What's Changed
Features
- Restore custom taint map from cache; make taint analysis deterministic by @danog in #11946
- Add nosql taint type and mark MongoDB sinks by @danog in #11944
- Taint php://input & STDIN sources, and propagate taint through closures by @danog in #11945
Fixes
- [7.x] Fix taint-analysis crash on first-class callables by @alies-dev in #11950
- Update nikic/php-parser version to ^5.2.0 by @danielmorell in #11927
Internal changes
- Use upstreamed amphp/parallel ForkContext by @danog in #11947
- Resolve the taint graph to a fixed point with sink-reachability pruning by @danog in #11951
- Key taint argument nodes by declared parameter index (fix named-argument sinks) by @danog in #11954
Other changes
- Derive data-flow node locations & sink taints from storage (deterministic taint findings) by @danog in #11952
- Make DataFlowNode locations deterministic by construction (private constructor) by @danog in #11953
- Hoist specialized_calls serialization out of the per-edge taint-resolution loop by @danog in #11956
- Fix crash on first-class callables in taint analysis by @Portll in #11932
- Fix MissingOverrideAttribute false positive for private trait methods by @Eljees in #11926
New Contributors
- @Portll made their first contribution in #11932
- @danielmorell made their first contribution in #11927
- @Eljees made their first contribution in #11926
Full Changelog: 7.0.0-beta20...7.0.0-beta21