Release
v2.7.0
pathfinderArgus can now fix vulnerable transitives by upgrading the direct dependency that brings them in, falling back to transitive overrides only when the parent upgrade cannot be proven.
Highlights
- 01
Direct parent upgrades
For vulnerable transitives, Argus trials same-major versions of the direct dependency on the path, re-scans the graph, and qualifies the candidate with mvn verify before replacing an override.
Read the guide → - 02
json-utils regression
A live Maven/OSV regression proves the customer-shaped json-utils 2.0.1 case now remediates by upgrading json-utils to 2.6.0 instead of pinning Jackson directly.
Full notes
Added
- Added the PARENT_UPGRADE remediation strategy for transitive vulnerabilities whose direct parent dependency has a newer same-major release that naturally resolves the vulnerable component to a safe version.
- Added REG-053, a live Maven Central and OSV regression covering io.gitlab.guisseppe:json-utils 2.0.1 -> 2.6.0 as the preferred maintainer-provided fix for vulnerable tools.jackson.core:jackson-databind 3.0.3.
Changed
- The transitive remediation ladder now tries proven direct parent upgrades before publishing OVERRIDE or EXCLUDE_ADD plans, while retaining the existing ladder as fallback when no candidate clears advisories and passes mvn verify.
- The GitLab CI/CD component exposes parent_upgrade, and ARGUS_PARENT_UPGRADE=off disables the new trial loop for teams that need classic transitive remediation only.