ArgoCD: vanhemmat versiot ja versiohistoria

## Quick Start

### Non-HA:

```shell
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.6/manifests/install.yaml
```

### HA:

```shell
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.6/manifests/ha/install.yaml
```

## Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the [documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/signed-release-assets) on how to verify.

## Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the [official blog post](https://blog.argoproj.io/argo-cd-v3-5-release-candidate-02b1fbf7b419)

## Upgrading

If upgrading from a different minor version, be sure to read the [upgrading](https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/) documentation.

## Changelog
### Bug fixes
• f62e0c6ae135accd040a7bd2f1031c3a9def3f60：fix(grpc): a workaround to fix SRV _grpclb._tcp SRV lookups (#29989) (cherry-pick #30084 for 3.5) (#30170) (@argo-cd-cherry-pick-bot[bot])
• d98924dfc0c88fe60302dd57259d6a52c7ff81df：fix: restore SSH repository fetch through a SOCKS5 proxy (cherry-pick #30238 for 3.5) (#30246) (@argo-cd-cherry-pick-bot[bot])
• d575730dffdf260ab15a73a810a4edfdd8b2dd48：fix: server-side diff reports fields removed by other managers as diffs (cherry-pick #30206 for 3.5) (#30229) (@argo-cd-cherry-pick-bot[bot])
### Dependency updates
• cad84a82c63c51e0e025d5c7770fdc1795c51880：chore(deps): bump dompurify for release-3.5 (#30176) (@ranakan19)
• 940d00e1ff3d1adf5d0cc2d53e679bd58e8c3185：chore(deps): update group golang to v1.26.10 (release-3.5) (#30305) (@argoproj-renovate[bot])
### Other work
• c2b1e3017e2cec86b122172e861dcd026453ae44：chore: bump version to 3.5.6 on release-3.5 branch (#30319) (@github-actions[bot])

**Full Changelog**：https://github.com/argoproj/argo-cd/compare/v3.5.5...v3.5.6

<a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/argo-site/master/content/pages/cd/gitops-cd.png" width="25%" ></a>

## Quick Start

### Non-HA:

```shell
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.5/manifests/install.yaml
```

### HA:

```shell
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.5/manifests/ha/install.yaml
```

## Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the [documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/signed-release-assets) on how to verify.

## Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the [official blog post](https://blog.argoproj.io/argo-cd-v3-0-release-candidate-a0b933f4e58f)

## Upgrading

If upgrading from a different minor version, be sure to read the [upgrading](https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/) documentation.

## Changelog
### Bug fixes
• 3295d0cede4438315f1f42b019f7d9197a236d80：fix(ci): use curl in kustomize checksum helper so Renovate can refresh checksums (cherry-pick #29938 for 3.5) (#30100) (@argo-cd-cherry-pick-bot[bot])
• a32fb960058cb1676615987058ff20aec5f99f81：fix(hydrator): retry notes push on cannot lock ref errors (cherry-pick #28469 for 3.5) (#29905) (@argo-cd-cherry-pick-bot[bot])
• f0f6bdea7090f2ab188ab3f379aa56ed2670be58：fix(reposerver): stale manifests and goroutine leak after CMP failure (#29870) (cherry-pick #29874 for 3.5) (#30140) (@argo-cd-cherry-pick-bot[bot])
• 3d31f1a9bbef941f0149d3270d5fb3dcd93790fe：fix(server): fill event count and timestamps for events.k8s.io events (#30015) (cherry-pick #30017 for 3.5) (#30111) (@rickbrouwer)
• 33a47a550daf4ae407baf04f678a4b5918cb8069：fix(ui): show enableOCI only for Helm (cherry-pick #29974 for 3.5) (#30074) (@argo-cd-cherry-pick-bot[bot])
• a48be5aa0a2d89988be52bb817e7498f7c248947：fix: cache the OCI tag list (#30117) (cherry-pick #30118 for 3.5) (#30119) (@argo-cd-cherry-pick-bot[bot])
• ebf5ac7ff31f1dd6511cc0246e13da4de8125743：fix: correct scheduled-time format in CronWorkflow create-workflow action (#29915) (cherry-pick #29916 for 3.5) (#29953) (@argo-cd-cherry-pick-bot[bot])
• 514141dab1058d72c4bfa4f0f08b63a0a6c1ad14：fix: fix escaped URL routing for write repo (creds) endpoints (cherry-pick #29940 for 3.5) (#29958) (@argo-cd-cherry-pick-bot[bot])
• 4d2194b2b8114aa5eb39b41ae12e82676032aae4：fix: fix untar inbound check if dstPath is symlinked (cherry-pick #28881 release-3.5) (#30053) (@blakepettersson)
• 4d68ee32ca16d0f8382bf88cd4adc3b6b3e09568：fix: fixes flaky tests by making Log capturer thread-safe (cherry-pick #28328 for 3.5) (#30078) (@argo-cd-cherry-pick-bot[bot])
• 1d0585d9b5097822fd49d32ca05d818231d1b497：fix: synchronize OCI cache cleanup with extraction (#30020) (cherry-pick #30023 for 3.5) (#30103) (@argo-cd-cherry-pick-bot[bot])
### Dependency updates
• 6b6f042ca2273444044a0b69a9b04ef06ed9b116：chore(deps): bump go-git dependency- #30013 for v3.5 (#30047) (@ranakan19)
• 59e320ff6af81722a355975ea956c79385dce2ed：chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.84.0 (cherry-pick release-3.5) (#30056) (@dipakkarde)
• d1b3091a834353fe71fe58b3137c979dd8554879：chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (cherry-pick #28696 for 3.5) (#30057) (@argo-cd-cherry-pick-bot[bot])
• 29f57d5d9b443d473fa699d3451981c63ba6e9a3：chore(deps): bump the golang-x group with 3 updates (#29705) (cherry-pick release-3.5) (#30072) (@blakepettersson)
• f89a094e6b92b3b83d47adc8f5edebd24302e118：chore(deps): update group golang to v1.26.9 (release-3.5) (#30092) (@argoproj-renovate[bot])

