Bump brakeman from 5.3.1 to 6.1.0

[dependabot]

Bumps brakeman from 5.3.1 to 6.1.0.

Release notes

Sourced from brakeman's releases.

6.1.0

• Add check for unfiltered search with Ransack
• Add --timing to add timing duration for scan steps
• Add PG::Connection.escape_string as a SQL sanitization method (Joévin Soulenq)
• Handle class << self
• Fix class method lookup in parent classes
• Fix keyword splats in filter arguments

6.0.0.1 - Docker only

This release is to fix the Ruby version used in the Docker image.

No other changes.

6.0.0

• Drop support for Ruby 1.8/1.9 syntax
• Raise minimum Ruby version to 3.0
• Add obsolete fingerprints to comparison report (#1758)
• Warn about missing CSRF protection when defaults are not loaded (Chris Kruger)
• Fix false positive with content_tag in newer Rails (#1778)
• Scan directories that include the word public
• Fix end-of-life dates for Ruby

5.4.1

• Add Rails 6.1 and 7.0 default configuration values
• Support Rails 7 redirect options
• Add redirect_back and redirect_back_or_to to open redirect check
• Revise checking for request.env to only consider request headers
• Prevent redirects using url_from being marked as unsafe (Lachlan Sylvester)
• Warn about unscoped find for find_by(id: ...)
• Support presence, presence_in and in? (#1569)
• Fix issue with if expressions in when clauses (#1743)
• Fix file/line location for EOL software warnings

5.4.0

• Add check for weak RSA key sizes and padding modes (#1736)
• Add check for absolute paths issue with Pathname (#1721)
• Handle multiple values and splats in case/when (#1730)
• Ignore more model methods in redirects (#1723)
• Fix load_rails_defaults overwriting settings in the Rails application (James Gregory-Monk)
• Use relative paths for CodeClimate report format (Mike Poage)

Changelog

Sourced from brakeman's changelog.

6.1.0 - 2023-12-04

• Add --timing to add timing duration for scan steps
• Fix keyword splats in filter arguments
• Add check for unfiltered search with Ransack
• Fix class method lookup in parent classes
• Handle class << self
• Add PG::Connection.escape_string as a SQL sanitization method (Joévin Soulenq)

6.0.1 - 2023-07-20

• Accept strings for load_defaults version

6.0.0 - 2023-05-24

• Add obsolete fingerprints to comparison report
• Warn about missing CSRF protection when defaults are not loaded (Chris Kruger)
• Scan directories that include the word public
• Raise minimum Ruby version to 3.0
• Drop support for Ruby 1.8/1.9 syntax
• Fix end-of-life dates for Ruby
• Fix false positive with content_tag in newer Rails

5.4.1 - 2023-02-21

• Fix file/line location for EOL software warnings
• Revise checking for request.env to only consider request headers
• Add redirect_back and redirect_back_or_to to open redirect check
• Support Rails 7 redirect options
• Add Rails 6.1 and 7.0 default configuration values
• Prevent redirects using url_from being marked as unsafe (Lachlan Sylvester)
• Warn about unscoped find for find_by(id: ...)
• Support presence, presence_in and in?
• Fix issue with if expressions in when clauses

5.4.0 - 2022-11-17

• Use relative paths for CodeClimate report format (Mike Poage)
• Add check for weak RSA key sizes and padding modes
• Handle multiple values and splats in case/when
• Ignore more model methods in redirects
• Add check for absolute paths issue with Pathname
• Fix load_rails_defaults overwriting settings in the Rails application (James Gregory-Monk)

Commits

• 391c95e Bump to 6.1.0
• 391f530 Merge pull request #1803 from presidentbeef/ransack_dupes
• be51b98 Avoid duplicate warnings about Ransack
• 9d36b2e Update CHANGES
• eac6316 Update CHANGES
• dcc6fef Merge pull request #1801 from presidentbeef/step_timings
• 8d1daa8 Test --timing
• 4353b8a Merge pull request #1789 from joevin-slq-docto/handle_pg_connection_escape_st...
• 9f63df9 Merge pull request #1800 from presidentbeef/fix_kwsplats_in_filter_options
• 7707798 Test non-value filter option
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #1652.