Release
v2.6.1
ceiling-anchor-guardHotfix: Maven ceilings now also constrain anchor upgrades, preventing generated MRs from proposing BOM or parent versions above the configured cap.
Highlights
- 01
Ceilings cover anchor upgrades
Argus now applies ceilings.maven to imported BOM, parent POM, and managed-dependency anchor candidates before re-scan and verification.
Read the guide → - 02
Customer-shaped regression
REG-051 now covers the Spring Boot 4.0.5 to 4.0.7 ceiling scenario with Kafka and Avro, including the anchor-upgrade handoff that feeds report and MR output.
Full notes
Changed
- REG-051 now exercises a PetClinic-shaped Spring Boot/Kafka/Avro scenario through the customer-visible report path and fails if the generated remediation output advertises a Spring Boot BOM version above the ceiling.
- Anchor diagnostics now log when a configured ceiling is applied, so support evidence clearly shows capped anchor-candidate selection.
Fixed
- Fixed a ceiling bypass where the ladder planner respected a Maven ceiling, but the later ANCHOR_UPGRADE pass could replace that capped plan with an imported BOM, parent POM, or managed dependency above the configured maximum.
- Spring Boot platform ceilings such as org.springframework.boot:spring-boot-dependencies <= 4.0.7 are now enforced before anchor candidates such as 4.1.0 are re-scanned or verified.