[developerz-ai]

What

bin/brakeman injected --ensure-latest, so brakeman aborted before scanning
whenever upstream published a newer release: CI went red on a stale-but-valid
lock and the scan never ran. The lock is a resolution, not a constraint.

• bin/brakeman: drop the --ensure-latest injection, resolve the locked
  brakeman spec explicitly, report a newer upstream release on stderr at
  most (never fatal). Findings still fail the scan as before.
• .github/dependabot.yml: exempt the dev-tools group from the 14-day
  cooldown (cooldown.exclude on the bundler entry) so brakeman/rubocop pins
  move within days; rails and the other groups keep the cooldown.
• AGENTS.md, .dz/briefs/health.md: match the new cooldown behaviour.

Acceptance

• bin/brakeman no longer passes --ensure-latest: grep -n ensure-latest bin/brakeman returns nothing and bin/brakeman --no-pager exits 0 with the locked brakeman.
• The scan still runs and still fails on findings: bin/brakeman passes no --no-exit-on-warn / --exit-on-warn=false, so brakeman keeps its default exit-on-warn (Warnings_Found_Exit_Code on any warning).
• A newer upstream brakeman, when detected, is reported on stderr only and can never change the exit status of bin/brakeman.
• .github/workflows/ci.yml:64 still runs bin/brakeman --no-pager in the test job; that step is unchanged by this diff.
• Gemfile.lock and Gemfile are unchanged by this change (git status shows no modification to either).
• bin/rubocop bin/brakeman reports no offenses for the changed script.
• .github/dependabot.yml: the bundler entry keeps cooldown.default-days: 14 but adds cooldown.exclude listing the dev-tools group patterns ('rubocop*', 'brakeman', 'lefthook', 'rake*', 'benchmark-ips', 'capybara', 'faker', 'pry*'), so dev-tools bumps are proposed within days.
• The other dependabot entries (github-actions, devcontainers, docker), their 14-day cooldowns and the rails/other groups are byte-identical to before.
• AGENTS.md:124 and .dz/briefs/health.md:12 no longer claim that every Dependabot update waits out a 14-day cooldown.
• The dependabot file is still valid YAML: ruby -ryaml -e 'YAML.safe_load_file(".github/dependabot.yml", aliases: true)' exits 0.

Changes

• bin/brakeman (edit) — Drop the --ensure-latest injection (line 5): the scan must run against the brakeman locked in Gemfile.lock and never fail on version skew. Resolve the locked spec explicitly (Gem.loaded_specs['brakeman']) instead of Gem.bin_path, keep brakeman's default exit-on-warn so findings still fail, and report a newer upstream brakeman on stderr at most, never affecting the exit status. Comment why the flag must not come back.
• .github/dependabot.yml (edit) — On the bundler entry keep cooldown.default-days: 14 for everything else but exempt the dev-tools gems: add cooldown.exclude with the dev-tools group patterns ('rubocop*', 'brakeman', 'lefthook', 'rake*', 'benchmark-ips', 'capybara', 'faker', 'pry*') so their bumps are proposed within days, not two weeks. Dependabot has no per-group cooldown key, so exclude is the only lever. Update the header comment (line 9). Leave the other entries and the rails/other groups untouched.
• AGENTS.md (edit) — Line 124 (Maintenance model) claims Dependabot 'opens grouped weekly PRs after a 14-day cooldown'; that is no longer true for the dev-tools group. Reword that one cell so it matches the new .github/dependabot.yml (app dependencies wait 14 days, dev-tools are exempt). No other AGENTS.md change.
• .dz/briefs/health.md (edit) — Line 12's health check says 'updates wait a 14-day cooldown before they open'; only app dependencies do now. Adjust that parenthetical so the check matches .github/dependabot.yml. No other change in the file.
• spec/bin/brakeman_spec.rb (create) — [test] The rewritten bin/brakeman adds untested paths (locked-gem resolution bin/brakeman:20-26, skew branch bin/brakeman:41-44, offline fallback bin/brakeman:9-13, aborts bin/brakeman:22,25): no spec fails if one is deleted. Add spec/bin/brakeman_spec.rb (run the script as a subprocess, like spec/bin/setup_spec.rb) pinning: a newer upstream version (stub Gem.latest_spec_for) is reported on stderr and never changes the exit status (not 5); findings still exit non-zero (brakeman's warnings code 3) and no --no-exit-on-warn is passed; the running brakeman is the locked one; no ensure-la [trimmed]

Verification

./bin/check passed (exit 0) in 16s.