**Full Changelog**：https://github.com/argoproj/argo-cd/compare/v3.5.4...v3.5.5

<a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/ar

## Quick Start

### Non-HA:

```shell
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.4/manifests/install.yaml
```

### HA:

```shell
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.4/manifests/ha/install.yaml
```

## Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the [documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/signed-release-assets) on how to verify.

## Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the [official blog post](https://blog.argoproj.io/argo-cd-v3-0-release-candidate-a0b933f4e58f)

## Upgrading

If upgrading from a different minor version, be sure to read the [upgrading](https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/) documentation.

## Changelog
### Security fixes

• CRITICAL：A Kustomize remote ref can run commands in the repo-server ([GHSA-9v9p-x54c-58gc](https://github.com/argoproj/argo-cd/security/advisories/GHSA-9v9p-x54c-58gc))
• CRITICAL：A Kustomize Helm config home can run commands in the repo-server ([GHSA-fw5c-w8rc-j7fx](https://github.com/argoproj/argo-cd/security/advisories/GHSA-fw5c-w8rc-j7fx))
• CRITICAL：A Jsonnet import can read files from the repo-server ([GHSA-m3vr-7329-44ww](https://github.com/argoproj/argo-cd/security/advisories/GHSA-m3vr-7329-44ww))
• CRITICAL：AppProject restrictions bypassed by PreDelete/PostDelete resource hooks ([GHSA-fmxq-cgp8-87wp](https://github.com/argoproj/argo-cd/security/advisories/GHSA-fmxq-cgp8-87wp), CVE-2026-77459)
• HIGH：Login failure rate limit can be bypassed via concurrent requests ([GHSA-4439-h7jw-5cjj](https://github.com/argoproj/argo-cd/security/advisories/GHSA-4439-h7jw-5cjj), CVE-2025-61560)
• HIGH：Command injection via a repository proxy URL on SSH Git repositories ([GHSA-j6cw-g6p4-7hch](https://github.com/argoproj/argo-cd/security/advisories/GHSA-j6cw-g6p4-7hch), CVE-2026-55797)
• MODERATE：Extension proxy RBAC ignores application namespace when applications-in-any-namespace is enabled ([GHSA-g3ff-q88g-chrj](https://github.com/argoproj/argo-cd/security/advisories/GHSA-g3ff-q88g-chrj))
• MODERATE：An oversized OCI manifest can exhaust repo-server memory ([GHSA-w996-f2wq-x9c6](https://github.com/argoproj/argo-cd/security/advisories/GHSA-w996-f2wq-x9c6))

### Potentially-breaking changes

• Kustomize builds that render Helm charts no longer honor `helmGlobals.configHome`. Ordinary `http`, `https`, and `oci` chart repositories still work. Builds that depended on a Helm plugin registered from that directory will not ([GHSA-fw5c-w8rc-j7fx](https://github.com/argoproj/argo-cd/security/advisories/GHSA-fw5c-w8rc-j7fx)).
• An OCI manifest larger than 4 MiB is now rejected ([GHSA-w996-f2wq-x9c6](https://github.com/argoproj/argo-cd/security/advisories/GHSA-w996-f2wq-x9c6)).

