Release

v2.2.0

2026-06-22legible

Argus now attaches a polished, browserless PDF security report to every merge request and trims the long advisory list from the MR body.

Download binary

Highlights

01
Polished PDF security report
Opt-in ARGUS_PDF_REPORT attaches a multi-page PDF to each merge request — cover, executive summary with a severity chart, a per-finding 'what was found / how it was fixed' page with the dependency path, and a methodology closer — rendered browserlessly in the Argus site's design language. The same report covers Maven and npm.
Read the guide →
02
Build verification for governance
When the validation strategy ran tests, the PDF gains a Build verification section with a pass/fail summary and per-suite table — Maven surefire/failsafe or any JUnit an npm test script emits — so a governance gate can fast-track green Argus fixes to production.
Read the guide →
03
Per-finding advisory detail
Every finding page carries an advisory block — identifiers (CVE / GHSA / OSV), severity with the CVSS vector, the affected range, plus real-world risk: CISA KEV (known-exploited) membership with the EPSS probability, and whether the package is a direct or transitive dependency. All text is selectable and searchable, and long names wrap instead of truncating.
Read the guide →
04
Trimmed merge-request body
The verbose vulnerability-details list at the bottom of security and aggregate MRs is gone. The CVE links in the table at the top stay as the in-MR record, and the full advisory detail now lives in the attached PDF.

Opt-in polished PDF security report (ARGUS_PDF_REPORT, default off): a browserless, multi-page PDF attached to each merge request detailing every finding and how it was fixed, generated for both Maven and npm. With --no-publish a combined report.pdf is written to the output directory. PDF generation is best-effort and never blocks a remediation MR (ADR-030).
Per-finding advisory detail in the PDF: identifiers (CVE / GHSA / OSV aliases), severity with the CVSS vector, and the affected version range, laid out as definition rows beside justified prose. Report text is embedded as selectable, searchable text, and long test-suite names and repository paths wrap on their natural separators instead of truncating.
Exploitation and reachability signals on each finding: an Exploitation row flags CISA KEV (Known Exploited Vulnerabilities) membership and the EPSS probability/percentile, fetched best-effort from the CISA and FIRST.org feeds and cached like advisory data; a Reachability row marks whether the vulnerable package is a direct or transitive dependency and how deep. Rows are omitted when unknown and a feed failure never blocks the report. The feeds are on by default and can be disabled — keeping the report — with ARGUS_EXPLOIT_INTEL=off.
CI/CD component pdf_report input (default off), mapped to ARGUS_PDF_REPORT, so component users can enable the report.

The verbose 'Vulnerability details' list is removed from the bottom of security and aggregate merge requests (Maven and npm); the CVE links in the top table remain, and the full detail now lives in the attached PDF.