What the editors ran to see the change working, and what they saw:

• bin/rubocop bin/brakeman (brakeman): 1 file inspected, no offenses detected (exit 0)
• bin/brakeman --no-pager (brakeman): scan ran with the locked brakeman: 'Brakeman Version: 8.1.0', 'Checks Run: ...' 79 checks, 'Errors: 0', 'Security Warnings: 0'; process exit 0
• bin/brakeman --no-pager /tmp/bra_app (throwaway fixture: controller with 'render inline: params[:x]') (brakeman): 'Security Warnings: 1' and exit code 3 = brakeman's Warnings_Found_Exit_Code - findings still fail through bin/brakeman
• ruby /tmp/fake_newer_brakeman.rb --no-pager (wrapper that stubs Gem.latest_spec_for to 99.0.0, then loads bin/brakeman) (brakeman): stderr: 'brakeman 8.1.0 is behind the latest release 99.0.0 - the scan ran against the locked version.'; stdout carried the normal report; exit status still 0 - the notice cannot change it
• grep -n ensure-latest bin/brakeman ; grep -n exit-on-warn bin/brakeman (brakeman): both greps returned no match (exit 1) - no version-skew flag and no warning-flag override in the script
• ruby -ryaml -e 'YAML.safe_load_file(".github/dependabot.yml", aliases: true); puts "yaml ok"' (deps): exit 0, stdout "yaml ok" — the file is still valid YAML after the cooldown.exclude addition.
• ruby -ryaml -e 'c = YAML.safe_load_file(".github/dependabot.yml", aliases: true)["updates"]; c.each { |u| puts "#{u["package-ecosystem"]} #{u["directory"]}: cooldown=#{u["cooldown"].inspect} groups=#{u["groups"]&.keys.inspect}" }' (deps): bundler /: cooldown={"default-days" => 14, "exclude" => ["rubocop*", "brakeman", "lefthook", "rake*", "benchmark-ips", "capybara", "faker", "pry*"]} groups=["rails", "dev-tools", "other"]; github-actions /: cooldown={"default-days" => 14}; devcontainers /: cooldown={"default-days" => 14}; docker /.devcontainer: cooldown={"default-days" => 14} — the 14-day cooldown survives on every entry, only bundler gained the exclude list, and the rails/dev-tools/other groups are untouched.
• code_changes on .github/dependabot.yml, AGENTS.md, .dz/briefs/health.md (deps): Diff is exactly three hunks: the dependabot header comment + bundler cooldown.exclude block, the AGENTS.md:124 Dependencies table cell, the .dz/briefs/health.md:12 table cell. The github-actions/devcontainers/docker entries and the rails/other group stanzas are byte-identical to before.
• code_grep -i 'cooldown|14-day|14 days' across the repo (deps): Only three files mention the cooldown: .github/dependabot.yml, AGENTS.md:124, .dz/briefs/health.md:12 — all three are the files this brief assigned, so no doc statement of the 14-day rule was left stale.
• ruby -ryaml -e 'YAML.safe_load_file(".github/dependabot.yml", aliases: true); puts "yaml ok"' (deps): yaml ok (exit 0) — the dependabot config still parses; the new cooldown.exclude list is well-formed YAML
• +4 more

Notes

Premises of the request the team disproved:

• The request says the dev-tools group stanza 'currently' carries a 14-day cooldown. It does not: the 14 days live in the bundler entry's cooldown.default-days (.github/dependabot.yml:17-18); the dev-tools group stanza holds only patterns. Dependabot's schema has no per-group cooldown key (GitHub options reference: groups accept applies-to, dependency-type, exclude-patterns, group-by, [trimmed]
• The request describes the symptom as the CI test job failing on version skew. In brakeman v8.1.0 lib/brakeman/commandline.rb run, check_latest(options[:ensure_latest]) runs BEFORE run_report, so with bin/brakeman:5 injecting --ensure-latest today's CI exits with Not_Latest_Version_Exit_Code and the scan is skipped entirely - a skipped scan, not a red scan of the app.

