Release

v1.1.1

2026-06-06live anchor

Anchor upgrades are now the default path for transitive vulnerabilities, with CI logs captured automatically.

Download binary

Highlights

01
Anchor upgrades default on
Argus now tries a proven BOM, parent POM, or managed-dependency anchor upgrade before publishing a transitive override. Set ARGUS_ANCHOR_UPGRADE=off when you need the classic ladder only.
Read the guide →
02
Anchor logs captured in CI
The GitLab CI/CD component writes anchor-upgrade reasoning to anchor.log by default and uploads it with report.json and report.sarif.
Read the guide →
03
Strategy ladder docs explain anchors
The ladder docs now describe how imported BOMs, parent POMs, and managed dependencies are trialled, verified, and used as the cleaner fix before fallback.
Read the guide →

Anchor upgrades are now enabled by default. Set ARGUS_ANCHOR_UPGRADE=off to skip anchor trials and use only the classic BUMP / OVERRIDE / EXCLUDE+ADD ladder.
The GitLab CI/CD component now defaults to Argus 1.1.1, enables anchor_upgrade by default, writes anchor-upgrade reasoning to anchor.log, and uploads that log as a job artifact.
Updated the strategy ladder and anchor-upgrade documentation to explain how imported BOM, parent POM, and managed-dependency anchors are tried before falling back to the ladder.