Release
v2.0.0
two ecosystemsArgus now supports npm projects alongside Maven, with lockfile-aware scanning, npm-native remediation, and the same GitLab safety controls.
Highlights
- 01
npm projects are first-class
Argus parses package-lock.json v2/v3, queries OSV with ecosystem npm, plans lockfile-only refreshes, direct range bumps, and transitive overrides, then qualifies and publishes GitLab merge requests with npm-correct copy.
Read the guide → - 02
The remediation core is now ecosystem-aware
npm is a provider behind a shared ecosystem.Project seam, with a VersionScheme so Maven (ComparableVersion) and npm (semver) each order versions by their own rules. Shared controls — offlimits, severity labels, qualification evidence, idempotency, grand-slam, and MR reconciliation — stay consistent across both.
- 03
Mixed repositories can run safely
When a command root contains child Maven and npm projects, Argus scopes reports, patch directories, and branch prefixes by project directory to avoid cross-talk.
Full notes
Breaking changes
- The --offlimits flag is removed in favour of the unified --config. Move package/advisory policy into config.yml under offlimits.maven (and offlimits.npm). See ADR-026 and the CHANGELOG for the migration.
Added
- npm scan, planning, staging, qualification, and GitLab publication support for package-lock.json v2/v3 projects.
- npm stale override markers under argus.overrides, with cleanup re-proof before maintenance MR publication.
- ADR-024 documents the pluggable ecosystem provider model.
Changed
- Argus is no longer Maven-only in its architecture or documentation; Maven remediation behaviour is unchanged.
- Advisory matching and fixed-version selection are ecosystem-aware (Maven ComparableVersion vs npm semver), and npm advisories on the same package are consolidated into one remediation at the highest required fix.
- GitLab publication can commit multiple files atomically (package.json + package-lock.json for npm).
- npm distinguishes "unfixable" from publication failure (ADR-027): a remediation whose lockfile regeneration cannot move the resolved version (e.g. a vendored transitive a root override cannot reach) is reported as unfixable_shared_target and skipped instead of failing the run, matching Maven. Genuine qualification and operational failures still fail the run.
- Provenance comments are bounded (ADR-028): an anchor upgrade that clears many advisories inlines at most ARGUS_MAX_COMMENT_CVES ids (default 6) in the POM with a +N-more summary, keeping the full set in the MR and report.json. Stale-override detection is unaffected; npm's re-proof is now package-level.