5.1.0

• Report Formats
  • Add GitHub Actions format (Klaus Badelt)
  • Add ignored warnings to SARIF report (Eli Block)
  • Fix SARIF report when checks have no description (Eli Block)
  • Adjust copy of --interactive menu (Elia Schito)
• Performance
  • Read and parse files in parallel
• Ruby Interpretation
  • Initial support for ActiveRecord enums (#1492)
  • Interprocedural dataflow from very simple class methods
  • Support Array#fetch and Hash#fetch (#1571)
  • Support Array#push
  • Support Array#*
  • Better Array#join support
  • Support Hash#values and Hash#values_at
  • Support Hash#include?
• SQL Injection
  • Update SQL injection check for Rails 6.0/6.1
  • Add --sql-safe-methods option (Esty Scheiner)
  • Ignore dates in SQL
  • Ignore sanitize_sql_like in SQL (#1571)
  • Ignore method calls on numbers in SQL (#1571)
• Other Fixes
  • Ignore renderables in dynamic render path check (Brad Parker)
  • Fix false positive in command injection with Open3.capture (Richard Fitzgerald)
  • Fix infinite loop on mixin self-includes (Andrew Szczepanski)
  • Check for user-controlled evaluation even if it's a call target (#1590)
• Refactoring
  • Refactor cookie?/param? methods (Keenan Brock)
  • Better method definition tracking and lookup

5.0.4

• Update bundled ruby_parser to include argument forwarding support (brakeman gem only)

5.0.2

• Fix Loofah version check

5.0.1

• Support loading slim/smart (#1570)
• Set more line numbers on Sexps (#1579)
• Detect ::Rails.application.configure too (#1584)
• Always ignore slice/only calls for mass assignment
• Don't fail if $HOME/$USER are not defined
• Convert splat array arguments to arguments
• Bundle unreleased RubyParser changes

5.0.0

• Scan (almost) all Ruby files in project
• Revamp CSV report to a CSV list of warnings
• Add Sonarqube report format (Adam England)
• Add check for (more) unsafe method reflection (#1488, #1507, and #1508)
• Add check for potential HTTP verb confusion (#1432)
• Add --[no-]skip-vendor option
• Ignore uuid as a safe attribute
• Ignore Tempfile#path in shell commands
• Ignore development environment
• Collapse __send__ calls
• Set Rails configuration defaults based on load_defaults version
• Update Ruby requirement to version 2.4.0
• Suggest using --force if no Rails application is detected

4.10.1

• Declare REXML as a dependency (Ruby 3.0 compatibility)
• Use Sexp#sexp_body instead of Sexp#[..] (Ruby 3.0 compatibility)
• Prevent render loops when template names are absolute paths (#1536)
• Ensure RubyParser is passed file path as a String (#1534)
• Support new Haml 5.2.0 escaping method (#1517)

5.0.0.pre1

• Add check for (more) unsafe method reflection
• Suggest using --force if no Rails application is detected
• Add Sonarqube report format (Adam England)
• Add check for potential HTTP verb confusion
• Add --[no-]skip-vendor option
• Scan (almost) all Ruby files in project
• Add support for Haml 5.2.0

4.10.0

• Add SARIF report format (Steve Winton)

4.9.1

• Use version from active_record for non-Rails apps (Ulysse Buonomo)
• Check chomped strings for SQL injection (#1509)
• Always set line number for joined arrays (#1499)
• Avoid warning about missing attr_accessible if protected_attributes gem is used (#1512)
• Bundle latest ruby_parser (4.15.0)

4.9.0

• Add --ensure-ignore-notes (Eli Block)
• Add check for user input in ERB.new (Matt Hickman)
• Add check for CVE-2020-8166 (Jamie Finnigan)
• Always scan environment.rb
• Avoid warning when safe_yaml is used via YAML.load(..., safe: true)
• Do not warn about mass assignment with params.permit!.slice
• Ignore params.permit! in path helpers
• Treat Dir.glob as safe source of values in guards
• Remove whitelist/blacklist language, add clarifications
• Add "full call" information to call index results
• Updated Slim dependency (Jeremiah Church)