Release
v2.5.0
lockstepArgus can now move companion libraries in lockstep with a remediation — a Maven-only `complications` policy for runtime couplings that mvn verify cannot catch.
Highlights
- 01
Maven complications: companion upgrades
Declare in config.yml that when Argus upgrades a trigger coordinate to at least a given version, certain companion libraries must move with it (minimum-version). Argus folds those bumps into the same merge request and qualifies them together — for runtime couplings mvn verify can't see, like a Spring Boot parent bump that also needs the spring-cloud BOM.
Read the guide →
Full notes
Added
- Maven-only
complicationssection in config.yml (ADR-032): when a remediation upgrades a trigger coordinate to >= a configured version, Argus also bumps the required companion libraries it lists, in the same MR, qualified together with mvn verify. Companions are minimum-version (never downgraded) and skipped when offlimits or already remediated by Argus; an absent companion is skipped by default or inserted as a new direct dependency with add_if_missing. The combined patch is re-scanned by the final pass so a vuln a companion introduces is detected and auto-fixed when possible. Surfaced in report.json, a 'Required companion upgrades' MR section, and the PDF report. Gated by ARGUS_COMPLICATIONS (default on) and the CI/CD componentcomplicationsinput.
Changed
- Residual-risk handling in the final pass (ADR-033): when the post-fix re-scan finds a vulnerability the ladder cannot fix in a build that passes mvn verify (e.g. one a required complications companion pulled in), Argus no longer fails the whole run. It publishes the already-qualified remediation and highlights the remaining vulnerabilities in a 'Residual vulnerabilities — review before merging' merge-request section, honouring cve_ignores. The published POM always passed mvn verify, so no broken build ships.