Argus
Release ledger

Release

v1.5.0

plain sight

Redesigned, customer-facing merge requests — clear, scannable, and free of internal jargon — plus registry discovery diagnostics for multi-registry teams.

Download binary
Linux · amd64Linux · arm64macOS · arm64
Diagnostic skillCI/CD componentHow to use the skill →

Highlights

  • 01

    Merge requests that read like a person wrote them

    Every MR now leads with one plain sentence and a compact facts table, states each fact once, and exposes no internal Argus reasoning — no strategy codes, Maven jargon, or qualification internals. Titles are cleaner too: "[Security] Update snakeyaml to 1.33 (CVE-2022-25857)".

    Read the guide →
  • 02

    Signed off by Argus

    Each merge request closes with a subtle "Produced by Argus vX" footer, so reviewers can see which tool and version opened it at a glance.

    Read the guide →
  • 03

    See exactly which registry served each lookup

    Registry version discovery now logs, per registry, whether the artifact was found and the actual versions returned — so teams running multiple registries can confirm each one is reachable and serving the coordinates they expect, and spot a misconfigured one immediately.

    Read the guide →

Full notes

Added

  • Per-registry, per-coordinate discovery logging: registry searched: versions found (registry id, metadata URL, sampled version list) or registry searched: artifact not present, plus a registry version discovery complete summary. Emitted at info to the default anchor.log; ARGUS_LOG_LEVEL=debug adds per-fetch URLs, retries, cache hits, and not-served skips. Credentials are never logged.
  • The GitLab CI/CD component now exposes an osv_concurrency input (mapping to ARGUS_OSV_CONCURRENCY) so component users can tune OSV advisory-hydration parallelism.

Changed

  • Redesigned merge-request titles and descriptions to be clear and scannable: one plain-language lead, a compact facts table, each fact stated once, and no internal reasoning (strategy names, Maven jargon, qualification enums, the raw mvn command, and the grand-slam/final-pass/grouped pipeline names are gone). Titles drop the internal word "bump". Rendered from Go text/template. See ADR-020.
  • Every merge request closes with a subtle attribution footer — Produced by Argus vX — automated dependency remediation.
  • Build-validation (qualification) evidence is no longer shown in the MR body; it is recorded in a trailing HTML comment for operator debugging only.
  • Merge-request dependency graphs are now SVG-only. The Mermaid block (and inline Mermaid fallback) is removed; when the SVG upload cannot complete, Argus falls back to a plain-text list of the transitive paths that renders identically in every Markdown viewer. The merge request is never blocked on the image.
  • Updated the GitLab CI/CD component and documentation examples to default to Argus 1.5.0.