Argus
Release ledger

Release

v4.0.0

bedrock

Argus reads advisories from databases again, and only from databases. The GitLab vulnerability report source is removed: it described the project's current state, so an Argus fix erased the finding that justified it, and cleanup removed pins the next run had to put back. An advisory OSV has not mapped yet is declared in config.yml.

Download binary
Linux · amd64Linux · arm64macOS · arm64
Diagnostic skillCI/CD componentGrafana dashboardsHow to use the skill →

Highlights

  • 01

    No more remove-and-re-add pins

    With the gitlab source, a pin fixed a finding, the finding left the report once resolved, cleanup read the silence as 'no longer needed' and removed the pin, and the next scan brought it back. Without a source that depends on the project's own state, a pin stays until OSV or your declaration says the version it protects against is clear. And a declared advisory an Argus pin holds clear is no longer called 'safe to delete': the run now says the pin holds it and the declaration should stay.

  • 02

    A config that lists gitlab refuses to load

    An advisory_sources entry naming gitlab, in any form and even when optional, stops the run with a message naming the entry and pointing to declare_advisories. Quietly dropping it would narrow coverage for every project sharing a central config.

  • 03

    One file to mirror from

    argus-assets.typecheck.io/releases.json lists every version and artifact with its URL, size and SHA-256, and SHA256SUMS sits beside each version's files. A mirror polls one file, fetches what it has not seen, and verifies it; the installation docs carry the script.

  • 04

    Every merge request says how it is doing

    Merge requests, the failure issue and the comment that closes an unneeded merge request open with the Argus creature and one plain line: tested and ready, nearly there, tidying up, held back, needs a hand or all clear. The header follows your GitLab light or dark theme. Set ARGUS_MR_MOOD=off to keep descriptions as before.

Full notes

Breaking changes

  • The gitlab advisory source (ADR-052, 3.7.0) is removed (ADR-055). A config.yml whose advisory_sources names gitlab refuses to load: delete the entry and declare, under declare_advisories, every advisory the project relied on it for.

Added

  • releases.json at the root of argus-assets.typecheck.io: every published version newest first, with latest, notes links, and each artifact's kind, platform, URL, size and SHA-256, so internal artifact repositories can mirror Argus with a small script. Each version folder also carries SHA256SUMS.

Fixed

  • A declared advisory held clear by an Argus pin is no longer reported as 'safe to delete'; the run says to keep it while the pin exists and records no inert signal (reg-272).

Removed

  • GitLab-report presentation: the 'Reported by the project's GitLab vulnerability report' provenance line and the link to the finding in GitLab, on merge requests, failure issues, SARIF and the PDF.