### Features
• f37dc0c742724e1b5f2393839a24d9664f31ede7：feat(server): log username on login attempts (cherry-pick #29841 for 3.5) (#29861) (@argo-cd-cherry-pick-bot[bot])
### Bug fixes
• 5c8aa4620c0a606e9fe5e03a07e3dcaabe81fbe6：fix(cmp): clean up tgz stream temporary directories (#29148) (cherry-pick #29156 for 3.5) (#29773) (@argo-cd-cherry-pick-bot[bot])
• 7f0a05834b05103d69d7c150e1ee36541b314696：fix(security): coordinated security fixes (release-3.5) (#30038) (@crenshaw-dev)
• 482c71a558b3001e028316232fe2f86c25becb09：fix(ui): manifest viewer jumpiness (#29691) (cherry pick 3.5) (#29725) (@crenshaw-dev)
• 1f8100a3db64fdc520b768c5606b6fca4e4ad09c：fix: cherry-pick #29737 (release-3.5) (#29749) (@blakepettersson)
• 9886fc1363e92a517b811375505317912cdb82b9：fix: use ObjectMeta in session login test (release-3.5) (#29919) (@crenshaw-de

## Quick Start

### Non-HA:

```shell
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.3/manifests/install.yaml
```

### HA:

```shell
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.3/manifests/ha/install.yaml
```

## Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the [documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/signed-release-assets) on how to verify.

## Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the [official blog post](https://blog.argoproj.io/argo-cd-v3-0-release-candidate-a0b933f4e58f)

## Upgrading

If upgrading from a different minor version, be sure to read the [upgrading](https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/) documentation.

## Changelog
### Bug fixes
• c198be7e7a00f6e643180c0f9b762f768fefcbb1：fix(health): a KubeVirt VirtualMachine declared stopped is Healthy (cherry-pick #29664 for 3.5) (#29665) (@argo-cd-cherry-pick-bot[bot])
• 4b3f69d204d25aeaf9056bc37c3e4d44f198570c：fix(health): report suspended FlinkDeployment as healthy (#26818) (cherry-pick #28995 for 3.5) (#29525) (@argo-cd-cherry-pick-bot[bot])
• dd2cb1aaf12ef19a2bab816fbaecced6422cad7c：fix(repository): clean repository on revision change (cherry-pick #28771 for 3.5) (#29486) (@argo-cd-cherry-pick-bot[bot])
• 70b399c5a8335cd3abb0bf132d63129733a5e3a0：fix(resource_customizations): Crossplane MRs should report Progressing (not Healthy) whilst provisioning [ISSUE: #29381] (cherry-pick #29382 for 3.5) (#29520) (@argo-cd-cherry-pick-bot[bot])
• be8b3873521671e3f9418c6e3019f12a472ac3c1：fix(sync): correctly set operationState values on retry (#26530) (cherry-pick #28778 for 3.5) (#29431) (@omkar619-dev)
• a5e5992f62561d112a6d6a715e6631e3b6817671：fix(ui): guard SSO redirect to stop 401 retry loop (cherry-pick #28807 for 3.5) (#29631) (@argo-cd-cherry-pick-bot[bot])
• 0b0890e0c79d2e2c7f8bf33736cde2772024e2b3：fix(ui): use hydrateTo branch name when set (cherry-pick #29562 for 3.5) (#29564) (@crenshaw-dev)
• 18f0566fb550b1d10d9fb55a72fa887a530eca42：fix: GRPCRoute health check ignores stale observedGeneration conditions (#28086) (cherry-pick #28087 for 3.5) (#29517) (@argo-cd-cherry-pick-bot[bot])
• 4d653a67174ecacd3a7d17ef5f1c923a48304bd6：fix: handle GrafanaFolder negative-polarity condition (#29395) (cherry-pick #29397 for 3.5) (#29524) (@argo-cd-cherry-pick-bot[bot])
• ec585202b451045155203736eaa6bca145b19935：fix: recover AuthReconcile visitor panics (cherry-pick #29440 for 3.5) (#29531) (@Karthik-Chowdary)

**Full Changelog**：https://github.com/argoproj/argo-cd/compare/v3.5.2...v3.5.3

<a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/argo-site/master/content/pages/cd/gitops-cd.png" width="25%" ></a>

## Quick Start

### Non-HA:

```shell
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.2/manifests/install.yaml
```

### HA:

```shell
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.2/manifests/ha/install.yaml
```

## Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the [documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/signed-release-assets) on how to verify.

## Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the [official blog post](https://blog.argoproj.io/argo-cd-v3-0-release-candidate-a0b933f4e58f)

## Upgrading

If upgrading from a different minor version, be sure to read the [upgrading](https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/) documentation.

## Changelog
### Bug fixes
• f1f109cc20895275ebae2dc62e51cba6c788586b：fix(appset): restore ignoreApplicationDifferences after normalization (cherry-pick #29070 for 3.5) (#29195) (@argo-cd-cherry-pick-bot[bot])
• a45dd38594f6f30bcc6c743e6f11080187cc84a1：fix(repository): resolve untyped helm source type in UpdateRevisionForPaths (cherry-pick #28904 for 3.5) (#29399) (@argo-cd-cherry-pick-bot[bot])
• 417c675b17207730f3b89ed579132267c9af4892：fix(revert): auto-sync skipped when newer commit arrives during sync (cherry-pick #28692 for 3.5) (#29224) (@rumstead)
• 961ee40cc32717bad323629284085b9f2cd7173f：fix(ui): remove kind filter from appset page (#29310) (#29311) (cherry-pick 3.5) (#29314) (@crenshaw-dev)
• cc1f3eef40dfee35842cc5a4c27a80b5f5dbe82e：fix(ui): show operation state on applications list page (cherry-pick release-3.5) (#29344) (@antonu17)
• 5accee3440f1a140de32071a035b783d653ce452：fix: don't degrade Cluster API Cluster health while Ready is False during provisioning (cherry-pick #29237 for 3.5) (#29273) (@argo-cd-cherry-pick-bot[bot])
• 4d99c524afda80d091dff81e8745eb3365285874：fix: recover from kubectl panic in AuthReconcile when SA is forbidden (cherry-pick #28669 for 3.5) (#29294) (@alexymantha)
### Dependency updates
• 8b9e270fa2cefb4eb370609b38606bf1a3ae410e：chore(deps): update dependency dexidp/dex to v2.45.1 (#29334) (@nitishfy)
### Other work
• e258ee23c3e52266d407572f4bcdfe7d9ed36cb5：chore: bump version to 3.5.2 on release-3.5 branch (#29404) (@github-actions[bot])
• a9d94d68c8a5bee4e1708f6640e7922b91736fec：fix(notification-controller): deep-copy before mutating object from a shared cache (cherry-pick #29350 for 3.5) (#29354) (@argo-cd-cherry-pick-bot[bot])
• cc1d7a2601ce87695808a2632687975a84900a54：fix(notification-controller): read appprojects from informer cache (#28815) (cherry-pick release-3.5) (#29345) (@antonu17)

**Full Changelog**：https://github.com/argoproj/argo-cd/compare/v3.5.1...v3.5.2

<a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/argo-site/master/content/pages/cd/gitops-cd.png" width="25%" ></a>

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.5/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.5/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
• e77e4b6：fix(reposerver)：honor depth of referenced source instead of primary source (cherry-pick #28339 for 3.4) (#28341) (@alexandresavicki)
• 63e67d5：fix(ssa)：do not run auth reconcile with SSA (cherry pick of #27624 and #27601 to 3.4) (#28265) (@Mangaal)
• 2403907：fix：auto-sync skipped when newer commit arrives during sync with manifest-generate-paths (#27875) (cherry-pick #28227 for 3.4) (#28331) (@argo-cd-cherry-pick-bot[bot])
• 2d18587：fix：deleted resource are incorrectly shown in UI (cherry-pick #28322 for 3.4) (#28337) (@argo-cd-cherry-pick-bot[bot])
• a82e158：fix：don't clobber non-ignored fields on "replace" (cherry-pick #27136 for 3.4) (#28507) (@argo-cd-cherry-pick-bot[bot])
• d4c8f1c：fix：fixes a regression of dex config env vars substituion - Cherry pick of #28369 in 3.4 (#28411) (@ppapapetrou76)
Dependency updates
• 8c7ece5：chore(deps)：bump golang.org/x/crypto to 0.53.0 (release-3.4) (#28375) (@nmirasch)
• a8f245b：chore(deps)：update Ubuntu base image to 26.04 LTS (3.4) (#28430) (@suii2210)
Full Changelog：v3.4.4...v3.4.5

