Release

v1.4.0

2026-06-07hundred eyes

Parallel POM qualification with cgroup-aware concurrency, cutting qualification wall time for large remediation runs on Kubernetes.

Download binary

Highlights

01
Parallel qualification — up to 4× faster
Candidate POMs are now qualified concurrently. On a run with 12 qualifying POMs and a test gate, wall time drops from ~9 minutes to ~3 minutes. The worker count defaults to 4 and is configurable per runner shape.
Read the guide →
02
Cgroup-aware concurrency for Kubernetes
Set ARGUS_QUALIFICATION_CONCURRENCY=-1 to let Argus auto-detect the pod's real CPU limit from the Linux cgroup quota — not the host node count that runtime.GOMAXPROCS would return. Powered by go.uber.org/automaxprocs.
Read the guide →
03
Parallel OSV advisory hydration
Advisory metadata is now fetched from OSV.dev through a bounded worker pool (default 8, ARGUS_OSV_CONCURRENCY), collapsing the previously-serial per-advisory fetch chain on a cold cache. Rate-limit handling is preserved per request.
Read the guide →
04
Dropped redundant mvn clean
The clean phase was removed from every qualification invocation. copyWorkspace already skips target/, so each workspace was already clean — the phase added JVM startup overhead with no benefit.
Read the guide →

Parallel POM qualification using a bounded goroutine pool. Worker count controlled by ARGUS_QUALIFICATION_CONCURRENCY (default 4). Qualification order is preserved so the priority set by the strategy ladder is respected.
ARGUS_QUALIFICATION_CONCURRENCY=-1 auto-detects the container's Linux cgroup CPU quota via go.uber.org/automaxprocs (v1.6.0). Recommended for Kubernetes runners where runtime.GOMAXPROCS reflects the host node's CPU count rather than the pod's CFS limit.
ADR-018 documents the parallel qualification architecture, the GOMAXPROCS pitfall in containerised environments, and the automaxprocs integration decision.
Parallel OSV advisory hydration via a bounded worker pool, controlled by ARGUS_OSV_CONCURRENCY (default 8). Results preserve input order and the existing 429 Retry-After backoff applies per request.
Process-level advisory memoization so later pipeline phases reuse a parsed OSV record without a repeat disk read or unmarshal. ADR-019 documents the hydration changes and why a content-hash SBOM cache was evaluated and rejected.

Dropped the clean phase from every mvn <phase> qualification invocation. copyWorkspace skips target/ so every workspace starts clean; the explicit clean was redundant overhead.
Updated the GitLab CI/CD component and documentation examples to default to Argus 1.4.0. The component now exposes a qualification_concurrency input that maps to ARGUS_QUALIFICATION_CONCURRENCY.