Release
v2.5.1
lockstep-nettyHotfix: Netty is now remediated as a coupled family — Argus emits a single netty-bom import at the highest required version instead of pinning modules to a mix that breaks at runtime.
Highlights
- 01
Netty moves in lockstep
Every io.netty module hard-depends on its siblings at the exact same version, so remediating each module to its own advisory fix version pinned the family at a mix (e.g. netty-handler 4.2.15 against netty-common 4.2.13) that splits the core and fails at runtime. Argus now recognises io.netty (governed by io.netty:netty-bom) as a coupled family and, when multiple members are remediated transitively, emits a single netty-bom import at the maximum fix version across them.
Read the guide →
Full notes
Changed
- Coupled-family remediation now coalesces: when several members of a family (e.g. Jackson, Netty) are remediated transitively and their advisories fix at different versions, Argus picks the maximum and emits one family-BOM import rather than per-module overrides. Single-member families are unchanged, and it falls back to a per-member override when the family BOM is not published at that version (ADR-034).
Fixed
- Netty is remediated as a coupled family; no more mixed module versions (ADR-034). Argus recognises io.netty (governed by io.netty:netty-bom) as a lockstep family and emits a single netty-bom import at the maximum fix version across the affected members, so the whole family stays on one release. Previously, per-module remediation could pin io.netty modules to different versions (e.g. netty-handler 4.2.15.Final against netty-common 4.2.13.Final), which splits the shared core and breaks at runtime.
- Maven qualification failures now leave shareable evidence (ADR-035). Argus writes patches/qualification/ with an index plus per-POM result.json, stdout, and stderr logs for source baseline, generated POM, aggregate, and final-pass qualification attempts. Withheld POM errors point to the matching evidence file so support can inspect the Maven failure after the temporary workspace is gone.