Release
v1.7.0
open verdictAnchor-upgrade decisions are now fully transparent: anchor.log records every version Argus trialled and why it chose the one it did — not just the winner.
Highlights
- 01
See every anchor candidate Argus tried
When Argus upgrades a parent POM or imported BOM, anchor.log now lists each version it trialled and what each resolved — so you can see, for instance, that bumping spring-boot-starter-parent from 4.0.6 considered 4.1.0 but chose 4.0.7, the smallest version that clears all the advisories.
Read the guide → - 02
Fallbacks explain themselves
When no candidate upgrade is accepted, the anchor now logs why it fell back to the override/exclude ladder, instead of going silent.
- 03
Branch names that read like the fix
Merge requests now open on vulnerability-led branches such as argus/security/cve-2022-25857-snakeyaml, with cleanup MRs under argus/maintenance/ — no internal strategy names. The footer also states whether the change is automated security remediation or dependency maintenance.
Read the guide →
Full notes
Added
- Anchor-upgrade decisions are now fully transparent in
anchor.log: the per-candidate trial log (which versions were tried and what each resolved —resolved N/N targets,resolved but introduced a new advisory,mvn verify failed,resolved + verified (accepted)) is emitted, not just the accepted version, and a fall-back-to-ladder decision now records its reason. Selection behaviour is unchanged — Argus still picks the smallest version that clears the most advisories; only its observability improved. - Updated the GitLab CI/CD component and documentation examples to default to Argus
1.7.0.
Changed
- Merge-request branch names are now vulnerability-led and strategy-agnostic: a single fix opens on
argus/security/<cve>-<artifact>, aggregates onargus/security/<cve>-plus-<n>-<hash>, and cleanup-only MRs onargus/maintenance/redundant-overrides-<date>. Theargusprefix /ARGUS_BRANCH_PREFIXand title-based idempotency are unchanged. - The MR footer now names the kind of change:
Produced by Argus vX — automated security remediation.for security/aggregate MRs, and… — automated dependency maintenance.for cleanup MRs (the version is retained).
Security
- The Argus binary is now built with Go 1.26.4 (
toolchain go1.26.4ingo.mod), clearing 18 Go standard-library advisories carried by the previous toolchain (12 HIGH, 6 MEDIUM) — html/template XSS, net/textproto and archive/tar DoS, and crypto/x509 VerifyHostname among them. Argus' own dependencies were already clean; verified with Trivy (0 findings post-fix). Also bumped the test-only GitLab mock harness Flask pin to 3.1.3 (CVE-2026-27205).