Every watch, on record.

Thirty owls for every mood, and a rare golden owl for each mood that a project sees at most twice a year.

• 2 added
• 1 changed

Twenty-four owls for every mood instead of eight, and the headers ship as one small compressed file.

• 1 added
• 1 changed

Argus reads advisories from databases again, and only from databases. The GitLab vulnerability report source is removed: it described the project's current state, so an Argus fix erased the finding that justified it, and cleanup removed pins the next run had to put back. An advisory OSV has not mapped yet is declared in config.yml.

• 1 breaking changes
• 1 added
• 1 fixed
• 1 removed

A merge request may only name an advisory as fixed when the tree it produces no longer carries it. 3.8.0 checks every artifact as it will ship, publishes false claims as residual risk instead of fixes, and was compared project by project with the trusted 3.6.0 before release.

• 3 added
• 10 fixed

Hotfix for a wrong merge request seen on 3.7.2: an unrelated dependency was upgraded and credited with fixing advisories on a coordinate whose pin the same run had just released. The anchor movement probe now resolves the POM planning sees, so a released pin can no longer be mistaken for an anchor's effect.

• 1 added
• 1 fixed

Hotfix completing the 3.7.1 line. Discovery now holds the version-filtered invariant at the source boundary, so every reader of advisory data is covered, including override reclamation; cross-source fixed-version reconciliation works again for lines the sources describe differently; the GitLab report source retries transient failures; and a merge request produced with reduced coverage says so.

• 2 added
• 13 fixed

Hotfix for two 3.7.0 advisory-source defects. A dependency with parallel maintained release lines (Bouncy Castle FIPS) was collapsed onto a single fix, pushing a 1.x user onto a 2.x major upgrade instead of the in-line patch; fixes are now reconciled per line. And an upgrade that genuinely fixed a cohort no longer highlights the already-fixed advisories as residual risk on the merge request.

• 3 fixed

Advisory sources become a list you order: OSV by default, your own GitLab vulnerability report when you enable it, your declared advisories always, queried together and merged with provenance. A CVE your GitLab scanner shows becomes a merge request from that report. Plus the planner fix for an advisory with no published fix beside a fixable sibling.

• 4 added
• 1 changed
• 3 fixed

Discovery now shares one vantage point with the build — the parallax fixes — plus shell-aware --maven-args and the first run-scoped performance caches: several fewer SBOM builds per run, identical output.

• 1 changed
• 3 fixed

Declared advisories: hand Argus a CVE your scanner flagged before OSV published it, and the whole engine acts on it — with OSV taking over automatically the moment it catches up.

• 1 added

Log4j joins the built-in coupled families: a vulnerable log4j-api now ships as one log4j-bom import that moves log4j-core with it, instead of a lone pin that leaves the family skewed. Also fixes the 3.3.1 duplicated netty-bom imports and empty maintenance MRs.

• 1 added
• 2 fixed

Coupling floors now apply to Argus's own remediations: when the advisory fix lands below the floor you vetted, the fix moves to the floor — one coherent remediation instead of a resolve-manually warning.

• 3 fixed

A hotfix from first customer feedback: failure issues link the CI job that raised them and drop the boilerplate footer, and runs with couplings now leave a per-registry drift audit for diagnosing out-of-sync mirrors.

• 2 added
• 2 fixed

Failed runs now leave a visible record: one issue in your repository describing the latest failure, with the log, the affected dependencies and the dependency graph — while the job itself fails exactly as before. Also fixes three problems reported from customer merge requests: a merge request addressed to Argus's own staging file instead of your pom.xml, a still-needed BOM pin removed and re-added in one diff, and Jetty modules pinned individually at versions that cannot resolve together.

• 3 added
• 4 fixed

Upgrade from 3.2.0. That release shipped with a defect that turns Argus's own fixes into permanent fixtures, reachable by running Argus twice — an override it added is relabelled on the next upgrade, after which it can never be removed.

