{"record":{"id":"111dd64e7634fcf9","repo":"presidentbeef/brakeman","slug":"minimum-age-must-be-1-15-days","errorCode":null,"errorMessage":"Minimum age must be 1-15 days.","messagePattern":"Minimum age must be 1-15 days\\.","errorType":"exception","errorClass":"OptionParser::InvalidArgument","httpStatus":null,"severity":"error","filePath":"lib/brakeman/options.rb","lineNumber":68,"sourceCode":"        opts.on \"-p\", \"--path PATH\", \"Specify path to Rails application\" do |path|\n          options[:app_path] = path\n        end\n\n        opts.on \"-q\", \"--[no-]quiet\", \"Suppress informational messages\" do |quiet|\n          options[:quiet] = quiet\n        end\n\n        opts.on( \"-z\", \"--[no-]exit-on-warn\", \"Exit code is non-zero if warnings found (Default)\") do |exit_on_warn|\n          options[:exit_on_warn] = exit_on_warn\n        end\n\n        opts.on \"--[no-]exit-on-error\", \"Exit code is non-zero if errors raised (Default)\" do |exit_on_error|\n          options[:exit_on_error] = exit_on_error\n        end\n\n        opts.on \"--ensure-latest [DAYS]\", Integer, \"Fail when Brakeman is outdated. Optionally set minimum age in days (1-15).\" do |days|\n          if days and not (1..15).include? days\n            raise OptionParser::InvalidArgument, \"Minimum age must be 1-15 days.\"\n          end\n\n          options[:ensure_latest] = days || true\n        end\n\n        opts.on \"--ensure-ignore-notes\", \"Fail when an ignored warnings does not include a note\" do\n          options[:ensure_ignore_notes] = true\n        end\n\n        opts.on \"--ensure-no-obsolete-ignore-entries\", \"Fail when an obsolete ignore entry is found\" do\n          options[:ensure_no_obsolete_ignore_entries] = true\n        end\n\n        opts.on \"-3\", \"--rails3\", \"Force Rails 3 mode\" do\n          options[:rails3] = true\n        end\n\n        opts.on \"-4\", \"--rails4\", \"Force Rails 4 mode\" do","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/presidentbeef/brakeman/blob/649e678d0a46bda0e7c35874fa7af5d16e19b4f1/lib/brakeman/options.rb#L50-L86","documentation":"`--ensure-latest [DAYS]` makes a run fail when the installed Brakeman is deemed outdated; the optional integer argument sets the minimum age in days and is explicitly restricted to the range 1..15 by the option handler. Values outside that range raise `OptionParser::InvalidArgument` immediately during option parsing, before any scan starts.","triggerScenarios":"Running `brakeman --ensure-latest 30`, `--ensure-latest 0`, or any negative/`> 15` integer. The check only fires when a value is supplied — bare `--ensure-latest` (defaults to `true`) never triggers it.","commonSituations":"CI configs copied from examples suggesting larger windows (e.g. 30 days) that the option does not accept; teams trying to express 'only fail if brakeman is older than a month' and assuming an unbounded range; scripts templating the days value from another variable without clamping.","solutions":["Pick a value within 1-15, e.g. `brakeman --ensure-latest 7`.","If you wanted 'always require latest', just omit the value: `brakeman --ensure-latest`.","If a pipeline variable feeds the value, clamp it (`[[ $n -ge 1 && $n -le 15 ]] || n=15`) before passing it to the CLI."],"exampleFix":"# before\nbrakeman --ensure-latest 30   # => OptionParser::InvalidArgument: Minimum age must be 1-15 days.\n\n# after (window capped at the maximum allowed)\nbrakeman --ensure-latest 15","handlingStrategy":"validation","validationCode":"# Ruby, clamp before building the CLI args\ndays = Integer(env_value) rescue 1\ndays = [[days, 1].max, 15].min  # keep within 1..15\nsystem('brakeman', '--ensure-latest', days.to_s)","typeGuard":null,"tryCatchPattern":"begin\n  opts = Brakeman::Options.parse!([\"--ensure-latest\", arg])\nrescue OptionParser::InvalidArgument => e\n  warn \"#{e.message} — using the default (no minimum age).\"\n  opts = Brakeman::Options.parse!(['--ensure-latest'])\nend","preventionTips":["Remember the accepted window is exactly 1-15 days; larger policies are not expressible with this flag.","Bare `--ensure-latest` (no integer) is always valid and just requires the latest release.","Validate any templated/CI-provided day value against (1..15).include? before passing it through."],"tags":["brakeman","cli","option-validation","range-check","version-policy"],"backgroundTag":"option-value-out-of-range","analyzedSha":"649e678d0a46bda0e7c35874fa7af5d16e19b4f1","analyzedAt":"2026-08-21T18:43:10.938Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}