Update dependency brakeman to v6 (!123) · Merge requests · GitLab.org / gitlab-services / version-gitlab-com

GitLab Dependency Bot requested to merge gitlab-renovate-forks/version.gitlab.com:renovate/brakeman-6.x into main May 13, 2024

This MR contains the following updates:

Package	Update	Change
brakeman (source, changelog)	major	`'4.10.1'` -> `'6.1.2'`

MR created with the help of gitlab-org/frontend/renovate-gitlab-bot

Release Notes

presidentbeef/brakeman (brakeman)

`v6.1.2`

Compare Source

Update Highline to 3.0
Add EOL date for Ruby 3.3.0
Avoid copying Sexps that are too large
Avoid detecting ViewComponentContrib::Base as dynamic render paths (vividmuimui)
Remove deprecated use of Kernel#open("|...")
Remove safe_yaml gem dependency
Avoid detecting Phlex components as dynamic render paths (Máximo Mussini)

`v6.1.1`

Compare Source

Handle racc as a default gem in Ruby 3.3.0

`v6.1.0`

Compare Source

Add --timing to add timing duration for scan steps
Fix keyword splats in filter arguments
Add check for unfiltered search with Ransack
Fix class method lookup in parent classes
Handle class << self
Add PG::Connection.escape_string as a SQL sanitization method (Joévin Soulenq)

`v6.0.1`

Compare Source

Accept strings for load_defaults version

`v6.0.0`

Compare Source

Add obsolete fingerprints to comparison report
Warn about missing CSRF protection when defaults are not loaded (Chris Kruger)
Scan directories that include the word public
Raise minimum Ruby version to 3.0
Drop support for Ruby 1.8/1.9 syntax
Fix end-of-life dates for Ruby
Fix false positive with content_tag in newer Rails

`v5.4.1`

Compare Source

Fix file/line location for EOL software warnings
Revise checking for request.env to only consider request headers
Add redirect_back and redirect_back_or_to to open redirect check
Support Rails 7 redirect options
Add Rails 6.1 and 7.0 default configuration values
Prevent redirects using url_from being marked as unsafe (Lachlan Sylvester)
Warn about unscoped find for find_by(id: ...)
Support presence, presence_in and in?
Fix issue with if expressions in when clauses

`v5.4.0`

Compare Source

Use relative paths for CodeClimate report format (Mike Poage)
Add check for weak RSA key sizes and padding modes
Handle multiple values and splats in case/when
Ignore more model methods in redirects
Add check for absolute paths issue with Pathname
Fix load_rails_defaults overwriting settings in the Rails application (James Gregory-Monk)

`v5.3.1`

Compare Source

Fix version range for CVE-2022-32209

`v5.3.0`

Compare Source

Include explicit engine or lib paths in vendor/ (Joe Rafaniello)
Load rexml as a Brakeman dependency
Fix "full call" information propagating unnecessarily
Add check for CVE-2022-32209
Add CWE information to warnings (Stephen Aghaulor)

`v5.2.3`

Compare Source

Fix error with hash shorthand syntax
Match order of interactive options with help message (Rory O'Kane)

`v5.2.2`

Compare Source

Update ruby_parser for Ruby 3.1 support (Merek Skubela)
Handle nil when joining values (Dan Buettner)
Update message for unsafe reflection (Pedro Baracho)
Add additional String methods for SQL injection check
Respect equality in if conditions

`v5.2.1`

Compare Source

Add warning codes for EOL software warnings

`v5.2.0`

Compare Source

Initial Rails 7 support
Require Ruby 2.5.0+
Fix issue with calls to foo.root in routes
Ignore I18n.locale in SQL queries
Do not treat sanitize_sql_like as safe
Add new checks for unsupported Ruby and Rails versions

`v5.1.2`

Compare Source

Handle cases where enums are not symbols
Support newer Haml with ::Haml::AttributeBuilder.build
Fix issue where the previous output is still visible (Jason Frey)
Fix warning sorting with nil line numbers
Update for latest RubyParser (Ryan Davis)

`v5.1.1`

Compare Source

Unrefactor IgnoreConfig's use of Brakeman::FilePath

`v5.1.0`

Compare Source

Initial support for ActiveRecord enums
Support Hash#include?
Interprocedural dataflow from very simple class methods
Fix SARIF report when checks have no description (Eli Block)
Add ignored warnings to SARIF report (Eli Block)
Add --sql-safe-methods option (Esty Scheiner)
Update SQL injection check for Rails 6.0/6.1
Fix false positive in command injection with Open3.capture (Richard Fitzgerald)
Fix infinite loop on mixin self-includes (Andrew Szczepanski)
Ignore dates in SQL
Refactor cookie?/param? methods (Keenan Brock)
Ignore renderables in dynamic render path check (Brad Parker)
Support Array#push
Better Array#join support
Adjust copy of --interactive menu (Elia Schito)
Support Array#*
Better method definition tracking and lookup
Support Hash#values and Hash#values_at
Check for user-controlled evaluation even if it's a call target
Support Array#fetch and Hash#fetch
Ignore sanitize_sql_like in SQL
Ignore method calls on numbers in SQL
Add GitHub Actions format (Klaus Badelt)
Read and parse files in parallel