[v1.62.0]
- Added
pattern_requirementschecks to rules, providing lightweight post-regex character-class validation without lookarounds. See docs/RULES.md for detail - Added an
ignore_if_containsoption topattern_requirementsto drop matches containing case-insensitive placeholder words, with tests covering the new behavior. - Updated rules to adopt the new
pattern_requirementssupport. - Added checksum comparisons to
pattern_requirements, newsuffix,crc32, andbase62Liquid filters, and verbose logging so mismatched checksums are skipped with context rather than reported as findings. - Split GitHub token detections into fine-grained/fixed-format variants and enforce checksum validation for modern GitHub token families (PAT, OAuth, App, refresh) while preserving legacy coverage.
- Added a rule for Zuplo tokens.
- Added checksum calculation for Confluent, GitHub, and Zuplo tokens, which can drastically reduce false positive reports.
- Improved OpsGenie validation.
- Automatically enable
--no-dedupwhen--manage-baselineis supplied so baseline management keeps every finding. - This release is focused on further improving detection accuracy, before even attempting to validate findings.
- Updated GitHub Actions CI for Windows and buildwin.bat script