Argus
Release ledger

Release

v3.7.1

sightline

Hotfix for two 3.7.0 advisory-source defects. A dependency with parallel maintained release lines (Bouncy Castle FIPS) was collapsed onto a single fix, pushing a 1.x user onto a 2.x major upgrade instead of the in-line patch; fixes are now reconciled per line. And an upgrade that genuinely fixed a cohort no longer highlights the already-fixed advisories as residual risk on the merge request.

Download binary
Linux · amd64Linux · arm64macOS · arm64
Diagnostic skillCI/CD componentGrafana dashboardsHow to use the skill →

Highlights

  • 01

    Parallel release lines keep their own fix

    When advisory entries merge for one coordinate, the fix is reconciled per line (coordinate plus introduced boundary) instead of taking the single highest across all lines. A user on Bouncy Castle FIPS 1.x now gets the 1.0.2.7 patch, not the 2.1.3 major upgrade, and the 1.x patch is no longer marked affected.

  • 02

    Quieter logs on equal fixes

    Reconciling fixed versions that are equal in Maven ordering, such as 1.85 and 1.85.0, no longer logs a spurious "superseded by higher" warning.

  • 03

    No false residuals for fixed cohorts

    After an anchor or parent upgrade moves a coordinate to or past its fixed version, the merge request no longer lists it as residual risk. A coordinate-keyed advisory source such as the GitLab vulnerability report re-reports the coordinate until its next pipeline scan, so the final pass was counting already-fixed advisories that report.json correctly omitted. The residual list is now gated against the post-fix dependency graph, so the merge request and report.json agree and only a genuinely unfixable finding is highlighted.

Full notes

Fixed

  • Advisory-source merge reconciles fixed versions per maintained release line, so parallel lines are not collapsed onto the single highest fix (ADR-052).
  • No spurious supersede warning when two sources state fixed versions that are equal in Maven ordering.
  • Final-pass residual highlighting is gated against the post-fix dependency graph, so an upgrade that fixes a cohort no longer reports the already-fixed advisories from a coordinate-keyed source as residual risk on the merge request (ADR-052, ADR-033).