Argus
Release ledger

Release

v1.0.0

panoptes

The first release of Argus — deterministic, format-preserving dependency remediation, starting with Maven.

Download binary
Linux · amd64Linux · arm64macOS · arm64
Diagnostic skillCI/CD componentHow to use the skill →

Highlights

  • 01

    One command, end to end

    argus run generates a CycloneDX SBOM, matches every component against OSV.dev, plans a fix, validates it with Maven, and opens a GitLab merge request.

    Read the guide →
  • 02

    The strategy ladder

    A fixed, ranked decision: BUMP a direct dependency, OVERRIDE a transitive one, or EXCLUDE and add when a parent POM hard-pins the version. Same inputs, same fix, every time.

    Read the guide →
  • 03

    Patches you can actually review

    Byte-level POM edits preserve every comment, indent, and element order, so a remediation diff is just the lines that had to change.

    Read the guide →
  • 04

    Download and go

    Prebuilt binaries for linux/amd64, linux/arm64, and darwin/arm64, named argus-<version>-<os>-<arch>. No compiling required.

    Read the guide →

Full notes

Added

  • Initial release of Argus, a deterministic, format-preserving dependency-remediation tool. Maven is the first supported ecosystem.
  • argus run — the end-to-end pipeline: generate a CycloneDX SBOM, match every component against OSV.dev, plan a fix, validate it with Maven, and open a GitLab merge request.
  • Deterministic strategy ladder — BUMP a direct dependency, OVERRIDE a transitive one through dependencyManagement, or EXCLUDE and add when a parent POM hard-pins the version.
  • Byte-level, format-preserving POM patching that leaves comments, indentation, and element ordering untouched, annotating every edit with a PATCH provenance comment.
  • Maven-native version selection using ComparableVersion ordering, never naive SemVer; pre-release versions are never selected automatically.
  • Qualification gate that validates each patched POM with Maven before publication, configurable via ARGUS_VALIDATION_STRATEGY (compile, test, or test-or-compile).
  • GitLab merge-request publication with severity labels, breaking-change signalling, grand-slam aggregation, a per-run publication budget, and reconciliation of stale Argus-owned merge requests.
  • offlimits.yaml policy file to exclude packages by glob and silence advisories with a recorded reason and expiry.
  • JSON and SARIF 2.1.0 reports, plus standalone patch POMs.
  • Development commands scan, fix, curate, and mr for inspecting individual pipeline stages.

Changed

  • Cross-compiled release binaries are published for linux/amd64, linux/arm64, and darwin/arm64, named argus-<version>-<os>-<arch>.

Security

  • Advisories are matched against the live OSV.dev database, and withdrawn advisories are dropped rather than remediated.