Release
v3.2.0
reclamationArgus removes its own past work once that work has stopped protecting anything. This release fixes how that decision is made: every rule was asking whether the platform had caught up to the version Argus pinned — a question about currency, which is Dependabot's job. Argus fixes vulnerabilities, so the question is now whether the advisory is still a problem without the edit.
Highlights
- 01
An override the platform settles below is no longer permanent
Argus pinned spring-kafka 3.2.4 for an advisory fixed in 3.1.0. A later Spring Boot upgrade made 3.2.1 the managed version and cleared the advisory outright — but the pin survived, because 3.2.1 is below 3.2.4 and that read as a downgrade. Nothing short of the platform overtaking the pin could ever have released it, and nothing surfaced the hold-back because the pinned version was itself safe. Releases are now decided by re-resolving the project without the edit and re-scanning it.
- 02
A withdrawn advisory no longer deletes a dependency
Where Argus changed the version on a dependency the project declares, the reclaim rules treated the whole element as Argus's own — so once the advisory was withdrawn, the next run removed the dependency and the build failed on the missing artifact. Edits that changed a value the developer already had are now marker-only: the stale comment goes and the version stands exactly as it was.
- 03
A merge request can never increase a project's vulnerability count
Curation is folded into whatever remediation patch a run produces, so a patch titled as a straight improvement could also drop a protective pin and introduce an advisory with no published fix — one advisory traded for another. Curation is now abandoned wholesale, and reported, whenever the cleaned project would gain an advisory nothing can fix. The unrelated fix still ships.
- 04
The report shows what was removed, not just what was added
Releases land in the same diff as fixes, and an unexplained deletion invites a revert that puts the redundant edit straight back. The PDF now carries an "Overrides released" section naming each released edit and the evidence for releasing it, distinguishing an edit removed from a comment removed.
Full notes
Added
- "Overrides released" section in the PDF report: each edit Argus released this run, the evidence for releasing it, and whether a version moved or only a comment was removed.
- ADR-050 recording the curation criterion, the additive/mutative split across the strategy ladder, and the stated limits of the safety guard.
- Regression coverage for each vector: a platform settling below a pin, the withdrawn-advisory deletion, the bundled net-effect case, and marker staleness on a real drifted Spring Boot POM.
Changed
- Releasing an edit can now lower a resolved version, returning the coordinate to what the project's own platform provides. Argus only ever releases lines it added itself, so a developer-owned line is never affected.
Fixed
- An override is released when the advisory it was written for is no longer a problem without it, rather than when the platform overtakes the pinned version. Property overrides reach that proof too; previously the "has the parent caught up?" test was the only way to release one.
- A PATCH marker over a value Argus only changed — a parent version, an anchor, an in-place bump — no longer causes the element to be deleted when its advisory is withdrawn.
- Curation is abandoned, and reported, when releasing an edit would introduce an advisory with no published fix, whether the patch is cleanup-only or bundled with an unrelated remediation.
- Markers over anchor and parent upgrades are released once they stop describing the version below them; previously the joined advisory reference meant no rule could ever match and the stale comment was re-emitted on every run.
- Property overrides are judged against the value the POM carries today, not the version their own comment asserts — which goes stale as soon as another tool edits the value.