Integration
Output formats
Argus speaks in three artefacts: a JSON report for tooling, a SARIF file for GitLab's security dashboard, and patch POMs that become merge requests.
Three artefacts
Each format serves a different consumer. The JSON report is for you and your own tooling: a complete, machine-readable record of what was found and how Argus plans to fix it. The SARIF file is for GitLab, which renders it on the security dashboard. The patch POMs are the fixes themselves, ready to be turned into merge requests. A scan produces the reports; a fix adds the patches.
JSON report
The report Argus writes to --report (report.json by default) has a stable envelope: a scan_time, a list of vulnerabilities, and, when remediations were planned, a list of remediations. Each vulnerability records its identifier, summary, severity, and the affected coordinates with their introduced and fixed versions. Each remediation records the strategy chosen, the version move, and whether it is breaking.
When more than the default advisory sources took part, each vulnerability also carries a sources list naming every database that reported it in precedence order, a fixed_version_source when sources disagreed on the fix, and the report gains a top-level advisory_sources block recording each source’s finding count, duration and any error. All three are omitted on a default OSV-only run, so existing consumers see the same document. See Advisory sources.
{
"scan_time": "2026-05-31T09:14:22Z",
"vulnerabilities": [
{
"id": "GHSA-xxxx-xxxx-xxxx",
"summary": "Deserialisation of untrusted data in commons-text",
"severity": "9.8",
"affected": [
{
"group_id": "org.apache.commons",
"artifact_id": "commons-text",
"introduced": "1.0",
"fixed": "1.10.0"
}
]
}
],
"remediations": [
{
"remediation_key": "commons-text-1.10.0",
"vulnerability_ids": ["GHSA-xxxx-xxxx-xxxx"],
"target_package": "org.apache.commons:commons-text",
"current_version": "1.9",
"fixed_version": "1.10.0",
"strategy_type": "BUMP",
"bump_type": "minor",
"is_breaking": false
}
]
}SARIF
Pass --sarif and Argus also emits a SARIF 2.1.0 document. Each advisory becomes a rule and a result, and every result is located against the line in your pom.xml where the affected dependency is declared, so GitLab’s security dashboard can point a reviewer at the exact place. The driver identifies itself as Argus, and each rule links back to the OSV advisory. A result whose advisory came from another source carries the ordered source list under an advisorySources property.
Patch POMs
The fix command writes one patched POM per remediation to --out (patches/ by default), named <remediation-key>.pom.xml. Each is a complete POM, not a diff: your original with the relevant byte-level edits spliced in. These are exactly what mr consumes to open merge requests.
patches/
├── commons-text-1.10.0.pom.xml
├── jackson-databind-2.15.0.pom.xml
└── struts2-core-2.5.33.pom.xml