Release
v3.5.0
foresightDeclared advisories: hand Argus a CVE your scanner flagged before OSV published it, and the whole engine acts on it — with OSV taking over automatically the moment it catches up.
Highlights
- 01
The gap it closes
A critical Tomcat advisory sat unreviewed upstream for six weeks, invisible to OSV and therefore to Argus, while GitLab dependency-scanning dashboards flagged it. A declare_advisories: entry in config.yml closes that window the same day.
- 02
Guarded against staleness
OSV supersedes a declaration per advisory id (alias-aware) as soon as it publishes; inert declarations say 'safe to delete' in the run output; expires: forces a review date; and declaring an advisory that ignore_advisories silences is refused at load.
- 03
Provenance everywhere
Report rows carry source: config, merge requests annotate '(declared in config.yml)' and link CVEs to NVD and GHSAs to GitHub, the PDF shows a provenance row, and the run summary counts active and superseded declarations.
Full notes
Added
- declare_advisories: config block (ADR-051), injected at every discovery site so planning, qualification, cleanup and the final pass all see identical advisories; reg-101 and reg-102 prove the lifecycle end to end.