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.5/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.5/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
• e77e4b6：fix(reposerver): honor depth of referenced source instead of primary source (cherry-pick #28339 for 3.4) (#28341) (@alexandresavicki)
• 63e67d5：fix(ssa): do not run auth reconcile with SSA (cherry pick of #27624 and #27601 to 3.4) (#28265) (@Mangaal)
• 2403907：fix: auto-sync skipped when newer commit arrives during sync with manifest-generate-paths (#27875) (cherry-pick #28227 for 3.4) (#28331) (@argo-cd-cherry-pick-bot[bot])
• 2d18587：fix: deleted resource are incorrectly shown in UI (cherry-pick #28322 for 3.4) (#28337) (@argo-cd-cherry-pick-bot[bot])
• a82e158：fix: don't clobber non-ignored fields on "replace" (cherry-pick #27136 for 3.4) (#28507) (@argo-cd-cherry-pick-bot[bot])
• d4c8f1c：fix: fixes a regression of dex config env vars substituion - Cherry pick of #28369 in 3.4 (#28411) (@ppapapetrou76)
Dependency updates
• 8c7ece5：chore(deps): bump golang.org/x/crypto to 0.53.0 (release-3.4) (#28375) (@nmirasch)
• a8f245b：chore(deps): update Ubuntu base image to 26.04 LTS (3.4) (#28430) (@suii2210)
Full Changelog：v3.4.4...v3.4.5

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.5/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.5/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- e77e4b6: fix(reposerver): honor depth of referenced source instead of primary source (cherry-pick #28339 for 3.4) (#28341) (@alexandresavicki)
- 63e67d5: fix(ssa): do not run auth reconcile with SSA (cherry pick of #27624 and #27601 to 3.4) (#28265) (@Mangaal)
- 2403907: fix: auto-sync skipped when newer commit arrives during sync with manifest-generate-paths (#27875) (cherry-pick #28227 for 3.4) (#28331) (@argo-cd-cherry-pick-bot[bot])
- 2d18587: fix: deleted resource are incorrectly shown in UI (cherry-pick #28322 for 3.4) (#28337) (@argo-cd-cherry-pick-bot[bot])
- a82e158: fix: don't clobber non-ignored fields on "replace" (cherry-pick #27136 for 3.4) (#28507) (@argo-cd-cherry-pick-bot[bot])
- d4c8f1c: fix: fixes a regression of dex config env vars substituion - Cherry pick of #28369 in 3.4 (#28411) (@ppapapetrou76)
Dependency updates
- 8c7ece5: chore(deps): bump golang.org/x/crypto to 0.53.0 (release-3.4) (#28375) (@nmirasch)
- a8f245b: chore(deps): update Ubuntu base image to 26.04 LTS (3.4) (#28430) (@suii2210)
Full Changelog: v3.4.4...v3.4.5

