Bump brakeman from 5.4.1 to 6.2.2

[dependabot]

Bumps brakeman from 5.4.1 to 6.2.2.

Release notes

Sourced from brakeman's releases.

6.2.2

• New end-of-support dates for Rails
• Revamp command injection detection in pipeline* calls (#1862)
• Exclude more native gems from vendored gems in brakeman gem (#1869)

6.2.1

• Add optional support for Prism parser (use --prism)
• Handle parallel assignment with splats (#1833)
• Warn about unscoped finds with find_by! (#1786)
• Add initial Rails 8 support (Ron Shinall)
• Add support for symbolic links (Lu Zhu)
• Support YAML aliases in secret configs (Chedli Bourguiba)
• Add --show-ignored option (Gabriel Arcangel Zayas)
• Treat ::X and X the same, for now (Jill Klang)
• Remediation advice for command injection Nicholas Barone
• Fix compatibility with default frozen string literals (Jean Boussier)
• Fix Ruby warnings in test suite (Jean Boussier)

6.1.2

• Avoid detecting Phlex components as dynamic render paths (Máximo Mussini)
• Avoid detecting ViewComponentContrib::Base as dynamic render paths (vividmuimui)
• Avoid copying Sexps that are too large (#1818, #1546)
• Add EOL date for Ruby 3.3.0
• Remove deprecated use of Kernel#open("|...")
• Remove safe_yaml gem dependency
• Update Highline to 3.0 (#1812)

6.1.1

• Handle racc as a default gem in Ruby 3.3.0

6.1.0

• Add check for unfiltered search with Ransack
• Add --timing to add timing duration for scan steps
• Add PG::Connection.escape_string as a SQL sanitization method (Joévin Soulenq)
• Handle class << self
• Fix class method lookup in parent classes
• Fix keyword splats in filter arguments

6.0.0.1 - Docker only

This release is to fix the Ruby version used in the Docker image.

No other changes.

6.0.0

• Drop support for Ruby 1.8/1.9 syntax
• Raise minimum Ruby version to 3.0
• Add obsolete fingerprints to comparison report (#1758)
• Warn about missing CSRF protection when defaults are not loaded (Chris Kruger)
• Fix false positive with content_tag in newer Rails (#1778)
• Scan directories that include the word public

... (truncated)

Changelog

Sourced from brakeman's changelog.

6.2.2 - 2024-10-15

• Ignore more native gems when building gem
• Revamp command injection in pipeline* calls
• New end-of-support dates for Rails

6.2.1 - 2024-08-22

Just a packaging fix for brakeman.gem

6.2.0 - 2024-08-22

• Add --show-ignored option (Gabriel Zayas)
• Add optional support for Prism parser
• Warn about unscoped finds with find_by!
• Treat ::X and X the same, for now (Jill Klang)
• Fix compatibility with default frozen string literals (Jean Boussier)
• Remediation advice for command injection (Nicholas Barone)
• Fix Ruby warnings in test suite (Jean Boussier)
• Support YAML aliases in secret configs (Chedli Bourguiba)
• Add initial Rails 8 support (Ron Shinall)
• Handle mass assignment with splats
• Add support for symbolic links (Lu Zhu)

6.1.2 - 2024-02-01

• Update Highline to 3.0
• Add EOL date for Ruby 3.3.0
• Avoid copying Sexps that are too large
• Avoid detecting ViewComponentContrib::Base as dynamic render paths (vividmuimui)
• Remove deprecated use of Kernel#open("|...")
• Remove safe_yaml gem dependency
• Avoid detecting Phlex components as dynamic render paths (Máximo Mussini)

6.1.1 - 2023-12-24

• Handle racc as a default gem in Ruby 3.3.0

6.1.0 - 2023-12-04

• Add --timing to add timing duration for scan steps
• Fix keyword splats in filter arguments
• Add check for unfiltered search with Ransack
• Fix class method lookup in parent classes
• Handle class << self
• Add PG::Connection.escape_string as a SQL sanitization method (Joévin Soulenq)

6.0.1 - 2023-07-20

• Accept strings for load_defaults version

... (truncated)

Commits

• 0aeceda Bump to 6.2.2
• 43612a6 Merge pull request #1872 from presidentbeef/more_native_gems_to_ignore
• 2ece3b4 Update CHANGES
• 72df013 Ignore more native gems when building gem
• e4f49f6 Merge pull request #1868 from presidentbeef/revamp_pipeline_check
• 9e8cd79 Revamp command injection in pipeline* calls
• f99539b Merge pull request #1865 from presidentbeef/update_eol_dates_for_rails
• 1713d5f Remove Gitter link from README
• c25fcae Merge pull request #1864 from presidentbeef/fix_docker_once_more
• 8da2a28 New end-of-support dates for Rails
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)