6.2.2

• New end-of-support dates for Rails
• Revamp command injection detection in pipeline* calls (#1862)
• Exclude more native gems from vendored gems in brakeman gem (#1869)

6.2.1

• Add optional support for Prism parser (use --prism)
• Handle parallel assignment with splats (#1833)
• Warn about unscoped finds with find_by! (#1786)
• Add initial Rails 8 support (Ron Shinall)
• Add support for symbolic links (Lu Zhu)
• Support YAML aliases in secret configs (Chedli Bourguiba)
• Add --show-ignored option (Gabriel Arcangel Zayas)
• Treat ::X and X the same, for now (Jill Klang)
• Remediation advice for command injection Nicholas Barone
• Fix compatibility with default frozen string literals (Jean Boussier)
• Fix Ruby warnings in test suite (Jean Boussier)

6.1.2

• Avoid detecting Phlex components as dynamic render paths (Máximo Mussini)
• Avoid detecting ViewComponentContrib::Base as dynamic render paths (vividmuimui)
• Avoid copying Sexps that are too large (#1818, #1546)
• Add EOL date for Ruby 3.3.0
• Remove deprecated use of Kernel#open("|...")
• Remove safe_yaml gem dependency
• Update Highline to 3.0 (#1812)

6.1.1

• Handle racc as a default gem in Ruby 3.3.0

6.1.0

• Add check for unfiltered search with Ransack
• Add --timing to add timing duration for scan steps
• Add PG::Connection.escape_string as a SQL sanitization method (Joévin Soulenq)
• Handle class << self
• Fix class method lookup in parent classes
• Fix keyword splats in filter arguments

6.0.0.1 - Docker only

This release is to fix the Ruby version used in the Docker image.

No other changes.

6.0.0

• Drop support for Ruby 1.8/1.9 syntax
• Raise minimum Ruby version to 3.0
• Add obsolete fingerprints to comparison report (#1758)
• Warn about missing CSRF protection when defaults are not loaded (Chris Kruger)
• Fix false positive with content_tag in newer Rails (#1778)
• Scan directories that include the word public
• Fix end-of-life dates for Ruby

5.4.1

• Add Rails 6.1 and 7.0 default configuration values
• Support Rails 7 redirect options
• Add redirect_back and redirect_back_or_to to open redirect check
• Revise checking for request.env to only consider request headers
• Prevent redirects using url_from being marked as unsafe (Lachlan Sylvester)
• Warn about unscoped find for find_by(id: ...)
• Support presence, presence_in and in? (#1569)
• Fix issue with if expressions in when clauses (#1743)
• Fix file/line location for EOL software warnings

5.4.0

• Add check for weak RSA key sizes and padding modes (#1736)
• Add check for absolute paths issue with Pathname (#1721)
• Handle multiple values and splats in case/when (#1730)
• Ignore more model methods in redirects (#1723)
• Fix load_rails_defaults overwriting settings in the Rails application (James Gregory-Monk)
• Use relative paths for CodeClimate report format (Mike Poage)

5.3.1

• Fix version range for CVE-2022-32209