v2.6.9

This release removes two false denials in standard mode: a PowerShell ForEach-Object or Where-Object pipeline is now parsed as PowerShell, and an inline script literal that the code only prints is treated as inert data.

Fixed

• Fixed auto shell detection so a ForEach-Object or Where-Object pipeline selects the PowerShell parser and its script block is read as PowerShell. A property reference such as $records | ForEach-Object { $_.key } is no longer denied as a *.key secret file, while a real read inside the block, such as ForEach-Object { Get-Content server.key }, is still blocked. (#239)
• Fixed standard mode to treat a string literal that inline Python or JavaScript code only prints as inert data, so python3 -c "print('credentials'); Path('report.md').read_text()" and node -e 'const path = ".env"; console.log(path); require("fs").readFileSync("README.md")' are allowed. A literal stays a candidate when its name is actually opened, and when print or console is rebound, redefined, or used as anything other than a display call. (#240)