[dependabot]

Bumps brakeman from 7.1.2 to 8.1.0.

Release notes

Sourced from brakeman's releases.

8.1.0

• Update SonarQube report to use generic issue format (@​fffx)
• Include regex code in validation warnings (@​eliotsykes)
• Check validation regexes in non-activerecord models (@​eliotsykes)
• Skip top-level vendor directory before recursive globbing (@​ronocod)
• Support Rails 7.1+ positional enum syntax in SQL injection check (@​cubasepp / @​Eljees)
• Recognize Haml::AttributeBuilder.build_class as an escaped output (@​Eljees)
• Fix frozen string error (@​shaicoleman)
• Better help and error message for --ensure-latest (#2036)

8.0.6 - EOL Dates

• Fix EOL date for Rails 8.0 (@​yeaseul-kim)
• Fix command injection false positives (@​JacobEvelyn )
• Fix unused variable warning (@​viralpraxis)
• Add EOL dates for Rails 8.1 and Ruby 4.0

8.0.5

• Add quote_schema_name to safe quote method list (changes by Zsolt Kozaroczy)
• Fix SQL injection false positive for compact_blank/compact on permitted params (changes by Arpit Jain)
• Fix inline render false positive for local named text (changes by Arpit Jain)
• Fix HAML crash on .raw calls (changes by Federico Franco)
• Fix Ruby version parsing - especially for non-CRuby versions (changes by Chris Southerland Jr)
• Fix TemplateAliasProcessor#template_name arity (changes by viralpraxis)
• Reduce false positives when using shell escaping (changes)

8.0.3

• Add release age option for --ensure-latest (#1989)
• Fix polymorphic_name SQLi false positive (Fredrico Franco)
• Fix logger behavior when loading config files (#2009)
• Handle application names with module prefixes (#2011)

8.0.2

• Reline console control should use stderr
• Fix logger cleanup based method (Imran Iqbal)

8.0.1

• Fix for disappearing cursor when no warnings are reported

8.0.0

• Complete revamp of scan progress output and logging
• --skip-libs removed (#1839
• --index-libs removed
• Fix qualified constant lookup to respect module/class context (Mike Dalessio)
• Fix singleton method prefixes (viralpraxis)
• Faster file globbing for templates (Mikael Henriksson)
• No longer produce weak dynamic render path warnings
• Replace Erubis with Erubi (#1970)

Changelog

Sourced from brakeman's changelog.

8.1.0 - 2026-09-30

• Better help and error message for --ensure-latest
• Fix frozen string error (Shai Coleman)
• Update Sonar report format (fangxing)
• Fix frozen src string error
• Recognize Haml::AttributeBuilder.build_class as an escaped output (Yuriy Tumanov)
• Include regex code in validation warnings (Eliot Sykes)
• Check validation regexes in non-activerecord models (Eliot Sykes)
• Skip top-level vendor directory before recursive globbing (Conor O'Donnell)
• Support Rails 7.1+ positional enum syntax in SQL injection check (Michael Vogl/Yuriy Tumanov)

8.0.6 - 2026-08-13

• Fix EOL date for Rails 8.0 (yeaseul-kim)
• Add EOL dates for Rails 8.1 and Ruby 4.0
• Fix command injection false positives (Jacob Evelyn)
• Fix unused variable warning (viralpraxis)

8.0.5 - 2026-06-12

• Add quote_schema_name to safe quote method list (Zsolt Kozaroczy)
• Fix SQL injection false positive for compact_blank/compact on permitted params (Arpit Jain)
• Fix inline render false positive for local named text (Arpit Jain)
• Fix HAML crash on .raw calls (Federico Franco)
• Fix Ruby version parsing - especially for non-CRuby versions (Chris Southerland Jr)
• Fix TemplateAliasProcessor#template_name arity (viralpraxis)
• Reduce false positives when using shell escaping

8.0.4 - 2026-02-26

• Load 'date' library for --ensure-latest

8.0.3 - 2026-02-26

• Fix polymorphic_name SQLi false positive (Fredrico Franco)
• Fix logger behavior when loading config files
• Handle application names with module prefixes
• Add release age option for --ensure-latest

8.0.2 - 2026-02-03

• Reline console control should use stderr
• Fix logger cleanup based method (Imran Iqbal)

8.0.1 - 2026-01-29

• Make sure to reset the cursor even when exit code is 0

8.0.0 - 2026-01-29

... (truncated)

Commits

• c778164 Bump to 8.1.0
• 4621407 Update CHANGES
• 26ba01f Support Rails 7.1+ positional enum syntax in SQL injection check (#2051)
• 8f04922 Skip top-level vendor directory before recursive globbing (#2039)
• f921f01 Check validation regexes in non-activerecord models (#2053)
• d62e919 Fix CheckValidationRegex overly broad ignores (#2050)
• 73bbc99 Recognize Haml::AttributeBuilder.build_class as an escaped output (#2052)
• 71f8f69 Fix typo in test_format_validation_with_multiline (#2049)
• 0fd4dbc Add bundle install step to contributing doc (#2047)
• 5de415c Fix ERB frozen src error (#2048)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[developerz-ai]

Needs a human: dinndev2/adminer #37: a check keeps ending without a result and needs a look at CI.

A check on this pull request ended without a result on the code (GitHub cancelled it, marked it stale, or the job failed before running a single step) and a re-run did not settle it: it ended the same way again, GitHub refused the re-run (this installation has not accepted the app's Actions write permission, the run is too old to re-run, or the repo forbids it), the job's workflow run was still going past the CI wait ceiling, so GitHub would not re-run the job yet, or it is not a job the platform can re-run. Such a job never reported on the code, so no fix was attempted and nothing was split. Look at the CI configuration (a job timeout, a concurrency group, runner availability, the workflow permissions). If GitHub refused the re-run, re-run the job by hand or push a commit; if the job's workflow run was still going, the job is re-runnable once that run finishes, and a re-run by hand would be refused the same way.

🤖 Posted by developerz.ai — an automated agent, not a human.