Argus
Release ledger

Release

v2.3.0

herald

Argus can now append your own Markdown policy or comms to every merge request it opens, ships a faster and more reliable CI pipeline, and patches six HIGH dependency CVEs.

Download binary
Linux · amd64Linux · arm64macOS · arm64
Diagnostic skillCI/CD componentHow to use the skill →

Highlights

  • 01

    Injectable MR policy appendix

    Point ARGUS_MR_APPENDIX (or --mr-appendix) at a Markdown file and Argus appends it — below a horizontal rule — to the description of every merge request it opens: a policy notice, compliance statement, approvals checklist, or standing comms. Covers security/aggregate/single remediations (Maven and npm) and cleanup MRs.

    Read the guide →
  • 02

    Faster, more reliable CI

    The Go test and build jobs share a module + build cache, duplicate branch+MR pipelines are gone, and the ~30 regression jobs run on a prebuilt toolchain image instead of apt-installing 250 MB each run — removing the per-job download and the disk-full and Debian-mirror-GPG failures.

  • 03

    Security: x/net CVEs patched

    golang.org/x/net is bumped to 0.55.0, clearing six HIGH advisories (HTML/IDNA parsing) carried by the previous indirect dependency.

Full notes

Added

  • Merge-request policy appendix (ARGUS_MR_APPENDIX / --mr-appendix): a Markdown file whose contents Argus appends, below a horizontal rule, to the description of every merge request it opens — for a policy notice, compliance statement, or standing comms. Covers security/aggregate/single remediations (Maven and npm) and cleanup MRs; read once per run, best-effort, never blocks a remediation MR (ADR-031).
  • CI/CD component mr_appendix input (mapped to ARGUS_MR_APPENDIX), plus a previously-missing exploit_intel input (ARGUS_EXPLOIT_INTEL), so component users can inject an MR appendix and toggle the EPSS/KEV feeds. The component's argus_version default is bumped to 2.3.0.

Changed

  • Faster, more reliable CI: the Go test/build jobs share a module + build cache keyed on go.sum; workflow:rules stops duplicate branch+MR pipelines; and the ~30 regression jobs run on a prebuilt toolchain image (.gitlab/ci/Dockerfile) instead of apt-installing their toolchain each run, removing the per-job download and the disk-full and Debian-mirror-GPG failures. The image rebuilds only when the Dockerfile changes, on the default branch.

Security

  • Bumped golang.org/x/net to 0.55.0, clearing six HIGH advisories in 0.53.0 (CVE-2026-25680/25681/27136/39821/42502/42506 — HTML/IDNA parsing). A narrow, path-scoped .trivyignore.yaml suppresses only the run-as-non-root check on the CI build image.