Release
v2.8.0
sentinel pactArgus keeps offlimits hard by default, but honours an explicit pact: a named platform owner may bump its own offlimits companion and take ownership of the vulnerable transitives on that companion's dependency path.
Highlights
- 01
Complication-owned offlimits
A single complication requirement can opt into allow_offlimits to bump an otherwise offlimits companion when a platform upgrade fires, without weakening offlimits for anything else. Ceilings still win.
Read the guide → - 02
Delegated transitive remediation
With suppress_transitive_remediation, vulnerable transitives reached only through an owned companion are delegated to its owner instead of getting app-level overrides, and surfaced as delegated residuals in report.json, the MR, and the PDF.
Full notes
Added
- Added complication-owned offlimits: allow_offlimits lets exactly one complication requirement bump an otherwise offlimits companion, with ceilings taking precedence and traditional offlimits unchanged for everyone else.
- Added delegated transitive remediation: suppress_transitive_remediation delegates vulnerable transitives reached through an owned companion's SBOM path to the companion owner, using path-based ownership so unrelated paths are still fixed.
- Added delegated residuals to report.json (reason delegated_to_offlimits_companion plus owner), the merge request description, and the PDF, so suppressed transitives are always surfaced and never dropped.
Changed
- suppress_transitive_remediation now requires allow_offlimits, and conflicting ownership flags for the same companion coordinate across rules are rejected, keeping delegated suppression deterministic and auditable.
- The final remediation pass re-applies the delegated policy against the accepted patch, so a suppressed transitive override cannot be reintroduced and a delegated residual clears once the companion bump no longer brings the vulnerable core.