Release
v3.8.0
tollgateA merge request may only name an advisory as fixed when the tree it produces no longer carries it. 3.8.0 checks every artifact as it will ship, publishes false claims as residual risk instead of fixes, and was compared project by project with the trusted 3.6.0 before release.
Highlights
- 01
Claim check before publication
After the final pass, each artifact is re-resolved exactly as it will ship and every advisory a plan claims to fix must no longer affect the coordinates the plan moved, in every module. A claim that does not hold is demoted: the advisory moves to the merge request's residual table instead of its fix table (or, when the patch fixed some modules but not all, stays on its row marked partial), and the other fixes still ship. A patch that would expose an advisory the project does not carry today, or a change left fixing nothing, is withheld with evidence. Every verdict (verified, demoted, withheld) is written to an evidence file and to report.json, and summarised in the job log. ARGUS_CLAIM_CHECK=off disables it.
- 02
Checked against the trusted 3.6.0
A new version-diff comparison runs 3.6.0 and 3.8.0 against the same pinned open-source projects with identical advisory data and compares what each would publish. On a single-module Spring Boot service 3.8.0 ships the same change with a correct merge request where 3.6.0's listed the Tomcat pin twice; on a reactor whose parent skips deploy 3.6.0 cannot scan at all; on an 8-module Spring Cloud project both ship the same change, but 3.6.0 claims an httpclient fix that six of seven services did not receive, while 3.8.0 marks it partial and lists the advisory as residual risk; on the remaining projects the two are identical.
- 03
Projects that skip deploy are scanned
The CycloneDX plugin skips any module that switches off maven-deploy-plugin, which services shipped as container images commonly do, and every earlier version failed with "generated bom was not found". 3.8.0 retries with the skip turned off, and never reads a stale bom from an earlier build.
Full notes
Added
- Claim check (ADR-053): verified, demoted or withheld per artifact, with an evidence file under <out>/qualification/claim-check-<key>/, claim_check on report.json rows and a default-level summary line. ARGUS_CLAIM_CHECK toggles it, default on.
- Regression cases REG-237 (exclusion pin kept when the consumer's BOM outranks the carrier) and REG-270 (a module that skips deploy).
- Merge requests mark what a reviewer must act on with GitLab alerts (17.10+): residual risk and reduced advisory coverage as warnings, major version updates as a caution, and the note on Argus change markers as a note. Headings are unchanged.
Fixed
- On a multi-module project an upgrade trial counts a dependency as fixed only when every version it resolves at is unaffected. Reading only the first module's version credited a jolokia-core bump that changed nothing with an httpclient advisory six services still carried.
- Upgrade trials judge an advisory only the GitLab vulnerability report knows by version against the run's own record. They re-checked with OSV alone, so every candidate read as the fix and the merge request listed the same BOM twice for one CVE (present since 3.7.0).
- A module that switches off maven-deploy-plugin is scanned: Argus retries CycloneDX with skipNotDeployed turned off when the default scan writes no bom.
- An EXCLUDE_ADD pin is judged by the tree that resolves without it, never by what the carrier's own POM declares; the static proof that released a load-bearing pin (and produced a merge request repeating the same fix with a marker-id-only diff) is gone.
- A residual is never presented as fixed: fix rows, the merge request title and the coverage marker name only what the plan fixes.
- A final pass cannot list a fix or a removal the artifact already carries, and a merge request never says "Also removed" or "resolved without a pin" about a coordinate its own patch pins.
- Reactor trials probe the staged planning tree, trial rescans skip off-limits components and know aliases, and reactor merge requests ship every file their "Also removed" section describes.
- One exclusion fix reached through several carriers is one finding in the PDF report, with an "Excluded from" row; report.json rows name their carrier.
- SARIF describes the project on disk, cleanup no longer leaves growing blank-line holes, and the "findings set aside" line is logged once per run.
- Four regression cases, including those pinning the 3.7.3 and 3.8.0 customer fixes, were never included in the pipeline; they now run, and a guard fails when a job file is not included.