• Add --parser-timeout option
• Improve timeout error messages
• Check exec-type calls even if they are targets (#1199)
• Index Kernel#` calls even if they are targets (#1183)
• BaseCheck#include_interp? should return first string interpolation (#1189)
• Ignore Process.pid in system calls
• Warn about dangerous link_to href with sanitize() (#1187)
• Ignore params#to_h and params#to_hash in SQL checks (#1180)
• Convert Array#join to string interpolation (#1179)
• Change "".freeze to just "" (#1182)
• --color can be used to force color output (#1175)
• Track parent calls in call index
• Fix reported line numbers for CVE-2018-3741 and CVE-2018-8048
• Code Climate: omit leading dot from only_files (Todd Mazierski)