presidentbeef/brakeman · error · OptionParser::InvalidArgument

Minimum age must be 1-15 days.

Error message

Minimum age must be 1-15 days.

What it means

`--ensure-latest [DAYS]` makes a run fail when the installed Brakeman is deemed outdated; the optional integer argument sets the minimum age in days and is explicitly restricted to the range 1..15 by the option handler. Values outside that range raise `OptionParser::InvalidArgument` immediately during option parsing, before any scan starts.

Source

Thrown at lib/brakeman/options.rb:68

        opts.on "-p", "--path PATH", "Specify path to Rails application" do |path|
          options[:app_path] = path
        end

        opts.on "-q", "--[no-]quiet", "Suppress informational messages" do |quiet|
          options[:quiet] = quiet
        end

        opts.on( "-z", "--[no-]exit-on-warn", "Exit code is non-zero if warnings found (Default)") do |exit_on_warn|
          options[:exit_on_warn] = exit_on_warn
        end

        opts.on "--[no-]exit-on-error", "Exit code is non-zero if errors raised (Default)" do |exit_on_error|
          options[:exit_on_error] = exit_on_error
        end

        opts.on "--ensure-latest [DAYS]", Integer, "Fail when Brakeman is outdated. Optionally set minimum age in days (1-15)." do |days|
          if days and not (1..15).include? days
            raise OptionParser::InvalidArgument, "Minimum age must be 1-15 days."
          end

          options[:ensure_latest] = days || true
        end

        opts.on "--ensure-ignore-notes", "Fail when an ignored warnings does not include a note" do
          options[:ensure_ignore_notes] = true
        end

        opts.on "--ensure-no-obsolete-ignore-entries", "Fail when an obsolete ignore entry is found" do
          options[:ensure_no_obsolete_ignore_entries] = true
        end

        opts.on "-3", "--rails3", "Force Rails 3 mode" do
          options[:rails3] = true
        end

        opts.on "-4", "--rails4", "Force Rails 4 mode" do

View on GitHub (pinned to 649e678d0a)

Solutions

1. Pick a value within 1-15, e.g. `brakeman --ensure-latest 7`.
2. If you wanted 'always require latest', just omit the value: `brakeman --ensure-latest`.
3. If a pipeline variable feeds the value, clamp it (`[[ $n -ge 1 && $n -le 15 ]] || n=15`) before passing it to the CLI.

Example fix

# before
brakeman --ensure-latest 30   # => OptionParser::InvalidArgument: Minimum age must be 1-15 days.

# after (window capped at the maximum allowed)
brakeman --ensure-latest 15

# Ruby, clamp before building the CLI args
days = Integer(env_value) rescue 1
days = [[days, 1].max, 15].min  # keep within 1..15
system('brakeman', '--ensure-latest', days.to_s)

begin
  opts = Brakeman::Options.parse!(["--ensure-latest", arg])
rescue OptionParser::InvalidArgument => e
  warn "#{e.message} — using the default (no minimum age)."
  opts = Brakeman::Options.parse!(['--ensure-latest'])
end

When it happens

Trigger: Running `brakeman --ensure-latest 30`, `--ensure-latest 0`, or any negative/`> 15` integer. The check only fires when a value is supplied — bare `--ensure-latest` (defaults to `true`) never triggers it.

Common situations: CI configs copied from examples suggesting larger windows (e.g. 30 days) that the option does not accept; teams trying to express 'only fail if brakeman is older than a month' and assuming an unbounded range; scripts templating the days value from another variable without clamping.

Related errors

• Invalid GitHub repository format
• Comparison file doesn't exist
• Cannot specify output format if multiple output files specif
• Could not find specified check#{missing.length > 1 ? 's' : '
• Invalid format options: #{invalid_options.inspect}

AI-assisted analysis of presidentbeef/brakeman@649e678d0a (2026-08-21). Data as JSON: /api/errors/111dd64e7634fcf9. Report an issue: GitHub.