- There was a bug in
TaintTracking::localTaintandTaintTracking::localTaintStepsuch that they only tracked non-value-preserving flow steps. They have been fixed and now also include value-preserving steps. - Instantiations using
Faraday::Connection.neware now recognized as part ofFaradayHttpRequests, meaning they will be considered as sinks for queries such asrb/request-forgery. - Taint flow is now tracked through extension methods on
Hash,StringandObjectprovided byActiveSupport.