Brakeman 3.7.0 Released

Performance Improvement with Hash/Array Accesses

When Brakeman sees a hash or array access that it cannot resolve (i.e. can’t find the value for the key), it will no longer copy the entire hash/array value to the call site.

For some applications, this will significantly improve performance.

This may cause some warning fingerprints to change.

(changes)

Unsafe Hash in Redirects

Thanks to Mário Areias, Brakeman correctly handles to_unsafe_hash and to_unsafe_h in redirect_to.

(changes)

Progress Indicator in Interactive Mode

When using -I to manage false positives, Brakeman will now show how far you are through the warnings.

(changes)

Simple Guards with Return

Brakeman can now recognize simple guard conditions such as:

return unless [:safe, :values].include? params[:x]

(changes)

Rails Version Option in Brakeman Configuration

It is now possible to specify just :rails4: true or :rails5: true in a Brakeman configuration file.

(changes)

Updated RubyParser

The main brakeman gem bundles as-of-yet unreleased changes in RubyParser. This includes “squiggly heredoc” support (<<~), improved line numbers, and a few other fixes.