- Calls to methods generated by ActiveRecord associations are now recognised as
instantiations of ActiveRecord objects. This increases the sensitivity of
queries such as
rb/sql-injectionandrb/stored-xss. - Calls to
ActiveRecord::Base.createandActiveRecord::Base.updateare now recognised as write accesses. - Arguments to
Mime::Type#match?andMime::Type#=~are now recognised as regular expression sources.