Argus
Release ledger

Release

v1.2.0

final watch

Argus now performs a verified final remediation pass for publication and local artifacts, catching follow-on fixes before an MR or patch leaves the run.

Download binary
Linux · amd64Linux · arm64macOS · arm64
Diagnostic skillCI/CD componentHow to use the skill →

Highlights

  • 01

    Final remediation pass

    Selected MR candidates are treated as the new input POM, rescanned once, given any remaining cleanup or remediation, and verified with mvn clean verify before publication.

    Read the guide →
  • 02

    Local artifacts get the same safety pass

    argus run --no-publish now applies the final pass to generated local POMs too, so cleanup-only artifacts cannot expose a fixable transitive without the same run writing the follow-on fix.

    Read the guide →
  • 03

    Imported BOM and parent anchors covered

    The regression suite covers Spring Boot parent and spring-boot-dependencies BOM import scenarios, including multi-step upgrades and cleanup of redundant managed pins.

    Read the guide →

Full notes

Added

  • Added default-on ARGUS_FINAL_PASS. Set ARGUS_FINAL_PASS=off to preserve first-pass-only behaviour.
  • Added a bounded final pass that rescans the selected POM, reruns cleanup and strategy planning, writes a final-pass-*.pom.xml when additional work is found, and requires mvn clean verify before publication.
  • Added regression coverage for Spring Boot parent upgrades, spring-boot-dependencies BOM imports, multiple BOMs, test-scoped vulnerable transitives, and developer upgrades that leave Argus-authored overrides or exclusions behind.

Changed

  • argus run --no-publish now runs the final remediation pass against generated local POM artifacts and verifies the final local POM with mvn clean verify.
  • Final-pass cleanup removes redundant Argus-managed OVERRIDE and BUMP pins when an anchor or developer upgrade already resolves the vulnerability safely.

Fixed

  • Fixed cleanup-derived local artifacts so cleanup cannot expose a new fixable transitive vulnerability without the same run adding the follow-on remediation.
  • Fixed final-pass cleanup reporting for redundant managed pins after Spring Boot anchor upgrades such as 4.0.0 -> 4.0.3 -> 4.0.6.