mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-08-22 06:53:46 +09:00
Jeremy Daer
487125dc4c
* Bump brakeman to 8.0.6 Brakeman 8.0.6 shipped 2026-08-12: corrected Rails 8.0 EOL date, added Rails 8.1 and Ruby 4.0 EOL dates, and fixed command-injection false positives. brakeman's only runtime dependency is racc and its required ruby is >= 3.2.0, both unchanged since 7.1.2, so this is a version bump with no other movement in the graph. * Give brakeman's --ensure-latest a 15-day grace period Bare --ensure-latest exits 5 the moment a newer brakeman exists, so a release turns this build red before anyone has a chance to react. That is what happened on 2026-08-12 when 8.0.6 shipped. The flag takes an optional minimum age in days and only complains once the latest release is at least that old. 15 is the maximum it accepts; brakeman rejects anything outside 1-15. * Exempt brakeman from the dependabot cooldown The grace period on --ensure-latest is only headroom if the bump lands inside it. A weekly schedule plus a 7-day cooldown can take 14 days to so much as open the PR, leaving a single day to merge it. Excluding brakeman from the cooldown caps the delay at the weekly schedule, comfortably inside the 15 days.