Part 1/2 of goal rtk_610f3d7e29304704be95bf5a4ccd203f

• sebyx07/ruby2html (no PR yet)

---

🤖 Opened by developerz.ai for task tsk_93d2c3e141069c96fc92d97bdd9df20f on sebyx07/ruby2html.

Raised automatically by the raw_task_triage lane.

🤖 developerz.ai, an automated agent, not a human — this PR is one slice of a stacked plan.
Dispatched automatically by the raw_task_triage lane
Model MiniMax-M3 on router.ai.developerz.ai via native, funded by account_key
Ran on box sebastian-2
Cost unknown: no list price on record for MiniMax-M3 on router.ai.developerz.ai
Run timeline run_0e0a75ff930c4f11a97b13b87935127d
Part 1/2 of plan rtk_610f3d7e29304704be95bf5a4ccd203f

[github-actions]

Benchmarks: x86_64 (linux)

ruby 4.0.9 (2026-10-23 revision 3e93b23afc) +PRISM [x86_64-linux] · commit 979da44a33 · 2.0s per report
Δ is against main 4d589aa883 (same runner type; expect a few % noise).

escape_bench (C ext) · peak RSS 120 MB

Benchmark	i/s	ms / call	allocs / call	vs fastest	Δ vs main
escape_html short clean (10B)	735,163 ± 0.4%	0.0014	0.00	fastest	+4.2%
escape_html medium clean (200B)	398,737 ± 1.2%	0.0025	0.00	1.84x slower	-2.8%
append short clean (10B)	270,263 ± 0.4%	0.0037	0.02	2.72x slower	+7.5%
append short dirty (10B)	188,746 ± 1.4%	0.0053	0.00	3.89x slower	+1.3%
append medium clean (200B)	186,373 ± 0.6%	0.0054	0.00	3.94x slower	+8.8%
escape_html short dirty (10B)	129,142 ± 1.8%	0.0077	100	5.69x slower	-1.5%
append medium dirty (200B)	87,557 ± 0.3%	0.0114	0.00	8.40x slower	-4.2%
escape_html medium dirty (200B)	65,963 ± 2.2%	0.0152	100	11.15x slower	-10.1%
escape_html long clean (10KB)	14,828 ± 0.2%	0.0674	0.00	49.58x slower	-8.7%
append long clean (10KB)	12,402 ± 0.9%	0.0806	0.00	59.28x slower	+5.6%
append long dirty (10KB)	1,511 ± 0.2%	0.6619	0.00	486.58x slower	-0.2%
escape_html long dirty (10KB)	1,340 ± 5.0%	0.7465	100	548.79x slower	-7.4%

escape_bench (pure Ruby) · peak RSS 145 MB

Benchmark	i/s	ms / call	allocs / call	vs fastest	Δ vs main
escape_html short clean (10B)	204,478 ± 1.0%	0.0049	0.00	fastest	+1.5%
append short clean (10B)	148,865 ± 1.7%	0.0067	0.02	1.37x slower	-2.5%
escape_html short dirty (10B)	80,565 ± 1.1%	0.0124	100	2.54x slower	-10.1%
append short dirty (10B)	64,335 ± 1.6%	0.0155	100	3.18x slower	-5.8%
escape_html medium clean (200B)	59,933 ± 0.4%	0.0167	0.00	3.41x slower	+4.1%
append medium clean (200B)	51,299 ± 0.9%	0.0195	0.00	3.99x slower	+3.4%
escape_html medium dirty (200B)	21,639 ± 1.8%	0.0462	200	9.45x slower	-17.4%
append medium dirty (200B)	19,864 ± 6.0%	0.0503	200	10.29x slower	-16.5%
escape_html long clean (10KB)	1,671 ± 0.2%	0.5984	0.00	122.36x slower	+7.8%
append long clean (10KB)	1,605 ± 0.4%	0.6231	0.00	127.41x slower	+7.4%
escape_html long dirty (10KB)	1,015 ± 5.2%	0.9851	200	201.42x slower	-1.8%
append long dirty (10KB)	877 ± 2.5%	1.1397	200	233.04x slower	-5.6%

