Release

v1.3.0

2026-06-07zoom and pan

The dependency graph in every merge request is now an interactive SVG you can zoom and pan, so large grand-slam remediations stay readable.

Download binary

Highlights

01
Interactive SVG dependency graph
Argus renders the SBOM dependency path as a self-contained SVG, uploads it to GitLab, and embeds it in the merge request. Reviewers zoom with the wheel and pan by dragging, with a layered layout and crossing reduction that keeps dense graphs legible.
Read the guide →
02
Mermaid fallback, never blocked
The Mermaid source stays in a collapsible block beneath the image, and when the SVG upload can't complete Argus falls back to the inline Mermaid graph automatically — the merge request is never blocked on the asset.
Read the guide →

Dependency graphs in merge request descriptions are now rendered as interactive SVGs uploaded to GitLab, enabling pan and zoom for large codebases. The Mermaid source is preserved in a collapsible <details> block as a fallback. When the SVG upload fails (e.g. insufficient permissions), Argus falls back to the inline Mermaid graph.

Updated the GitLab CI/CD component and documentation examples to default to Argus 1.3.0.

Fixed the final remediation pass failing with maven execution exited with status 1 on projects with a relative custom parent POM (for example a Spring PetClinic-style project importing spring-boot-dependencies and spring-cloud-dependencies BOMs). The pass ran its SBOM discovery against the candidate POM materialized under the output directory (patches/), where Maven cannot resolve <parent relativePath> or the repository configuration the parent provides, so model-building failed before any work — even though the same candidate had already passed mvn clean verify in the qualifier's project-tree workspace. Discovery now runs from the project directory, matching the first-pass behaviour.
CycloneDX BOM generation failures now include the tail of Maven's stdout (where Maven writes its [ERROR] and BUILD FAILURE diagnostics) in the error, instead of only stderr — so the root cause of a failed scan is visible rather than an empty exited with status N:.
Added regression coverage for the relative custom-parent shape that the existing suite missed: a deterministic unit guard asserting the final pass runs discovery in the project directory, a real-Maven maven_integration test proving a <parent> resolved by relativePath fails out-of-tree and resolves in-tree, and Docker regression scenario REG-030.