0.5.0

What's Changed

• Create java parser and example rule with test by @ericwb in #414
• Add more tests for java weak cipher rule by @ericwb in #415
• Add rule for weak hashes in java.security by @ericwb in #416
• Small refactor to parsers by @ericwb in #417
• Make Call class more generic for all supported languages by @ericwb in #418
• Add new Java rule to check for a weak key by @ericwb in #419
• Fix collison in rule wildcards by @ericwb in #420
• Create sub-symbol tables on class and method declaration by @ericwb in #421
• Add more symbol tables for other declarations by @ericwb in #422
• Go and Java docs should have similar headers as Python by @ericwb in #423
• Add rule for detection of weak random algorithm in SecureRandom by @ericwb in #424
• Don't break code with suggested fix by @ericwb in #425
• Weak hash and weak random Java rules need to guard from none by @ericwb in #426
• Handle method calls with field access by @ericwb in #427

Full Changelog: 0.4.6...0.5.0

0.4.6

What's Changed

• Resolve a call argument that is a call to its identifier by @ericwb in #412

Full Changelog: 0.4.5...0.4.6

0.4.5

What's Changed

• Add more detail to the --version output by @ericwb in #410
• Add extensions to the version output by @ericwb in #411

Full Changelog: 0.4.4...0.4.5

0.4.4

What's Changed

• Do update check only if git target or gist output by @ericwb in #401
• Add dependabot checks for PyPI packages by @ericwb in #402
• Add suggested fixes for the hashlib weak hash rule by @ericwb in #403
• Add suggested fixes for weak hashes in hmac function by @ericwb in #404
• Fix traceback from usage of importlib.import_module by @ericwb in #406
• Fix for IndexError in an expression list assignment by @ericwb in #408

Full Changelog: 0.4.3...0.4.4

0.4.3

What's Changed

• Rule to check for insufficient key size to HMAC by @ericwb in #390
• Small edit to hmac weak key doc by @ericwb in #391
• Fix for cases of a reassignment of a variable by @ericwb in #392
• Correct invalid examples for hmac timing attack by @ericwb in #393
• Add rule to check for improper random generator usage by @ericwb in #394
• Bump tree-sitter to version 0.21.3 by @ericwb in #395
• Check for no action passed in argparse rule by @ericwb in #396

Full Changelog: 0.4.2...0.4.3

0.4.2

What's Changed

• importlib.import_module also needs to handle string types by @ericwb in #389

Full Changelog: 0.4.1...0.4.2

0.4.1

What's Changed

• Embed the copyright as part of the package by @ericwb in #374
• Add --api_key checked in the CLI args by @ericwb in #375
• Check for api-key not api_key by @ericwb in #376
• Pin the dependencies in requirements.txt by @ericwb in #377
• Fix so preignore properly ignores tests by @ericwb in #378
• IgnoreFilterManager always requires relative path by @ericwb in #379
• Add ability to process a byte string value by @ericwb in #380
• Add md5-sha1 to list of hashlib algorithms by @ericwb in #383
• Ensure the tests import hashlib by @ericwb in #385
• Put tokens into a separate module by @ericwb in #386
• More progress indicators by @ericwb in #387
• Distinguish betwen strings and attributes by @ericwb in #388

Full Changelog: 0.4.0...0.4.1

0.4.0

What's Changed

• Refactor how rules are called to analyze by @ericwb in #373

Full Changelog: 0.3.14...0.4.0

0.3.14

What's Changed

• Keep SARIF output as minimal as possible by @ericwb in #333
• Create a code of conduct by @ericwb in #334
• Create a security policy by @ericwb in #335
• Bump softprops/action-gh-release from 1 to 2 by @dependabot in #336
• Add more details to README by @ericwb in #337
• Skip build for changes to README by @ericwb in #338
• Add new rule to check for no context being passed to FTP_TLS by @ericwb in #346
• Use guards instead of nested if conditionals by @ericwb in #347
• Add new rule to check for no context being passed to IMAP4_SSL by @ericwb in #348
• Reorganize the paths of the testcases and examples by @ericwb in #349
• Add new rule to check for context=None in nntp.starttls or NNTP_SSL by @ericwb in #350
• Add new rule to check for context=None in stls or POP3_SSL by @ericwb in #351
• Add new rule to check for context=None in smtp.starttls or SMTP_SSL by @ericwb in #352
• Add rule on argparse to check for an argument of password by @ericwb in #353
• Rename function to be more clear by @ericwb in #355
• Add new rule for secrets insufficient token length by @ericwb in #356
• Add secrets_weak_token to rules table by @ericwb in #357
• Change category name to insufficient_token_length by @ericwb in #358
• Refactor the docs by @ericwb in #359
• More consistent naming of docs by @ericwb in #360
• Add logo to README by @ericwb in #361
• Drop support of Windows by @ericwb in #363
• New rule for socket based unrestricted bind by @ericwb in #362
• Add rule for socketserver unrestricted bind by @ericwb in #364
• SocketServer doc needs example and refs for socketserver by @ericwb in #365
• Add new rule for http.server unrestricted bind by @ericwb in #366
• Nit: rename file for consistency by @ericwb in #367
• Add rule for xmlrpc.server unrestricted bind by @ericwb in #368
• Fix wrong examples in docstring of xmlrpc by @ericwb in #369
• Add new rule to detect regex denial-of-service patterns by @ericwb in #372

Full Changelog: 0.3.13...0.3.14

0.3.13

What's Changed

• Add security-severity property to sarif rules by @ericwb in #323
• Rename tool name to Precaution by @ericwb in #324
• Fix the schema version to not be the uri by @ericwb in #325
• security severity should be str not float by @ericwb in #326
• Switch docs to use mkdocs by @ericwb in #327
• Nit: use single ticks not double by @ericwb in #328
• Add rule descriptions to SARIF output by @ericwb in #329
• Better short and long rule descriptions by @ericwb in #330
• Add help text and markdown for rule by @ericwb in #331
• Clean up the description text for rules by @ericwb in #332

Full Changelog: 0.3.12...0.3.13