Release
v2.4.0
lodestarArgus now confirms a remediation's fix version is actually published before opening a merge request, and upgrades tightly-coupled families (like Jackson) together so the fix builds and runs.
Highlights
- 01
Resolvable-fix validation
Before emitting a patch, Argus checks the advisory's fix version against your configured repositories. If that exact version was never published (e.g. an advisory lists 2.21.5 but the registry jumps 2.21.4 → 2.22.0), Argus advances to the smallest published version that still clears the advisory instead of pinning a phantom version that can never build. When no safe published version exists, the finding is reported as needs-attention with a reason rather than a doomed patch.
Read the guide → - 02
Coupled families move together
Jackson and similar BOM-governed families must move in lockstep or they break at runtime. Argus now imports the family BOM (e.g. jackson-bom) at the fix version instead of pinning one member, so databind/core/annotations align and the patch actually qualifies — no config required.
Full notes
Added
- Built-in coupled-family remediation: some libraries are released in lockstep and governed by one BOM (Jackson first — com.fasterxml.jackson.* → com.fasterxml.jackson:jackson-bom). Overriding a single member while a BOM pins its siblings resolves but breaks at runtime (jackson-databind 2.22.0 against jackson-core 2.18.2 → NoClassDefFoundError on ObjectMapper). Argus now imports the family BOM at the fix version instead of pinning the leaf, moving the whole family together; it falls back to a single-member override when the BOM version is not published. No project configuration required (ADR-034).
- Cleanup reclaims redundant family BOM-import overrides: once another anchor (e.g. an upgraded spring-boot-dependencies) manages the family at or above the pinned version and the covered advisories are clean there, Argus removes its now-redundant import. Conservative by design — if the natural version can't be determined or a covered CVE is still active there, the override is kept, so cleanup never reintroduces a vulnerability (ADR-034).
Changed
- Fix-version selection is now registry-aware. When the advisory's fix version is unpublished, Argus advances to the smallest published version that is still safe for every affected coordinate sharing the edit (e.g. 2.21.5 → 2.22.0); when none exists it emits an unfixable plan carrying a human-readable reason. The check reuses the same configured-registry discovery as anchor-upgrade (ADR-015), so it is correct under egress restrictions, and degrades to prior behaviour if the registry is briefly unreachable, with the qualification gate as the backstop (ADR-034).
Fixed
- Remediation no longer pins a fix version that is not published to any configured repository. Previously, when an OSV/GHSA advisory's fixed boundary did not correspond to a released artifact, Argus wrote that phantom version into the POM; qualification then failed with 'Could not find artifact …' and the patch was withheld every run — a permanent dead-end for the finding (ADR-034).