render_bench (C ext) · peak RSS 132 MB

Benchmark	i/s	ms / call	allocs / call	vs fastest	Δ vs main
erubi	7,977 ± 0.7%	0.1254	713	fastest	-7.4%
ruby2html	5,338 ± 1.3%	0.1874	419	1.49x slower	-5.7%
phlex	517 ± 4.1%	1.9349	6,374	15.43x slower	-0.9%

render_bench (pure Ruby) · peak RSS 132 MB

Benchmark	i/s	ms / call	allocs / call	vs fastest	Δ vs main
erubi	8,036 ± 1.4%	0.1244	713	fastest	-4.1%
ruby2html	2,185 ± 1.0%	0.4577	1,029	3.68x slower	-1.2%
phlex	521 ± 1.5%	1.9179	6,374	15.41x slower	-0.1%

tag_bench (C ext) · peak RSS 39 MB

Benchmark	i/s	ms / call	allocs / call	vs fastest	Δ vs main
br	259,993 ± 1.1%	0.0038	7.00	fastest	-4.5%
li(text)	168,383 ± 2.4%	0.0059	7.02	1.54x slower	-4.6%
li(dirty text)	141,716 ± 3.9%	0.0071	7.00	1.83x slower	-4.9%
div { block }	119,874 ± 0.9%	0.0083	7.00	2.17x slower	+3.3%
span(text, class:)	31,586 ± 3.1%	0.0317	207	8.23x slower	-2.7%
div(class:) { block }	30,122 ± 0.7%	0.0332	207	8.63x slower	+5.6%
a(text, href:, class:)	23,287 ± 1.8%	0.0429	207	11.16x slower	+0.1%

tag_bench (pure Ruby) · peak RSS 27 MB

Benchmark	i/s	ms / call	allocs / call	vs fastest	Δ vs main
br	100,657 ± 0.6%	0.0099	107	fastest	+0.7%
div { block }	81,210 ± 0.8%	0.0123	107	1.24x slower	+0.4%
li(text)	67,784 ± 1.6%	0.0148	107	1.48x slower	-7.0%
li(dirty text)	46,891 ± 1.5%	0.0213	207	2.15x slower	-8.8%
div(class:) { block }	14,280 ± 0.8%	0.0700	207	7.05x slower	+5.9%
span(text, class:)	13,841 ± 0.8%	0.0723	207	7.27x slower	-7.1%
a(text, href:, class:)	8,925 ± 3.4%	0.1120	207	11.28x slower	-7.0%

Rails request (C ext) · peak RSS 241 MB

Benchmark	i/s	ms / call	allocs / call	vs fastest	Δ vs main
Slim	569 ± 7.0%	1.7578	3,836	fastest	-0.7%
Ruby2html::Component	534 ± 2.4%	1.8710	4,136	1.06x slower	-3.8%
ruby2html .html.rb templates	507 ± 5.3%	1.9735	4,259	1.12x slower	-7.7%
ERB	486 ± 16.5%	2.0579	2,755	1.17x slower	-2.0%
ViewComponent + ruby2html	474 ± 5.5%	2.1095	3,993	1.20x slower	-6.4%
Phlex	449 ± 3.3%	2.2296	5,362	1.27x slower	-8.6%

[github-actions]

Benchmarks: aarch64 (linux)

ruby 4.0.9 (2026-10-23 revision 3e93b23afc) +PRISM [aarch64-linux] · commit 979da44a33 · 2.0s per report
Δ is against main 4d589aa883 (same runner type; expect a few % noise).

