Skip to content

Bump brakeman from 7.1.2 to 8.1.0 - #37

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/brakeman-8.1.0
Open

Bump brakeman from 7.1.2 to 8.1.0#37
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/brakeman-8.1.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown

Bumps brakeman from 7.1.2 to 8.1.0.

Release notes

Sourced from brakeman's releases.

8.1.0

  • Update SonarQube report to use generic issue format (@​fffx)
  • Include regex code in validation warnings (@​eliotsykes)
  • Check validation regexes in non-activerecord models (@​eliotsykes)
  • Skip top-level vendor directory before recursive globbing (@​ronocod)
  • Support Rails 7.1+ positional enum syntax in SQL injection check (@​cubasepp / @​Eljees)
  • Recognize Haml::AttributeBuilder.build_class as an escaped output (@​Eljees)
  • Fix frozen string error (@​shaicoleman)
  • Better help and error message for --ensure-latest (#2036)

8.0.6 - EOL Dates

8.0.5

8.0.3

  • Add release age option for --ensure-latest (#1989)
  • Fix polymorphic_name SQLi false positive (Fredrico Franco)
  • Fix logger behavior when loading config files (#2009)
  • Handle application names with module prefixes (#2011)

8.0.2

  • Reline console control should use stderr
  • Fix logger cleanup based method (Imran Iqbal)

8.0.1

  • Fix for disappearing cursor when no warnings are reported

8.0.0

  • Complete revamp of scan progress output and logging
  • --skip-libs removed (#1839
  • --index-libs removed
  • Fix qualified constant lookup to respect module/class context (Mike Dalessio)
  • Fix singleton method prefixes (viralpraxis)
  • Faster file globbing for templates (Mikael Henriksson)
  • No longer produce weak dynamic render path warnings
  • Replace Erubis with Erubi (#1970)
Changelog

Sourced from brakeman's changelog.

8.1.0 - 2026-09-30

  • Better help and error message for --ensure-latest
  • Fix frozen string error (Shai Coleman)
  • Update Sonar report format (fangxing)
  • Fix frozen src string error
  • Recognize Haml::AttributeBuilder.build_class as an escaped output (Yuriy Tumanov)
  • Include regex code in validation warnings (Eliot Sykes)
  • Check validation regexes in non-activerecord models (Eliot Sykes)
  • Skip top-level vendor directory before recursive globbing (Conor O'Donnell)
  • Support Rails 7.1+ positional enum syntax in SQL injection check (Michael Vogl/Yuriy Tumanov)

8.0.6 - 2026-08-13

  • Fix EOL date for Rails 8.0 (yeaseul-kim)
  • Add EOL dates for Rails 8.1 and Ruby 4.0
  • Fix command injection false positives (Jacob Evelyn)
  • Fix unused variable warning (viralpraxis)

8.0.5 - 2026-06-12

  • Add quote_schema_name to safe quote method list (Zsolt Kozaroczy)
  • Fix SQL injection false positive for compact_blank/compact on permitted params (Arpit Jain)
  • Fix inline render false positive for local named text (Arpit Jain)
  • Fix HAML crash on .raw calls (Federico Franco)
  • Fix Ruby version parsing - especially for non-CRuby versions (Chris Southerland Jr)
  • Fix TemplateAliasProcessor#template_name arity (viralpraxis)
  • Reduce false positives when using shell escaping

8.0.4 - 2026-02-26

  • Load 'date' library for --ensure-latest

8.0.3 - 2026-02-26

  • Fix polymorphic_name SQLi false positive (Fredrico Franco)
  • Fix logger behavior when loading config files
  • Handle application names with module prefixes
  • Add release age option for --ensure-latest

8.0.2 - 2026-02-03

  • Reline console control should use stderr
  • Fix logger cleanup based method (Imran Iqbal)

8.0.1 - 2026-01-29

  • Make sure to reset the cursor even when exit code is 0

8.0.0 - 2026-01-29

... (truncated)

Commits
  • c778164 Bump to 8.1.0
  • 4621407 Update CHANGES
  • 26ba01f Support Rails 7.1+ positional enum syntax in SQL injection check (#2051)
  • 8f04922 Skip top-level vendor directory before recursive globbing (#2039)
  • f921f01 Check validation regexes in non-activerecord models (#2053)
  • d62e919 Fix CheckValidationRegex overly broad ignores (#2050)
  • 73bbc99 Recognize Haml::AttributeBuilder.build_class as an escaped output (#2052)
  • 71f8f69 Fix typo in test_format_validation_with_multiline (#2049)
  • 0fd4dbc Add bundle install step to contributing doc (#2047)
  • 5de415c Fix ERB frozen src error (#2048)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump brakeman from 7.1.2 to 8.1.0
df7fd0b 
Bumps [brakeman](https://github.com/presidentbeef/brakeman) from 7.1.2 to 8.1.0.
- [Release notes](https://github.com/presidentbeef/brakeman/releases)
- [Changelog](https://github.com/presidentbeef/brakeman/blob/main/CHANGES.md)
- [Commits](presidentbeef/brakeman@v7.1.2...v8.1.0)

---
updated-dependencies:
- dependency-name: brakeman
  dependency-version: 8.1.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Nov 2, 2026
@developerz-ai

developerz-ai Bot commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown

Needs a human: dinndev2/adminer #37: a check keeps ending without a result and needs a look at CI.

A check on this pull request ended without a result on the code (GitHub cancelled it, marked it stale, or the job failed before running a single step) and a re-run did not settle it: it ended the same way again, GitHub refused the re-run (this installation has not accepted the app's Actions write permission, the run is too old to re-run, or the repo forbids it), the job's workflow run was still going past the CI wait ceiling, so GitHub would not re-run the job yet, or it is not a job the platform can re-run. Such a job never reported on the code, so no fix was attempted and nothing was split. Look at the CI configuration (a job timeout, a concurrency group, runner availability, the workflow permissions). If GitHub refused the re-run, re-run the job by hand or push a commit; if the job's workflow run was still going, the job is re-runnable once that run finishes, and a re-run by hand would be refused the same way.

🤖 Posted by developerz.ai — an automated agent, not a human.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants