5.0.1

• Support loading slim/smart (#1570)
• Set more line numbers on Sexps (#1579)
• Detect ::Rails.application.configure too (#1584)
• Always ignore slice/only calls for mass assignment
• Don't fail if $HOME/$USER are not defined
• Convert splat array arguments to arguments
• Bundle unreleased RubyParser changes

5.0.0

• Scan (almost) all Ruby files in project
• Revamp CSV report to a CSV list of warnings
• Add Sonarqube report format (Adam England)
• Add check for (more) unsafe method reflection (#1488, #1507, and #1508)
• Add check for potential HTTP verb confusion (#1432)
• Add --[no-]skip-vendor option
• Ignore uuid as a safe attribute
• Ignore Tempfile#path in shell commands
• Ignore development environment
• Collapse __send__ calls
• Set Rails configuration defaults based on load_defaults version
• Update Ruby requirement to version 2.4.0
• Suggest using --force if no Rails application is detected

4.10.1

• Declare REXML as a dependency (Ruby 3.0 compatibility)
• Use Sexp#sexp_body instead of Sexp#[..] (Ruby 3.0 compatibility)
• Prevent render loops when template names are absolute paths (#1536)
• Ensure RubyParser is passed file path as a String (#1534)
• Support new Haml 5.2.0 escaping method (#1517)

5.0.0.pre1

• Add check for (more) unsafe method reflection
• Suggest using --force if no Rails application is detected
• Add Sonarqube report format (Adam England)
• Add check for potential HTTP verb confusion
• Add --[no-]skip-vendor option
• Scan (almost) all Ruby files in project
• Add support for Haml 5.2.0

4.10.0

• Add SARIF report format (Steve Winton)

4.9.1

• Use version from active_record for non-Rails apps (Ulysse Buonomo)
• Check chomped strings for SQL injection (#1509)
• Always set line number for joined arrays (#1499)
• Avoid warning about missing attr_accessible if protected_attributes gem is used (#1512)
• Bundle latest ruby_parser (4.15.0)

4.9.0

• Add --ensure-ignore-notes (Eli Block)
• Add check for user input in ERB.new (Matt Hickman)
• Add check for CVE-2020-8166 (Jamie Finnigan)
• Always scan environment.rb
• Avoid warning when safe_yaml is used via YAML.load(..., safe: true)
• Do not warn about mass assignment with params.permit!.slice
• Ignore params.permit! in path helpers
• Treat Dir.glob as safe source of values in guards
• Remove whitelist/blacklist language, add clarifications
• Add "full call" information to call index results
• Updated Slim dependency (Jeremiah Church)

4.8.2

• Add --text-fields option
• Add check for CVE-2020-8159
• Add check for escaping HTML entities in JSON configuration option
• Fix authenticate_or_request_with_http_basic check for passed blocks (Hugo Corbucci)

4.8.1

• Warn about global(!) mass assignment
• Check SQL query strings using String#strip or String.squish (#1459)
• Handle non-symbol keys in locals hash for render (#1465)
• Index calls in render arguments (#1459)

4.8.0

• Add JUnit XML report format (Naoki Kimurai)
• Sort ignore files by fingerprint and line (Ngan Pham)
• Catch dangerous concatenation in CheckExecute (Jacob Evelyn)
• User-friendly message when ignore config file has invalid JSON (D. Hicks)
• Freeze call index results, fix thread-safety issue
• Properly render confidence in Markdown report (#1446)
• Report old warnings as fixed if zero warnings reported
• Initialize Rails version with nil (Carsten Wirth)
• Fix output test when using newer Minitest