Release
v3.1.1
true-upan audit release: six adversarial review fronts swept the planner, the byte editor, the GitLab client, and the day-2 loop, and every confirmed finding lands here with a regression test. What an MR claims to cover, what a clean run reconciles, and what a patch comment promises to reclaim now all match what actually shipped.
Highlights
- 01
Coverage markers compare like with like
Aggregate MRs stamped package-qualified covers while single-fix MRs stamped bare CVE ids, so partial reconciliation could close an unrelated MR fixing the same CVE in a different package — or fail to supersede the one it should. Supersession is now keyed on (advisory, target package) in every MR shape, and only published, verified coverage counts.
- 02
Byte scanning is comment-aware everywhere
A commented-out dependencyManagement block or close tag used to fool the offset scans, producing silent non-fixes or edits landing inside the wrong element. Every tag scan now skips comments and CDATA — including stale cleanup's own.
- 03
Module companions follow the compile cascade
Maven fails fast at the first failing compile phase, so a candidate that moved packages out of both the main and test classpaths only names the main-scope package at first. The companion retry now re-diagnoses each failed build and accumulates companions across a bounded cascade instead of declining an upgrade a second companion would have qualified.
- 04
Governor imports pay their way out
The governing-BOM import's patch comment now embeds the advisories it covers, so the standing stale cleanup can reclaim the import once those fixes arrive natively. Cohort matching also got stricter where it should be (per-member rescan targets) and looser where it must be (semantic version compare, parent-chain properties).
Full notes
Fixed
- All findTagOffsets variants and sub-element scans skip comments and CDATA — no more silent non-fixes or wrong-element edits from commented-out POM blocks.
- Dependencies declared under a build <plugin> are no longer collected as project dependencies, so Argus never plans a fix for a coordinate the application doesn't ship.
- Coverage supersession is keyed on (advisory, target package) in both single-fix and aggregate MRs, and counts only published, verified coverage.
- A clean Maven run closes its obsolete MRs (matching npm), fail-closed: a degraded or throttled OSV re-resolve errors instead of mass-closing healthy MRs.
- Branch pruning keeps any branch with an open merge request, whatever its name shape.
- The GitLab client re-sends the request body when retrying after a transport error — no more empty-body 400s after a connection reset.
- A direct bump and a parent-upgrade side effect on the same coordinate consolidate into one plan at the higher version.
- Governor imports embed their covered advisories for stale-cleanup reclaim; rescan targets are per cohort member; cohort versions compare semantically; version properties resolve through the parent chain.
- A plan whose POM edit fails to render surfaces its advisories as residuals instead of vanishing from the report.
- Aggregate exclude+add rows inherit the carrier's scope, matching the single-MR path.
- The module-companion retry follows Maven's fail-fast phase cascade with a bounded round cap, diagnoses untruncated English build output, walks the anchor BOM's parent chain for managed versions, and classifies conventional integration-test roots as test scope.
- Unrecognised env toggle values (ARGUS_GOVERNORS=fasle) hard-error naming the bad value instead of silently falling back; an unset settings.xml env var falls back cleanly.
- The final remediation pass no longer double-counts: report rows are unique on (remediation unit, advisory, package) instead of repeating each shared local fix once per qualified artifact.
- A bundled PDF finding card is self-consistent: it headlines the bundle's most severe advisory and draws its summary, severity badge, and CVSS vector from that one advisory instead of mixing bundle members.