• 1 added
• 2 fixed

Argus removes its own past work once that work has stopped protecting anything. This release fixes how that decision is made: every rule was asking whether the platform had caught up to the version Argus pinned — a question about currency, which is Dependabot's job. Argus fixes vulnerabilities, so the question is now whether the advisory is still a problem without the edit.

• 3 added
• 1 changed
• 5 fixed

a hardening release. A second adversarial cross-examination of the codebase, plus a new check at the threshold of every run — the versions a coupling would write are proven against the registries before a single fix is planned — so a config typo or a subtle edge case is caught at the door rather than in a customer's build.

• 2 added
• 9 fixed

an audit release: six adversarial review fronts swept the planner, the byte editor, the GitLab client, and the day-2 loop, and every confirmed finding lands here with a regression test. What an MR claims to cover, what a clean run reconciles, and what a patch comment promises to reclaim now all match what actually shipped.

• 14 fixed

the platform moves with its whole retinue: an undeclared governing BOM is detected and imported as one proven line (GOVERNOR_IMPORT), and when a newer platform stops supplying a module the app compiles against, the build's own failure is used to prove and add the missing dependency (module companions) — so the upgrade ships instead of fragmenting into leaf pins. Around that, the release hardens the day-2 loop: shared-cache runners resolve correctly, stale merge requests reconcile even on partially-failed runs, and exclusions keep their carrier's scope.

• 4 added
• 1 changed
• 5 fixed

a BOM whose version property lives in a custom parent POM is now a visible anchor, and a coupled family (Netty, Jackson) consolidates into one BOM import even when its members are hard-pinned by a carrier — no more per-module pins at mismatched versions. The MR table says so, presenting the BOM that actually lands instead of an arbitrary member.

• 2 added
• 1 changed
• 4 fixed

Argus 3.0 replaces four overlapping config blocks with two — libraries and couplings — so a library's whole policy lives in one place. The new schema compiles down to the same proven engine, so a v3 config produces identical remediations to its 2.x equivalent. The startup error carries the full field map.

• 1 changed
• 2 fixed

Hotfix: an org-wide delegation entry for a library no longer freezes that library's own repository. The delegated coordinate is one of the repo's own modules, so Argus was delegating every vulnerability to itself and fixing nothing — precisely where the fixes must land.

• 1 fixed

Maven reactors, fully supported: point Argus at the aggregator and fixes are routed to the module POMs that declare them, qualified with one build at the reactor root, and published as a single multi-file merge request — with the same guarantees single-module projects have always had.

• 3 added

Hotfix: the qualification workspace copy no longer aborts when the project directory churns beneath it — a race that could silently downgrade every verdict to a publishable inconclusive, shipping fixes mvn never validated. Infrastructure-degraded verdicts now also surface as failure events in Grafana.

• 1 changed
• 1 fixed

Argus now exports OpenTelemetry metrics, logs and traces for every run — opt-in through environment variables, mirroring k6 — and ships a versioned Grafana dashboard suite with org → subgroup → project drill-down. Fleet health, remediation outcomes and exact failures, all without downloading job artifacts.

• 4 added
• 3 changed
• 1 fixed

Hotfix: anchor-upgrade merge requests now render the interactive dependency-graph SVG, by inheriting the SBOM paths of the transitive fixes they supersede.

• 1 fixed

A new top-level delegation block lets a curated internal library always own its vulnerable transitives, so Argus surfaces them as delegated residuals instead of pinning them at the application level — even when no platform upgrade is happening.

• 2 added

Hotfix: the direct-parent upgrade pass no longer trials a dependency whose version is supplied by an imported BOM, avoiding wasted rescans and misleading errors before it falls back to the ladder.

• 1 fixed

Argus qualifies the whole set of fixes once before checking them one by one, stops trialling upgrades that provably cannot move a pinned dependency, and judges each advisory against the specific component it affects.

• 3 added
• 2 changed

Argus keeps offlimits hard by default, but honours an explicit pact: a named platform owner may bump its own offlimits companion and take ownership of the vulnerable transitives on that companion's dependency path.

