4.10.1

• Declare REXML as a dependency (Ruby 3.0 compatibility)
• Use Sexp#sexp_body instead of Sexp#[..] (Ruby 3.0 compatibility)
• Prevent render loops when template names are absolute paths (#1536)
• Ensure RubyParser is passed file path as a String (#1534)
• Support new Haml 5.2.0 escaping method (#1517)

5.0.0.pre1

• Add check for (more) unsafe method reflection
• Suggest using --force if no Rails application is detected
• Add Sonarqube report format (Adam England)
• Add check for potential HTTP verb confusion
• Add --[no-]skip-vendor option
• Scan (almost) all Ruby files in project
• Add support for Haml 5.2.0

4.10.0

• Add SARIF report format (Steve Winton)

4.9.1

• Use version from active_record for non-Rails apps (Ulysse Buonomo)
• Check chomped strings for SQL injection (#1509)
• Always set line number for joined arrays (#1499)
• Avoid warning about missing attr_accessible if protected_attributes gem is used (#1512)
• Bundle latest ruby_parser (4.15.0)

4.9.0

• Add --ensure-ignore-notes (Eli Block)
• Add check for user input in ERB.new (Matt Hickman)
• Add check for CVE-2020-8166 (Jamie Finnigan)
• Always scan environment.rb
• Avoid warning when safe_yaml is used via YAML.load(..., safe: true)
• Do not warn about mass assignment with params.permit!.slice
• Ignore params.permit! in path helpers
• Treat Dir.glob as safe source of values in guards
• Remove whitelist/blacklist language, add clarifications
• Add "full call" information to call index results
• Updated Slim dependency (Jeremiah Church)

4.8.2

• Add --text-fields option
• Add check for CVE-2020-8159
• Add check for escaping HTML entities in JSON configuration option
• Fix authenticate_or_request_with_http_basic check for passed blocks (Hugo Corbucci)

4.8.1

• Warn about global(!) mass assignment
• Check SQL query strings using String#strip or String.squish (#1459)
• Handle non-symbol keys in locals hash for render (#1465)
• Index calls in render arguments (#1459)

4.8.0

• Add JUnit XML report format (Naoki Kimurai)
• Sort ignore files by fingerprint and line (Ngan Pham)
• Catch dangerous concatenation in CheckExecute (Jacob Evelyn)
• User-friendly message when ignore config file has invalid JSON (D. Hicks)
• Freeze call index results, fix thread-safety issue
• Properly render confidence in Markdown report (#1446)
• Report old warnings as fixed if zero warnings reported
• Initialize Rails version with nil (Carsten Wirth)
• Fix output test when using newer Minitest

4.7.2

• Add request.params as query parameters (#1398)
• Handle more permit! cases (#1426)
• Remove version guard for named_scope vs. scope
• Find SQL injection in String#strip_heredoc target (#1433)
• Ensure file name is set when processing models
• Bundle ruby_parser version 3.14.1 (#1429)

4.7.1

• Sort text report by file and line (Jacob Evelyn)
• Catch reverse tabnabbing with :_blank symbol (Jacob Evelyn)
• Convert s(:lambda) to s(:call) in Sexp#block_call (#1410)
• Check string length against limit before joining
• Fix flaky rails4 test (Adam Kiczula)
• Fix errors from frozen Symbol#to_s in Ruby 2.7
• Add release dates to each version in CHANGES (TheSpartan1980)