This was supposed to be a 1.0.1 release, but quite a bit of code changed.

Changes since 1.0:

• Relax required versions for dependencies (this is for Bundler users)
• Performance improvements for source processing
• Better progress reporting
• Handle basic operators like « + - * /
• Rescue more errors to prevent Brakeman from completely bailing out
• Compatibility with newer Haml versions
• Fix some 1.9 warnings

Relax Dependencies

The version dependencies for Brakeman have been relaxed somewhat, so it should work fine if included in a Rails 3 Gemfile. Unfortunately, this makes it a little harder to be sure it will work with all setups. Please report any problems!

Performance Improvements

The 1.0 release reduced the time taken for running the vulnerability checks, but (unrelatedly) the time for processing the source code increased.

This release makes some improvements that should improve scan times. If it takes an intolerable amount of time for scans (more than 5-10 minutes), try using the --faster option. This will possibly report fewer vulnerabilities, but should be much faster.

Progress Reporting

Brakeman will now provide better feedback about its progress while processing applications. For even more output, use the --debug option.

Handle More Operators

See here for the kinds of simple processing Brakeman can do.

Rescue More Errors

Brakeman does its best to never completely abort execution and tries to always provide an analysis of whatever it can manage. This release rescues exceptions that may occur while processing configurations and Gemfiles.

Problems

If you run into any problems, don’t hesitate to send a tweet to @Brakemanscanner or file an issue on GitHub!