CLI reference
argus curate
The housekeeping command. Over time, version overrides outlive the vulnerabilities that justified them. curate finds the pins that no longer change anything and reports them.
Synopsis
argus curate --pom pom.xmlWhy curation exists
When Argus fixes a transitive vulnerability, it pins a safe version in <dependencyManagement>. That pin is load-bearing for as long as the resolved graph would otherwise pull in the vulnerable version. But graphs move: a direct dependency gets upgraded, its own transitive set advances past the pinned version, and the override quietly becomes redundant: it now forces a version Maven would have resolved to anyway. Left unattended, these dead pins accumulate, and each one is a small lie about why it is there.
What it does
curate assesses the overrides Argus manages and reports those that are no longer pulling their weight. It reads the resolved graph, compares it against the versions your dependencyManagement forces, and identifies pins that have become no-ops. The command reports; it is the basis for the cleanup that run can act on.
Curation inside run
A full run performs this assessment automatically as part of reconciliation, so cleanup work is surfaced alongside new remediations. Pass --no-curate to run to skip it, and tune how cleanup-only outcomes are published with ARGUS_CLEANUP_ONLY_POLICY. See Merge requests and Environment variables.