Argus
Release ledger

Release

v1.1.0

keystone

Anchor upgrades: fix a transitive vulnerability by raising the BOM, parent, or managed library that governs it — re-scanned, mvn verify-gated, and discoverable straight from your registry.

Download binary
Linux · amd64Linux · arm64macOS · arm64
Diagnostic skillCI/CD componentHow to use the skill →

Highlights

  • 01

    Upgrade the anchor, not just the symptom

    When a transitive CVE is governed by an imported BOM, a parent POM, or a managed dependency, Argus trials newer anchor releases, confirms the advisory clears with no new advisory, and qualifies the candidate with mvn verify — preferring one clean bump over many overrides.

    Read the guide →
  • 02

    Always verified, always a safety net

    Every upgrade is gated by mvn verify and falls back to the OVERRIDE / EXCLUDE-and-add ladder when no candidate both resolves and builds, so nothing ships unverified. Public anchors are eligible by default; internal ones opt in.

    Read the guide →
  • 03

    Discover versions from your registry

    A config.yml registries section — the Dependabot schema you already use — discovers anchor versions directly from Artifactory or Nexus over HTTPS with ${{ENV}} credentials, no Maven subprocess required.

    Read the guide →

Full notes

Added

  • Added the ANCHOR_UPGRADE remediation: resolve a transitive vulnerability by upgrading the managed version anchor that governs it — an imported BOM, a parent POM, or a managed dependency — instead of only overriding the symptom. Argus discovers newer anchor releases, re-scans to confirm the advisory clears with no new advisory, qualifies the candidate with mvn verify, and accepts the smallest version that both resolves and verifies. Gated by ARGUS_ANCHOR_UPGRADE (off by default).
  • Added a public-auto / internal-opt-in policy for anchor upgrades: public anchors are eligible by default, while internal or off-limits anchors opt in through a new internal_upgrades list in offlimits.yaml.
  • Added registry-based version discovery: a config.yml registries section (a Dependabot-compatible schema, selected with --config) discovers anchor versions directly from configured Maven repositories over HTTPS, with ${{ENV}} credential references resolved from the environment. It needs no Maven subprocess and discovers imported BOMs and parents like any other artifact.
  • Added a transparent per-dependency anchor-upgrade decision log — which anchor was tried, which candidates, the re-scan and mvn verify outcomes, and the final decision — redirectable to a file with ARGUS_ANCHOR_LOG.

Changed

  • Anchor-upgrade trials now evaluate every governed transitive from a single re-resolution and qualify the chosen candidate with a single mvn verify, rather than once per target — one anchor that fixes many advisories is tested once.
  • When no anchor upgrade both resolves and verifies, Argus falls back to the existing OVERRIDE / EXCLUDE-and-add ladder for that dependency, so nothing ships unverified.
  • Updated the GitLab CI/CD component and documentation examples to use Argus 1.1.0 by default.

Fixed

  • Fixed anchor-upgrade version discovery so imported BOMs (scope=import) and parent POMs are found — both are resolved away while Maven builds the effective model, so the project's dependency-updates report never lists them; discovery now falls back to a per-artifact probe (or the registry API).
  • Fixed the anchor-upgrade pass to run inside the unified argus run pipeline so the feature is reachable from the production command, not only the development sub-commands.