Argus
Release ledger

Release

v3.0.1

heirloom

a BOM whose version property lives in a custom parent POM is now a visible anchor, and a coupled family (Netty, Jackson) consolidates into one BOM import even when its members are hard-pinned by a carrier — no more per-module pins at mismatched versions. The MR table says so, presenting the BOM that actually lands instead of an arbitrary member.

Download binary
Linux · amd64Linux · arm64macOS · arm64
Diagnostic skillCI/CD componentGrafana dashboardsHow to use the skill →

Highlights

  • 01

    Parent-defined BOM properties are anchors

    The common enterprise shape — a custom parent defines spring-boot.version and the app imports spring-boot-dependencies with it — used to hide the anchor entirely, fragmenting a whole Boot-managed fix into per-leaf pins. Argus now resolves the property through the parent chain and, once the newer BOM verifies, declares a local property override in the app's properties block: the child outranks the parent, so one line moves the whole platform.

  • 02

    Hard-pinned family members join the family

    Members the ladder classified EXCLUDE+ADD used to bypass the family-BOM consolidation, fragmenting a Netty fix into ten exclusion+add pairs at mixed versions — a split core that breaks at runtime. All transitive members now move together through one BOM import at the family's maximum fix version.

  • 03

    The MR shows the consolidation

    A family fix used to render as a single arbitrary member row (netty-codec-classes-quic 4.2.12 → 4.2.15), hiding that the patch was a netty-bom import moving every module. The row now names the BOM and the module count.

  • 04

    Jackson 3 is a coupled family

    The tools.jackson.* line is now governed by tools.jackson:jackson-bom, matching the Jackson 2 and Netty treatment.

Full notes

Added

  • Stale cleanup reclaims a local property override once the parent chain defines an equal-or-newer value (fail-closed when unreadable).
  • Jackson 3 (tools.jackson.*) modelled as a built-in coupled family governed by tools.jackson:jackson-bom.

Changed

  • Anchor-log dead-end diagnostics dedupe to one line per distinct reason; unreadable carrier POMs during hard-pin detection are logged.

Fixed

  • A BOM imported with a version property defined in a parent POM is now discovered as an anchor: the property resolves through the parent chain, and the accepted upgrade declares a local property override.
  • Coupled-family members hard-pinned by a carrier (EXCLUDE_ADD) now consolidate into the family BOM import at one aligned version instead of fragmenting into per-member pins at mixed versions.
  • Aggregate MR rows for family plans present the BOM import (family name, module count) rather than an arbitrary member coordinate.
  • Unfixable plans always surface their advisories in the residual section — a coordinate with no safe published version no longer vanishes from the report.