• 3 added
• 2 changed

Argus can now fix vulnerable transitives by upgrading the direct dependency that brings them in, falling back to transitive overrides only when the parent upgrade cannot be proven.

• 2 added
• 2 changed

Hotfix: Maven ceilings now also constrain anchor upgrades, preventing generated MRs from proposing BOM or parent versions above the configured cap.

• 2 changed
• 2 fixed

Argus can now cap Maven remediations at configured maximum versions and surface any blocked advisory as explicit residual risk.

• 2 added
• 1 changed

Hotfix: Argus generated POM comments now stay compact even when a remediation covers a long chain of vulnerability IDs.

• 1 changed
• 1 fixed

Hotfix: Argus now records selected package-version sources in diagnostics, keeps CI logs concise, and reuses aggregate remediation MRs across failed retries.

• 1 added
• 2 changed
• 2 fixed

Hotfix: Netty is now remediated as a coupled family — Argus emits a single netty-bom import at the highest required version instead of pinning modules to a mix that breaks at runtime.

• 1 changed
• 2 fixed

Argus can now move companion libraries in lockstep with a remediation — a Maven-only `complications` policy for runtime couplings that mvn verify cannot catch.

• 1 added
• 1 changed

Argus now confirms a remediation's fix version is actually published before opening a merge request, and upgrades tightly-coupled families (like Jackson) together so the fix builds and runs.

• 2 added
• 1 changed
• 1 fixed

Argus can now append your own Markdown policy or comms to every merge request it opens, ships a faster and more reliable CI pipeline, and patches six HIGH dependency CVEs.

• 2 added
• 1 changed
• 1 security

Argus now attaches a polished, browserless PDF security report to every merge request and trims the long advisory list from the MR body.

• 4 added
• 1 changed

Argus now prunes the stale branches it leaves behind and runs its cleanup consistently across Maven and npm.

• 2 added
• 1 changed

Argus now supports npm projects alongside Maven, with lockfile-aware scanning, npm-native remediation, and the same GitLab safety controls.

• 1 breaking changes
• 3 added
• 5 changed

Anchor-upgrade decisions are now fully transparent: anchor.log records every version Argus trialled and why it chose the one it did — not just the winner.

• 2 added
• 2 changed
• 1 security

Resolve Argus' secrets from AWS Secrets Manager using your pod's IAM identity — no secrets in environment variables — through a pluggable provider model.

• 3 added
• 1 changed

Merge-request titles now lead with the vulnerability, so security work gets a reviewer's attention at a glance.

• 3 changed

Redesigned, customer-facing merge requests — clear, scannable, and free of internal jargon — plus registry discovery diagnostics for multi-registry teams.

• 2 added
• 5 changed

Parallel POM qualification with cgroup-aware concurrency, cutting qualification wall time for large remediation runs on Kubernetes.

• 5 added
• 2 changed

Patch release fixing the final-pass native-cleanup probe for projects that pass a relative settings.xml via --maven-args.

• 1 changed
• 1 fixed

The dependency graph in every merge request is now an interactive SVG you can zoom and pan, so large grand-slam remediations stay readable.

• 1 added
• 1 changed
• 3 fixed

Argus now performs a verified final remediation pass for publication and local artifacts, catching follow-on fixes before an MR or patch leaves the run.

• 3 added
• 2 changed
• 2 fixed

Anchor upgrades are now the default path for transitive vulnerabilities, with CI logs captured automatically.

• 3 changed

Anchor upgrades: fix a transitive vulnerability by raising the BOM, parent, or managed library that governs it — re-scanned, mvn verify-gated, and discoverable straight from your registry.

• 4 added
• 3 changed
• 2 fixed

Reviewer-focused merge requests: version transitions, collapsed dependency graphs, mythic scan completion, and reconciled GitLab labels.

• 4 added
• 2 changed

Release publishing is repaired: the CI/CD component package uploads cleanly and the GitLab Release can publish binaries.

• 1 fixed

The first release of Argus — deterministic, format-preserving dependency remediation, starting with Maven.

• 10 added
• 1 changed
• 1 security