v6.2.1

Just a packaging fix for brakeman.gem

v6.2.0

• Add --show-ignored option (Gabriel Zayas)
• Add optional support for Prism parser
• Warn about unscoped finds with find_by!
• Treat ::X and X the same, for now (Jill Klang)
• Fix compatibility with default frozen string literals (Jean Boussier)
• Remediation advice for command injection (Nicholas Barone)
• Fix Ruby warnings in test suite (Jean Boussier)
• Support YAML aliases in secret configs (Chedli Bourguiba)
• Add initial Rails 8 support (Ron Shinall)
• Handle mass assignment with splats
• Add support for symbolic links (Lu Zhu)

v6.1.2

Compare Source

• Update Highline to 3.0
• Add EOL date for Ruby 3.3.0
• Avoid copying Sexps that are too large
• Avoid detecting ViewComponentContrib::Base as dynamic render paths (vividmuimui)
• Remove deprecated use of Kernel#open("|...")
• Remove safe_yaml gem dependency
• Avoid detecting Phlex components as dynamic render paths (Máximo Mussini)

v6.1.1

Compare Source

• Handle racc as a default gem in Ruby 3.3.0

v6.1.0

Compare Source

• Add --timing to add timing duration for scan steps
• Fix keyword splats in filter arguments
• Add check for unfiltered search with Ransack
• Fix class method lookup in parent classes
• Handle class << self
• Add PG::Connection.escape_string as a SQL sanitization method (Joévin Soulenq)

v6.0.1

Compare Source

• Accept strings for load_defaults version

v6.0.0

Compare Source

• Add obsolete fingerprints to comparison report
• Warn about missing CSRF protection when defaults are not loaded (Chris Kruger)
• Scan directories that include the word public
• Raise minimum Ruby version to 3.0
• Drop support for Ruby 1.8/1.9 syntax
• Fix end-of-life dates for Ruby
• Fix false positive with content_tag in newer Rails