Release
v2.10.0
standing ordersA new top-level delegation block lets a curated internal library always own its vulnerable transitives, so Argus surfaces them as delegated residuals instead of pinning them at the application level — even when no platform upgrade is happening.
Highlights
- 01
Standing transitive delegation
Declare a companion owner under delegation.maven and Argus will never emit an app-level override for a coordinate reached only through it — it records a delegated residual for the owner to fix, on every run, with no complication trigger required.
Read the guide → - 02
Path-based ownership, unchanged safety
Ownership stays path-based: a vulnerable coordinate that also has a path avoiding every owner is still remediated (mixed-path safety), so standing delegation never silently drops a genuinely application-owned occurrence.
- 03
Pure suppression
Standing delegation only delegates — it never bumps the owner. Ensuring the owner sits at a compatible floor remains the job of a complications rule when the platform actually moves.
Full notes
Added
- Added a top-level delegation.maven block of standing owners that unconditionally own the vulnerable transitives on their SBOM path, so Argus suppresses app-level overrides for coordinates reached only through them and surfaces delegated residuals instead — independent of any complication trigger (ADR-041).
- Unified the two delegation sources (complication-scoped suppress_transitive_remediation and standing delegation owners) at the single suppression seam, so both the planning pass and the final remediation pass honour standing owners with no new logic.