Introduction
Vulnerability remediation that respects your pom.xml.
Argus is a deterministic, format-preserving dependency-remediation tool, starting with Maven. It finds vulnerable dependencies, works out the safest version to move to, edits your manifest without disturbing it, and raises the merge request for you.
Overview
Most dependency scanners are happy to tell you that you have a problem. Far fewer will fix it, and the ones that do tend to reformat your pom.xml in the process: collapsing comments, reflowing whitespace, and reordering elements until the diff is impossible to review. Argus takes a different line. It treats your POM as a text file to be edited surgically, not an object graph to be serialised, so the only thing that changes in a patch is the version you actually needed to change.
The name is deliberate. Argus Panoptes, the hundred-eyed giant of Greek myth, was set to watch and never sleep; no single eye ever closed for long. Argus the tool keeps the same kind of watch over your dependency graph: scanning on every run, planning fixes, validating them, and opening (or closing) merge requests so that the set of open remediation work always reflects what is actually outstanding. It is built for GitLab CI: drop it into a pipeline, point it at your project, and let it watch.
What Argus does
A single argus run carries a project from “unknown” to “merge request raised”:
- generates a CycloneDX SBOM for the project with Maven
- queries the OSV.dev database, plus any advisories you declare in config.yml, for advisories affecting the components it finds
- plans a fix for each advisory using the deterministic strategy ladder
- rewrites
pom.xmlwith byte-level edits that preserve formatting - validates the patched POM by running Maven against it
- publishes a GitLab merge request, and reconciles any of its own merge requests that are now stale
# A single run does the whole job
argus run \
--pom pom.xml \
--gitlab-url https://gitlab.example.com \
--project-id 4567Documentation
Quick start
Download the binary, point Argus at a project, and open your first remediation merge request.
ReadInstallation
Download a prebuilt binary for your platform and check what Argus needs on the PATH.
ReadHow Argus works
The full pipeline, from SBOM generation through to merge-request reconciliation.
ReadThe strategy ladder
How Argus decides between bumping, overriding, and excluding a vulnerable dependency.
ReadCLI reference
The run command end users need, plus the development commands behind it.
ReadConfiguration
The config.yml policy file, environment variables, and validation gates.
Read
Scope
Argus is designed as a multi-ecosystem remediation tool. The pipeline (resolve a dependency graph, match it against OSV, plan a fix on a ranked ladder, patch the manifest at the byte level, qualify the result, and publish) makes no assumptions that are unique to any one package manager. Maven is the mature, production-ready ecosystem today and the one we recommend. npm support exists but is early and still in development; see npm projects for what it covers and its current limitations.
Multi-module Maven reactors are fully supported: point --pom at the aggregator and Argus routes each fix to the POM that declares it, qualifies once at the reactor root, and opens one multi-file merge request. Mixed repositories with independent Maven and npm child projects are run project-by-project with scoped outputs.