Release
v2.6.0
version-ceilingsArgus can now cap Maven remediations at configured maximum versions and surface any blocked advisory as explicit residual risk.
Highlights
- 01
Maven version ceilings
Declare ceilings.maven entries in config.yml to keep Argus inside a platform-approved version line while still applying the safest published upgrade available within the cap.
Read the guide → - 02
Residual risk in every report
Advisories that can only be cleared above a ceiling now appear in merge requests, report.json, and the PDF residual vulnerabilities section.
Full notes
Added
- Added Maven-only config.yml ceilings with inclusive max versions, ARGUS_CEILINGS, coupled-family BOM clamping, and capped best-effort remediation.
- Added residual vulnerability output to report.json and the PDF security report for ceiling-blocked advisories.
Changed
- Complication companion upgrades now honour configured ceilings and are skipped with a warning when the required companion version would exceed the cap.