Configuration

config.yml: libraries

One entry per coordinate, carrying its whole policy. In Argus 3.0 the libraries block replaces offlimits, ceilings, and delegation, so a library can no longer contradict itself across separate sections.

What it is for

The libraries block is where you tell Argus how to treat a specific coordinate. Anything you do not list is fully managed: Argus fixes third-party CVEs with every strategy available. You only add an entry to constrain that: freeze a first-party module, cap a library at an approved version, or hand a platform library’s transitives to the team that owns it. Everything Argus needs to know about a coordinate lives in one place.

YAML

# config.yml — Argus 3.0
version: 3

libraries:
  - match: "com.acme.*"              # every first-party library, frozen
    upgrade: never

  - match: "com.example:legacy-lib"  # cap at a platform-approved maximum
    upgrade: any
    max: "4.9.99"

  - match: "org.example:build-parent"
    upgrade: never
    internal_upgrades: true          # may still move as a parent/anchor

# config.yml — Argus 3.0
version: 3

libraries:
  - match: "com.acme.*"              # every first-party library, frozen
    upgrade: never

  - match: "com.example:legacy-lib"  # cap at a platform-approved maximum
    upgrade: any
    max: "4.9.99"

  - match: "org.example:build-parent"
    upgrade: never
    internal_upgrades: true          # may still move as a parent/anchor

Matching coordinates

match is an exact groupId:artifactId, a whole group groupId:*, or a group prefix ending .*(com.acme.* covers every group beneath the prefix). Artifact-only wildcards are not supported. Match on the group instead.

Property	Default	Description
`match` string	`—`	An exact `groupId:artifactId`, a whole group `groupId:`, or a group prefix `com.acme.`. Required.
`upgrade` enum	`any`	`never` (frozen), `any` (default, fully managed), or `coupled` (frozen except when a coupling moves it).
`max` string	`—`	An inclusive version ceiling. Only valid with `upgrade: any`.
`owner` string	`—`	The responsible team, shown in residual reports and merge-request copy.
`delegate_transitives` bool	`false`	Vulnerabilities reached only through this library become its owner’s residual, not an app-level pin. Requires `owner`.
`internal_upgrades` bool	`false`	A frozen artifact may still move as a parent/anchor to clear an otherwise-unfixable transitive.

The upgrade policy

upgrade: never is the old offlimits: Argus never changes the coordinate. upgrade: any (the default) leaves it fully managed, optionally capped by max. upgrade: coupled means the library is frozen on its own and moves only when a coupling names it. A coupled library that no coupling moves is a load error, so the two blocks cannot drift apart.

Ownership and delegation

A platform team often curates an internal library whose transitive stack they control. Set owner and delegate_transitives: true, and Argus stops emitting app-level pins for anything reached only through that library, recording a delegated residual attributed to the owning team instead.

YAML

libraries:
  - match: "com.acme.platform:telemetry-starter"
    owner: acme-platform-team        # named in reports and MR copy
    upgrade: coupled                 # frozen until a coupling moves it
    delegate_transitives: true       # its transitives are the owner's problem

libraries:
  - match: "com.acme.platform:telemetry-starter"
    owner: acme-platform-team        # named in reports and MR copy
    upgrade: coupled                 # frozen until a coupling moves it
    delegate_transitives: true       # its transitives are the owner's problem

Coming from 2.x

offlimits becomes upgrade: never; ceilings becomes max; delegation becomes owner + delegate_transitives. Behaviour is unchanged: the 3.0 schema compiles down to the same engine.