What causes "invalid order records value - %s" in slimtoolkit/slim?

Use exactly one of: score-desc, score-asc, percentile-desc, percentile-asc.

invalid order records value - %s

Error message

invalid order records value - %s

What it means

The 'vulnerability epss' command validates the optional --filter-order-records flag in EpssCommandFlagValues (pkg/app/master/command/vulnerability/cli.go:121). When the flag is non-empty it must match one of score-desc, score-asc, percentile-desc, or percentile-asc; otherwise IsValidOrderRecordsValue returns false and the CLI returns "invalid order records value - %s". Unlike the op flag, an empty value is accepted (meaning no ordering).

Source

Thrown at pkg/app/master/command/vulnerability/cli.go:121

		Op:                   ctx.String(FlagOp),
		WithHistory:          ctx.Bool(FlagWithHistory),
		Limit:                ctx.Uint64(FlagLimit),
		Offset:               ctx.Uint64(FlagOffset),
		FilterCveIDPattern:   ctx.String(FlagFilterCveIDPattern),
		FilterDaysSinceAdded: ctx.Uint(FlagFilterDaysSinceAdded),
		FilterScoreGt:        ctx.Float64(FlagFilterScoreGt),
		FilterScoreLt:        ctx.Float64(FlagFilterScoreLt),
		FilterPercentileGt:   ctx.Float64(FlagFilterPercentileGt),
		FilterPercentileLt:   ctx.Float64(FlagFilterPercentileLt),
	}

	if !IsValidOp(values.Op) {
		return nil, fmt.Errorf("invalid operation - %s", values.Op)
	}

	if orderStr := ctx.String(FlagFilterOrderRecords); orderStr != "" {
		if !IsValidOrderRecordsValue(orderStr) {
			return nil, fmt.Errorf("invalid order records value - %s", orderStr)
		}

		values.FilterOrderRecords = OrderType(orderStr)
	}

	if dateStr := ctx.String(FlagDate); dateStr != "" {
		date, err := epss.DateFromString(dateStr)
		if err != nil {
			return nil, err
		}

		values.Date = date
	}

	return values, nil
}

var CLI = &cli.Command{

View on GitHub (pinned to 81940d17fa)

Solutions

Use exactly one of: score-desc, score-asc, percentile-desc, percentile-asc.
Make sure the value is lowercase — matching is a plain string comparison, not case-insensitive.
If you don't need ordering, omit the flag entirely (empty is valid).
Run 'slim vulnerability epss --help' to confirm accepted values for your installed version.

Example fix

// before
slim vulnerability epss --op=list --filter-order-records=Score-Desc
// after
slim vulnerability epss --op=list --filter-order-records=score-desc

Defensive patterns

Strategy: validation

Validate before calling

var validOrders = map[string]bool{
    "score-desc": true, "score-asc": true,
    "percentile-desc": true, "percentile-asc": true,
}
if o := ctx.String("filter-order-records"); o != "" && !validOrders[o] {
    return fmt.Errorf("unsupported --filter-order-records %q", o)
}

Type guard

func isValidOrder(o string) bool {
    switch o {
    case "score-desc", "score-asc", "percentile-desc", "percentile-asc":
        return true
    }
    return false
}

Try / catch

params, err := vulnerability.EpssCommandFlagValues(ctx)
if err != nil {
    if strings.HasPrefix(err.Error(), "invalid order records value") {
        fmt.Fprintf(os.Stderr, "--filter-order-records must be score-desc|score-asc|percentile-desc|percentile-asc\n")
        os.Exit(2)
    }
    return err
}

Prevention

Use the exact lowercase constants (score-desc, etc.) — matching is case-sensitive.
Omit the flag when no ordering is needed rather than passing a guess value.
Wrap CLI invocations in helper functions that expose typed order enums.
Validate flag values in wrapper scripts before exec'ing the CLI.

When it happens

Trigger: Running 'slim vulnerability epss' with --filter-order-records set to a non-empty string that is not one of the four accepted order values (e.g. --filter-order-records=score, --filter-order-records=Score-Desc, --filter-order-records=desc).

Common situations: Case mismatch (uppercase letters); abbreviated ordering names like 'score' instead of 'score-desc'; shell scripts carrying values from an older CLI syntax; confusing this flag's underscore/dash naming with other filter flags.

Related errors

AI-assisted analysis of slimtoolkit/slim@81940d17fa (2026-08-31). Data as JSON: /api/errors/3c4f560ce82ccae1. Report an issue: GitHub.