Reference
Roadmap
Argus is Maven-first by design, not by accident: Maven was the proving ground for a model meant to travel. Here is where the tool stands and where it is going.
Maven today
The Maven support is the whole tool, not a preview of one. It builds a real CycloneDX SBOM, matches every component against OSV.dev and any further advisory source you enable, plans fixes through a ranked strategy ladder, validates each patch against your build, and opens reconciled GitLab merge requests. All of it deterministic, all of it format-preserving. If you build with Maven, Argus is ready to run unattended in your pipeline now.
Known limitations
One boundary is worth stating plainly: Maven is the production-ready ecosystem today, npm support is early and still in development, and Gradle, PyPI and the rest are still on the roadmap. Multi-module Maven reactors have been fully supported since 2.12.0.
A portable model
Almost nothing about how Argus reasons is specific to Maven. A dependency graph with forward and reverse edges, a ranked ladder that distinguishes direct from transitive dependencies, an ecosystem-aware version ordering, byte-level edits that preserve a hand-maintained manifest, a qualification gate that proves a fix before publishing: these are general ideas. Maven is where they were built and hardened; the work of supporting another ecosystem is mostly teaching Argus a new manifest format and a new resolver, not rethinking the pipeline.
Other ecosystems
Support for further ecosystems is planned. The natural next steps are package managers that share Maven and npm’s shape: a lockfile or manifest, a resolvable transitive graph, an OSV ecosystem to match against. The order will follow where the model fits most cleanly and where the demand is.
What will not change
Whatever Argus learns to remediate next, the principles hold. Determinism: the same inputs always produce the same fix, so a run stays reviewable. Format preservation: Argus changes only the bytes it must and never editorialises over a file a human maintains. And a qualification gate before anything is published, because a fix that breaks the build is no fix at all. New ecosystems extend the reach of those guarantees; they do not relax them.