Release
v3.1.0
retinuethe platform moves with its whole retinue: an undeclared governing BOM is detected and imported as one proven line (GOVERNOR_IMPORT), and when a newer platform stops supplying a module the app compiles against, the build's own failure is used to prove and add the missing dependency (module companions) — so the upgrade ships instead of fragmenting into leaf pins. Around that, the release hardens the day-2 loop: shared-cache runners resolve correctly, stale merge requests reconcile even on partially-failed runs, and exclusions keep their carrier's scope.
Highlights
- 01
Governor imports, on by default
When several vulnerable transitives are governed by a BOM the project never declares — Spring Boot arriving through an internal starter — Argus imports that governing BOM into the project's own dependencyManagement at a proven newer version. Detection is evidence-only: the governor must be declared verbatim in a dependency's own POM chain, and every covered library must sit at exactly the version the governor dictates. One line moves the whole governed set.
- 02
Module companions
Platforms modularise between releases: a class the app compiles against moves into its own module and the starters stop supplying it, so every upgrade candidate fails compilation. Argus now reads the missing packages from the failed build, proves the providing module against the candidate BOM's own dependencyManagement — including a jar receipt — and retries once with the version-less dependency added. The merge request and the PDF report both explain exactly why the dependency appeared.
- 03
No more immortal merge requests
Two fixes end the stale-MR reports: the open-MR inventory now paginates (an MR older than the 20 most recent could never be matched or closed), and runs that publish some work but withhold the rest perform coverage-aware partial reconciliation — closing exactly the MRs whose every advisory is superseded by a newly published one.
- 04
Shared build caches resolve correctly
Direct POM reads — hard-pin detection, inherited-property anchors, governor receipts, stale cleanup — now honour the localRepository declared in the settings.xml passed with -s, matching Maven's own precedence. On runners with a relocated shared cache these passes previously read an empty ~/.m2 and silently degraded.
Full notes
Added
- GOVERNOR_IMPORT (ADR-047): receipt-and-cohort detection of an undeclared governing BOM, imported at a proven newer version; disable with detection.governors or ARGUS_GOVERNORS.
- Module companions (ADR-048): a failed platform-upgrade build names the packages the new version stopped supplying; the proven modules are added version-less in the same patch, with the rationale in the MR, the PDF report, and the PATCH comment. Disable with detection.module_companions or ARGUS_MODULE_COMPANIONS.
- Every merge request explains the PATCH-comment ledger: keep a comment with its change; when taking a fix over manually, delete both together.
- Merge requests carry an advisory-coverage marker powering partial reconciliation, and the run log records the reconciliation inventory.
Changed
- The configuration docs are v3-only: the 2.x block pages and the standalone migration guide are retired, and the startup error for legacy configs carries the field map inline.
Fixed
- Open-MR listings paginate, so reconciliation and duplicate detection see every managed merge request, not just the newest twenty.
- Partially-failed runs reconcile the merge requests they demonstrably superseded instead of skipping cleanup entirely.
- Direct POM reads follow the localRepository declared in the -s settings file (Maven's own precedence), fixing silent degradation on shared-cache runners.
- EXCLUDE+ADD inherits the carrier's declared scope, so a test-scoped carrier's transitive is not promoted onto the compile classpath.
- A transient registry failure during the family-BOM resolvability check keeps the single family import instead of fragmenting into per-member pins.