Update dependency brakeman to v7

renovate commented

2024-12-31 06:03:58 +00:00

Collaborator

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
brakeman (source, changelog)	`6.2.2` -> `7.1.1`

Release Notes

presidentbeef/brakeman (brakeman)

`v7.1.1`

Compare Source

Fix false positive when calling with_content on ViewComponents (Peer Allan)
Word wrap text output in pager
Consider Tempfile.create.path as safe input (Ali Ismayilov)
Exclude directories before searching for files
Check each side of or SQL arguments
Ignore attribute builder in Haml 6
Add FilePath#to_path for Ruby 3.5 compatibility (S-H-GAMELINKS)
Fix SQL injection check for calculate method (Rohan Sharma)
Fix missing td in HTML report (John Hawthorn)
Check for unsafe SQL when two arguments are passed to AR methods (Patrick Brinich-Langlois)

`v7.1.0`

Compare Source

Add EOL dates for Rails 8.0 and Ruby 3.4
Support render model shortcut
Use lazy file lists for AppTree
Add Haml 6.x support
Improve ignored warnings layout in HTML report (Sebastien Savater)
Update JUnit report for CircleCI (Philippe Bernery)
Only load escape functionality from cgi library (Earlopain)
Add --ensure-no-obsolete-ignore-entries option (viralpraxis)

`v7.0.2`

Compare Source

Fix error with empty BUNDLE_GEMFILE env variable

`v7.0.1`

Compare Source

Avoid warning on evaluation of plain strings
Enable use of custom/alternative Gemfiles
Fix error on directory with rb extension (viralpraxis)
Support terminal-table 4.0 (Chedli Bourguiba)
Better support Prism 1.4.0
Only output timing for each file when using --debug

`v7.0.0`

Compare Source

Always warn about deserializing from Marshal
Output originalBaseUriIds for SARIF format report
Default to using Prism parser if available (disable with --no-prism)
Update terminal-table version to use latest
Update eval check to be a little noisier
Fix array/hash unknown index handling
Disable following symbolic links by default, re-enable with --follow-symlinks
Add step (and timing) for finding files
Add CSV library as explicit dependency for Ruby 3.4 support
Major changes to how rescanning works
Raise minimum Ruby version to 3.1
Fix hardcoded globally excluded paths
Remove updated entry in Brakeman ignore files (Toby Hsieh)
Fix recursion when handling multiple assignment expressions

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [brakeman](https://brakemanscanner.org/) ([source](https://github.com/presidentbeef/brakeman), [changelog](https://github.com/presidentbeef/brakeman/releases)) | `6.2.2` -> `7.1.1` | [![age](https://developer.mend.io/api/mc/badges/age/rubygems/brakeman/7.1.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/rubygems/brakeman/7.1.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/rubygems/brakeman/6.2.2/7.1.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/rubygems/brakeman/6.2.2/7.1.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes <details> <summary>presidentbeef/brakeman (brakeman)</summary> ### [`v7.1.1`](https://github.com/presidentbeef/brakeman/blob/HEAD/CHANGES.md#711---2025-11-03) [Compare Source](https://github.com/presidentbeef/brakeman/compare/v7.1.0...v7.1.1) - Fix false positive when calling `with_content` on ViewComponents (Peer Allan) - Word wrap text output in pager - Consider Tempfile.create.path as safe input (Ali Ismayilov) - Exclude directories before searching for files - Check each side of `or` SQL arguments - Ignore attribute builder in Haml 6 - Add `FilePath#to_path` for Ruby 3.5 compatibility (S-H-GAMELINKS) - Fix SQL injection check for calculate method (Rohan Sharma) - Fix missing `td` in HTML report (John Hawthorn) - Check for unsafe SQL when two arguments are passed to AR methods (Patrick Brinich-Langlois) ### [`v7.1.0`](https://github.com/presidentbeef/brakeman/blob/HEAD/CHANGES.md#710---2025-07-18) [Compare Source](https://github.com/presidentbeef/brakeman/compare/v7.0.2...v7.1.0) - Add EOL dates for Rails 8.0 and Ruby 3.4 - Support render model shortcut - Use lazy file lists for AppTree - Add Haml 6.x support - Improve ignored warnings layout in HTML report (Sebastien Savater) - Update JUnit report for CircleCI (Philippe Bernery) - Only load escape functionality from cgi library (Earlopain) - Add `--ensure-no-obsolete-ignore-entries` option (viralpraxis) ### [`v7.0.2`](https://github.com/presidentbeef/brakeman/blob/HEAD/CHANGES.md#702---2025-04-04) [Compare Source](https://github.com/presidentbeef/brakeman/compare/v7.0.1...v7.0.2) - Fix error with empty `BUNDLE_GEMFILE` env variable ### [`v7.0.1`](https://github.com/presidentbeef/brakeman/blob/HEAD/CHANGES.md#701---2025-04-03) [Compare Source](https://github.com/presidentbeef/brakeman/compare/v7.0.0...v7.0.1) - Avoid warning on evaluation of plain strings - Enable use of custom/alternative Gemfiles - Fix error on directory with `rb` extension (viralpraxis) - Support `terminal-table` 4.0 (Chedli Bourguiba) - Better support Prism 1.4.0 - Only output timing for each file when using `--debug` ### [`v7.0.0`](https://github.com/presidentbeef/brakeman/blob/HEAD/CHANGES.md#700---2024-12-30) [Compare Source](https://github.com/presidentbeef/brakeman/compare/v6.2.2...v7.0.0) - Always warn about deserializing from Marshal - Output `originalBaseUriIds` for SARIF format report - Default to using Prism parser if available (disable with `--no-prism`) - Update `terminal-table` version to use latest - Update `eval` check to be a little noisier - Fix array/hash unknown index handling - Disable following symbolic links by default, re-enable with --follow-symlinks - Add step (and timing) for finding files - Add CSV library as explicit dependency for Ruby 3.4 support - Major changes to how rescanning works - Raise minimum Ruby version to 3.1 - Fix hardcoded globally excluded paths - Remove updated entry in Brakeman ignore files (Toby Hsieh) - Fix recursion when handling multiple assignment expressions </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

renovate force-pushed renovate/brakeman-7.x-lockfile from 2285cb8ab2