**Description of the false positive** ReDos Regex alert incorrectly flags on Ruby versions `> 3.2` <!-- Please explain briefly why you think it shouldn't be included. --> The docs acknowledge this, but scanning is not checking versions. https://codeql.github.com/codeql-query-help/ruby/rb-redos/ Ruby 3.2 is EOL in March. See investigation PR of fix for false positive: * https://github.com/dependabot/dependabot-core/pull/14012 CodeQL source: https://github.com/github/codeql/blob/main/ruby/ql/src/queries/security/cwe-1333/ReDoS.ql https://github.com/github/codeql/blob/main/ruby/ql/src/queries/security/cwe-1333/PolynomialReDoS.ql <!-- For open source code: file links with line numbers on GitHub, for example: https://github.com/github/codeql/blob/dc440aaee6695deb0d9676b87e06ea984e1b4ae5/javascript/ql/test/query-tests/Security/CWE-078/CommandInjection/exec-sh2.js#L10 For closed source code: (redacted) code samples that illustrate the problem, for example: ``` function execSh(command, options) { return cp.spawn(getShell(), ["-c", command], options) // <- command line injection }; ``` --> **URL to the alert on GitHub code scanning (optional)** https://github.com/dependabot/dependabot-core/runs/61390123956 <!-- 1. Open the project on GitHub.com. 2. Switch to the `Security` tab. 3. Browse to the alert that you would like to report. 4. Copy and paste the page URL here. -->