patterns = parse_stix_pattern(self.pattern)
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

stix_pattern = "[ipv4-addr:value = '172.86.102.98']"

    def parse_stix_pattern(stix_pattern: str) -> list[dict]:
        """
        Parse observation expressions of a STIX pattern.
        :param stix_pattern: STIX pattern to parse
        :return: List of parsed observation expressions
        """
        try:
            translation_result = stix_translater.translate(
                "splunk",
                "parse",
                None,
                stix_pattern,
            )
            if translation_result:
                parsed_patterns = translation_result["parsed_stix"]
                return parsed_patterns
        except:
>           raise RuntimeError(f"Cannot parse STIX pattern {stix_pattern}")
E           RuntimeError: Cannot parse STIX pattern [ipv4-addr:value = '172.86.102.98']

.../src/harfanglab_intel_connector/utils.py:24: RuntimeError

stream.sekoia-intel.src.sekoia_intel_tests.cti_converter_test::test_cti_converter_create_ioc_rule

Stack Traces | 0.167s run time

stix_pattern = "[ipv4-addr:value = '172.86.102.98']"

    def parse_stix_pattern(stix_pattern: str) -> list[dict]:
        """
        Parse observation expressions of a STIX pattern.
        :param stix_pattern: STIX pattern to parse
        :return: List of parsed observation expressions
        """
        try:
            translation_result = stix_translater.translate(
                "splunk",
                "parse",
                None,
                stix_pattern,
            )
            if translation_result:
>               parsed_patterns = translation_result["parsed_stix"]
                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
E               KeyError: 'parsed_stix'

.../src/sekoia_intel_connector/utils.py:20: KeyError

During handling of the above exception, another exception occurred:

mock_config = <Mock id='140449927777840'>
fake_stix_indicator = <sekoia_intel_connector.models.opencti.Indicator object at 0x7fbd0c126090>

    def test_cti_converter_create_ioc_rule(mock_config, fake_stix_indicator):
        # Given an instance of CTI converter
        # and a valid STIX indicator
        cti_converter = CTIConverter(config=mock_config)
        indicator = fake_stix_indicator
        # when calling create_ioc_rule
>       ioc_rule = cti_converter.create_sekoia_ioc(indicator)
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

.../src/sekoia_intel_tests/cti_converter_test.py:37: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
.../src/sekoia_intel_connector/cti_converter.py:50: in create_sekoia_ioc
    parsed_pattern = parse_stix_pattern(indicator.pattern)
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

stix_pattern = "[ipv4-addr:value = '172.86.102.98']"

    def parse_stix_pattern(stix_pattern: str) -> list[dict]:
        """
        Parse observation expressions of a STIX pattern.
        :param stix_pattern: STIX pattern to parse
        :return: List of parsed observation expressions
        """
        try:
            translation_result = stix_translater.translate(
                "splunk",
                "parse",
                None,
                stix_pattern,
            )
            if translation_result:
                parsed_patterns = translation_result["parsed_stix"]
                return parsed_patterns
            return []
        except Exception:
>           raise RuntimeError(f"Cannot parse STIX pattern {stix_pattern}")
E           RuntimeError: Cannot parse STIX pattern [ipv4-addr:value = '172.86.102.98']

.../src/sekoia_intel_connector/utils.py:24: RuntimeError

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

renovate · 2026-09-09T07:41:31Z

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (==8.1.2). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

Copilot AI lite review requested due to automatic review settings September 3, 2026 14:06

renovate Bot added dependencies Pull requests that update a dependency file. filigran team Item from the Filigran team. labels Sep 3, 2026

Copilot started reviewing on behalf of OpenCTI Platform (OpenCTI-Platform) September 3, 2026 14:06 View session

Copilot AI reviewed Sep 3, 2026

View reviewed changes

renovate Bot force-pushed the renovate/master-stix-shifter-utils-8.x branch from 2c68510 to cbcbca1 Compare September 4, 2026 22:19

chore(deps): update dependency stix-shifter-utils to v8.1.2

340594c

renovate Bot force-pushed the renovate/master-stix-shifter-utils-8.x branch from cbcbca1 to 340594c Compare September 8, 2026 00:45

Hugo Dupras (jabesq) closed this Sep 9, 2026

renovate Bot deleted the renovate/master-stix-shifter-utils-8.x branch September 9, 2026 07:41

Navigation Menu

Uh oh!

chore(deps): update dependency stix-shifter-utils to v8.1.2 (master) - #7543

chore(deps): update dependency stix-shifter-utils to v8.1.2 (master)#7543
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/master-stix-shifter-utils-8.x

renovate Bot commented Sep 3, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 3, 2026

Uh oh!

github-actions Bot commented Sep 3, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

codecov Bot commented Sep 3, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Sep 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

renovate Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v8.1.2

v8.1.1

v8.1.0

Breaking changes:

Deprecations:

Changes:

Fixes:

Dependency update:

v8.0.4

Breaking changes:

Deprecations:

Changes:

Fixes:

Dependency update:

v8.0.3

Breaking changes:

Deprecations:

Changes:

Fixes:

Dependency update:

Configuration

Uh oh!

github-actions Bot commented Sep 3, 2026

Uh oh!

github-actions Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

codecov Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ 4 Tests Failed:

Uh oh!

renovate Bot commented Sep 9, 2026

Renovate Ignore Notification

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

renovate Bot commented Sep 3, 2026 •

edited

Loading

`v8.1.2`

`v8.1.1`

`v8.1.0`

`v8.0.4`

`v8.0.3`

github-actions Bot commented Sep 3, 2026 •

edited

Loading

codecov Bot commented Sep 3, 2026 •

edited

Loading