escape_bench (C ext) · peak RSS 118 MB

Benchmark	i/s	ms / call	allocs / call	vs fastest	Δ vs main
escape_html short clean (10B)	616,472 ± 0.2%	0.0016	0.00	fastest	+0.1%
escape_html medium clean (200B)	336,524 ± 0.3%	0.0030	0.00	1.83x slower	-0.6%
append short clean (10B)	208,474 ± 0.3%	0.0048	0.02	2.96x slower	-0.1%
append short dirty (10B)	160,373 ± 0.4%	0.0062	0.00	3.84x slower	-0.1%
append medium clean (200B)	147,070 ± 0.2%	0.0068	0.00	4.19x slower	-1.2%
escape_html short dirty (10B)	111,729 ± 0.3%	0.0090	100	5.52x slower	+0.7%
append medium dirty (200B)	73,651 ± 0.2%	0.0136	0.00	8.37x slower	-0.4%
escape_html medium dirty (200B)	59,082 ± 0.3%	0.0169	100	10.43x slower	+0.6%
escape_html long clean (10KB)	11,505 ± 0.2%	0.0869	0.00	53.58x slower	+0.2%
append long clean (10KB)	9,152 ± 0.3%	0.1093	0.00	67.36x slower	+1.3%
append long dirty (10KB)	1,207 ± 0.3%	0.8284	0.00	510.66x slower	+0.1%
escape_html long dirty (10KB)	1,151 ± 3.0%	0.8689	100	535.65x slower	+1.3%

escape_bench (pure Ruby) · peak RSS 150 MB

Benchmark	i/s	ms / call	allocs / call	vs fastest	Δ vs main
escape_html short clean (10B)	164,639 ± 0.2%	0.0061	0.00	fastest	+0.1%
append short clean (10B)	104,554 ± 0.2%	0.0096	0.02	1.57x slower	-0.0%
escape_html short dirty (10B)	70,087 ± 0.5%	0.0143	100	2.35x slower	+0.7%
append short dirty (10B)	58,172 ± 0.4%	0.0172	100	2.83x slower	+0.4%
escape_html medium clean (200B)	56,854 ± 0.2%	0.0176	0.00	2.90x slower	+0.1%
append medium clean (200B)	45,529 ± 0.2%	0.0220	0.00	3.62x slower	-0.3%
escape_html medium dirty (200B)	25,286 ± 0.3%	0.0395	200	6.51x slower	+1.2%
append medium dirty (200B)	22,586 ± 0.2%	0.0443	200	7.29x slower	+1.9%
escape_html long clean (10KB)	1,635 ± 0.2%	0.6116	0.00	100.70x slower	+0.1%
append long clean (10KB)	1,562 ± 0.4%	0.6400	0.00	105.38x slower	+0.3%
escape_html long dirty (10KB)	1,094 ± 0.5%	0.9137	200	150.43x slower	+0.8%
append long dirty (10KB)	974 ± 3.1%	1.0267	200	169.04x slower	+1.2%

render_bench (C ext) · peak RSS 131 MB

Benchmark	i/s	ms / call	allocs / call	vs fastest	Δ vs main
erubi	7,734 ± 0.4%	0.1293	713	fastest	+2.2%
ruby2html	5,891 ± 0.5%	0.1697	419	1.31x slower	+1.6%
phlex	577 ± 0.9%	1.7328	6,374	13.40x slower	+2.0%

render_bench (pure Ruby) · peak RSS 131 MB

Benchmark	i/s	ms / call	allocs / call	vs fastest	Δ vs main
erubi	7,728 ± 0.4%	0.1294	713	fastest	+1.7%
ruby2html	2,358 ± 0.7%	0.4240	1,029	3.28x slower	+0.5%
phlex	586 ± 1.2%	1.7070	6,374	13.19x slower	+2.5%

tag_bench (C ext) · peak RSS 39 MB

Benchmark	i/s	ms / call	allocs / call	vs fastest	Δ vs main
br	222,292 ± 0.8%	0.0045	7.00	fastest	+0.8%
li(text)	162,976 ± 1.0%	0.0061	7.02	1.36x slower	+2.0%
li(dirty text)	128,507 ± 0.7%	0.0078	7.00	1.73x slower	+2.4%
div { block }	100,583 ± 0.6%	0.0099	7.00	2.21x slower	+2.0%
span(text, class:)	30,977 ± 0.3%	0.0323	207	7.18x slower	-0.5%
div(class:) { block }	29,367 ± 0.4%	0.0341	207	7.57x slower	-0.9%
a(text, href:, class:)	23,755 ± 0.3%	0.0421	207	9.36x slower	+0.8%

