Argus
Release ledger

Release

v3.7.0

confluence

Advisory sources become a list you order: OSV by default, your own GitLab vulnerability report when you enable it, your declared advisories always, queried together and merged with provenance. A CVE your GitLab scanner shows becomes a merge request from that report. Plus the planner fix for an advisory with no published fix beside a fixable sibling.

Download binary
Linux · amd64Linux · arm64macOS · arm64
Diagnostic skillCI/CD componentGrafana dashboardsHow to use the skill →

Highlights

  • 01

    Read the CVEs your GitLab scanner already shows

    Add advisory_sources: [osv, gitlab] to config.yml and Argus reads the project's Dependency Scanning findings over GraphQL, parses the fixed version from the finding's solution text, and opens the merge request, marked as reported by the GitLab report. Needs GitLab Ultimate and a read_api token.

  • 02

    One contract for every advisory database

    Every source answers the same question in the same record shape. Sources are queried concurrently; a required source's failure fails the run and an optional one is recorded; findings that two sources report merge into one record with the higher fix. Nothing downstream of the merge learned a new type, so a fourth source is one adapter.

  • 03

    Provenance on every surface

    report.json carries sources and fixed_version_source per finding and an advisory_sources block per run; SARIF results carry advisorySources; merge requests, failure issues and the PDF finding card add one line naming the reporting source when OSV did not report the advisory. A default run is byte-identical to 3.6.0.

  • 04

    A fixless sibling no longer vetoes a coordinate

    A coordinate carrying one advisory fixed in 2.0.0 and one with no published fix used to come back unfixable with an empty reason and no patch. The fix now ships and the fixless advisory is carried as the plan's residual with a reason saying no fix is published.

Full notes

Added

  • advisory_sources config block (ADR-052): osv, gitlab and config in a precedence you choose; absent or empty means [osv, config]; optional: true records a source failure instead of failing the run; unknown or duplicate names refuse the run at load.
  • GitLab vulnerability report as an advisory source: DETECTED and CONFIRMED Dependency Scanning findings over GraphQL, fixed version parsed conservatively from the solution text, actionable error on tiers without the API.
  • Advisory-source provenance in report.json, SARIF, the run summary, merge requests, failure issues and the PDF security report.
  • Documentation: an advisory-sources configuration page, updated pipeline, SBOM, network, GitLab, CLI, output-format, declared-advisory and troubleshooting pages, a 3.7.0 diagnostic skill with a new eval, and a regenerated sample PDF.

Changed

  • Advisory discovery is one path for scan, fix, curate, run and the npm pipeline: assemble the enabled sources, query, record outcomes, merge.

Fixed

  • An advisory with no published fix no longer vetoes the fix for its siblings on the same coordinate; fixless advisories are carried as residuals with a reason, and an all-fixless coordinate reads a reason instead of an empty string (ADR-001 amendment, REG-220).
  • Quoted --maven-args survive intact via shell-aware splitting; malformed quoting is refused at the CLI boundary; subsystem-owned Maven options win via last-wins ordering (#7).
  • Version discovery runs in the run's own Maven environment when no registries are configured.