Release
v2.9.0
clean handsArgus qualifies the whole set of fixes once before checking them one by one, stops trialling upgrades that provably cannot move a pinned dependency, and judges each advisory against the specific component it affects.
Highlights
- 01
Grand-slam-first qualification
When several fixes are pending, Argus qualifies the aggregate up front and, if it passes mvn verify, publishes one MR and skips the per-artifact verifies entirely — the biggest speedup on CPU-limited runners.
Read the guide → - 02
Pinned-target movement probe
Before trialling every candidate, Argus probes the newest one; if it cannot move a dependency pinned by dependencyManagement, an imported BOM, or a repackaged artifact, it abandons after one rescan and says so, instead of burning a Maven resolve per version.
- 03
Per-component advisory accuracy
A trial now clears a target only when the advisory no longer affects that specific component at its resolved version, so a CVE spanning jackson-core and jackson-databind is no longer misattributed.
Full notes
Added
- Added grand-slam-first qualification: the aggregate of all pending fixes is qualified once before any per-artifact verify, and per-artifact qualification runs only when the aggregate fails.
- Added a newest-candidate movement probe to the anchor and parent upgrade passes that abandons a hopeless upgrade after one rescan when the vulnerable target is pinned or managed elsewhere, with a diagnostic that names the pin.
- Added per-candidate trial diagnostics logging each target's resolved version and whether it changed.
Changed
- Trial advisory clearance is now judged per target component using IsAffectedVersion against the resolved version, replacing whole-graph advisory-ID presence and fixing multi-artifact CVE misattribution.
- Documented ARGUS_QUALIFICATION_CONCURRENCY tuning (-1 or the core count) for CPU-limited runners, where the default of 4 oversubscribes a 2-CPU runner.