tag_bench (pure Ruby) · peak RSS 26 MB

Benchmark	i/s	ms / call	allocs / call	vs fastest	Δ vs main
br	82,608 ± 1.2%	0.0121	107	fastest	-1.2%
div { block }	64,194 ± 0.5%	0.0156	107	1.29x slower	-0.1%
li(text)	54,901 ± 0.5%	0.0182	107	1.50x slower	-0.1%
li(dirty text)	41,809 ± 0.4%	0.0239	207	1.98x slower	-0.0%
div(class:) { block }	15,869 ± 0.3%	0.0630	207	5.21x slower	+1.0%
span(text, class:)	15,738 ± 0.2%	0.0635	207	5.25x slower	+0.3%
a(text, href:, class:)	9,948 ± 0.3%	0.1005	207	8.30x slower	+1.5%

Rails request (C ext) · peak RSS 250 MB

Benchmark	i/s	ms / call	allocs / call	vs fastest	Δ vs main
Ruby2html::Component	482 ± 2.5%	2.0746	4,496	fastest	+3.1%
ruby2html .html.rb templates	479 ± 3.1%	2.0890	4,631	1.01x slower	+3.4%
Slim	471 ± 5.9%	2.1229	4,172	1.02x slower	+1.3%
ViewComponent + ruby2html	450 ± 2.7%	2.2235	4,353	1.07x slower	+1.5%
Phlex	416 ± 1.7%	2.4035	5,862	1.16x slower	+2.4%
ERB	414 ± 15.5%	2.4155	2,975	1.16x slower	+0.8%

[developerz-ai]

✅ Reviewed — nothing blocking

0 actionable comment(s) · grounded on your code

_{⏱ 1m 06s wall clock · glm-5.3-flash via router · 2 model call(s) · 425 output token(s)}

_{🤖 developerz.ai — automated review, running on your model and your box.}

[developerz-ai]

Review summary — 5 file(s), 2 finding(s).

Critical 0 · Major 0 · Minor 2 · Nit 0

Rewrites bin/brakeman to run the locked brakeman (drops --ensure-latest, warns on stderr about upstream skew), exempts dev-tools gems from the Dependabot cooldown, updates two docs, and adds a subprocess spec.

• concern-tests: nothing to review — The added specs exercise each changed bin/brakeman branch and assert its observable contract through the same subprocess seam as production, including failure paths; the documentation and Dependabot changes have matching configuration and no untested behavioural change requiring another finding.

🤖 developerz.ai review — automated, running on your model and your box. What is this? · Reviewed by router/MiniMax-M3 — 77.9k in / 823 out over 3 calls, on your flat-rate plan: no per-token charge (~$0.02 at list price).

[developerz-ai]

Needs a human: sebyx07/ruby2html #25: checks are still failing and need you.

CI is still failing after the platform spent its whole self-fix budget on this pull request. The failure survived every attempt — it needs you.

🤖 Posted by developerz.ai — an automated agent, not a human.

[developerz-ai]

Address review findings on #25

• Picked up
• Surveying the repo
• Working
• Pull request opened — fix(ci): run the brakeman scan against the locked version #25
• Done

Work landed on #25 — watching it toward merge.

10m · 21 tool calls · 13 messages

Sessions: coding run · review 1

---

🤖 developerz.ai, an automated agent, not a human — sebastian-3 (developerz-ai[bot]) · model glm-5.3-flash on router.ai.developerz.ai

[developerz-ai]

Review summary — 2 file(s), 0 finding(s).

Makes the upstream-version lookup opt-in via RUBY2HTML_CHECK_LATEST and reads the locked version from the bundle; both address the prior review threads. CI still runs the default path, so no network round trip.

🤖 developerz.ai review — automated, running on your model and your box. What is this? · Reviewed by router/glm-5.3-flash — 40.8k in / 425 out over 2 calls, on your flat-rate plan: no per-token charge (~<$0.01 at list price).