Release ledger

Release

v3.2.1

provenance

Upgrade from 3.2.0. That release shipped with a defect that turns Argus's own fixes into permanent fixtures, reachable by running Argus twice — an override it added is relabelled on the next upgrade, after which it can never be removed.

Highlights

  • 01

    A re-bump no longer erases who owns an entry

    The strategy in an Argus annotation is the only record of who wrote the line beneath it: an override is Argus's own and may be removed later, a bump belongs to your team and must not be. 3.2.0 trusted that record but let a later upgrade overwrite it, so an entry Argus had added became indistinguishable from one you wrote — and permanent. The record now survives the upgrade while the advisory reference and version still move.

  • 02

    Entries an earlier version relabelled are repaired by hand, never guessed at

    Projects that ran 3.1.0 or 3.2.0 may already carry entries whose ownership record was overwritten. They cannot be recovered from the file — the rewrite left them identical to a pin your team wrote — so Argus never deletes them, and cleanup refuses to touch any managed entry it cannot prove it owns. Affected projects are being repaired directly; deleting the redundant entry lets the next run re-add it in a form that can be cleaned up automatically.

Full notes

Added

  • Regressions covering the release path end to end, each verified to fail without its fix.

Fixed

  • Upgrading an Argus-added dependencyManagement override preserves the strategy recorded in its annotation, so the entry stays recognisable as Argus's own and can still be released. Reported from a customer merge request.
  • An exclusion's annotation keeps its "(excluded from …)" clause and remediation id through an upgrade, which is what lets cleanup remove the pin and the carrier's exclusion together.