- The hashing algorithms from
DigestandOpenSSL::Digestare now recognized and can be flagged by therb/weak-cryptographic-algorithmquery. - More sources of remote input arising from methods on
ActionDispatch::Requestare now recognized. - The response value returned by the
Faraday#run_requestmethod is now also considered a source of remote input. ActiveJob::Serializers.deserializeis considered to be a code execution sink.- Calls to
paramsinActionMailerclasses are now treated as sources of remote user input. - Taint flow through
ActionController::Parametersis tracked more accurately.