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.4/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.4/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- 146184e: fix(health): PromotionStrategy stuck Progressing after no-op re-hydration (#28124) (cherry-pick #28125 for 3.4) (#28135) (@argo-cd-cherry-pick-bot[bot])
- e515f51: fix(rbac): resolve RBAC regression for project-scoped resources in multi-namespace architecture (#25289) (#26573) (#28062) (@wanddynosios)
- 7f2fe95: fix(ssd): regression causing diff to error on new objects (#27679) (cherry-pick #27703 for 3.4) (#28241) (@argo-cd-cherry-pick-bot[bot])
- 5199ea6: fix: add a lock on clusterinformer (cherry-pick #28216 for 3.4) (#28312) (@blakepettersson)
- 7a64081: fix: exclude live status from normalization (cherry-pick #28201 for 3.4) (#28204) (@argo-cd-cherry-pick-bot[bot])
- 0b3436f: fix: fixes parsing of dex passwords with dollar sign (cherry pick of #28027 to 3.4) (#28197) (@ppapapetrou76)
- 9ccf66b: fix: resolve cross-generator Values templates in RenderGeneratorParams (#27827) (cherry-pick #27830 for 3.4) (#28128) (@argo-cd-cherry-pick-bot[bot])
Other work
- 14ad471: Merge pull request #28162 from argoproj/cherry-pick-28158-to-release-3.4 (@dudinea)
- 0fd000b: Merge pull request #28164 from argoproj/cherry-pick-28155-to-release-3.4 (@dudinea)
- ff25519: chore(ci): bump codecov action to 7.0.0 to fix the GPG issue (cherry-pick #28159 for 3.4) (#28172) (@dudinea)
- e9ff0c5: ci: bump goreleaser (cherry-pick #28033 for 3.4) (#28072) (@argo-cd-cherry-pick-bot[bot])
- 1c5e37d: ci: use github release notes in goreleaser (cherry-pick #28048 for 3.4) (#28071) (@argo-cd-cherry-pick-bot[bot])
- 0c14cfb: fix(manifest-generate-paths): Normalize repo before using type repo (#28113) (@fm1ck3y)
- c2003f4: test(e2e): Add test for second Sync after initial for different resources/options (#28156) (#28155) (@dudinea)
- 9810fa2: test(e2e): fix cleanup of CRDs for e2e tests (#28157) (#28158) (@dudinea)
Full Changelog: v3.4.3...v3.4.4

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.3/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.3/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- f435b0f fix(cli): return immediately from 'app wait' when app is already in desired state (#12211) (#27503) (#27713) (jheyduk)
- b39fe4f fix(lint): unnecessary nesting (cherry-pick #27815 for 3.4) (#27817) (argo-cd-cherry-pick-bot[bot], Michael Crenshaw)
- 668f2c5 fix(ui): don't prefetch errors (#27877) (cherry-pick #27925 for 3.4) (#28024) (argo-cd-cherry-pick-bot[bot], Blake Pettersson)
- b796979 fix(ui): return full source for non-hydrator apps in Parameters tab (cherry-pick #26946 for 3.4) (#27964) (Gabriel Barreto, himeshp)
- 5d3f8a0 fix: honor repo depth setting in gitSourceHasChanges and fetch functions (cherry-pick #27838 for 3.4) (#28043) (argo-cd-cherry-pick-bot[bot], alexandresavicki, Cursor)
- 35ed877 fix: nil-check (cherry-pick #28039 for 3.4) (#28040) (argo-cd-cherry-pick-bot[bot], Blake Pettersson, Soumya Ghosh Dastidar)
- b0f1553 fix: prevent InvalidSpecError race in application controller startup (cherry-pick #27672 for 3.4) (#27845) (argo-cd-cherry-pick-bot[bot], Michele Baldessari)
- 4fa0950 fix: truncate labels for deletion hook resources (cherry-pick #27542 for 3.4) (#27714) (argo-cd-cherry-pick-bot[bot], Jaewoo Choi)
Dependency updates
- 0edd404 chore(deps): bump redoc/dompurify to v3.4.0 in /ui for fixing CVE-2026-41240(cherry-pick 3.4) (#27913) (Alka Kumari)
Other work
- ce55c85 fix(gitops-engine): fix nil pointer dereference error in removeWebookMutation() (cherry-pick #27749 for 3.4) (#28031) (argo-cd-cherry-pick-bot[bot], Pierre Guinoiseau)
Full Changelog: v3.4.2...v3.4.3

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.2/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.2/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- b15e9e3 fix: Revert "fix: avoid calling UpdateRevisionForPaths unnecessary (#25151)" (cherry-pick #27241 for 3.4) (#27251) (argo-cd-cherry-pick-bot[bot], Alexander Matyushentsev)
- 570ccbc fix: prevent panic on nil APIResource in permission validator (cherry-pick #26610 for 3.4) (#27752) (argo-cd-cherry-pick-bot[bot], Andy Lo-A-Foe)
Dependency updates
- 6eb6215 chore(deps): bump github.com/moby/spdystream from 0.5.0 to 0.5.1 (cherry-pick #27401 for 3.4) (#27734) (argo-cd-cherry-pick-bot[bot], dependabot[bot])
Other work
- 35ea43c Merge commit from fork (Blake Pettersson)
- bcb4298 Merge commit from fork (Peter Jiang)
- 4e71577 chore: bump otel/sdk to 1.43.0 (release-3.4) (#27806) (Nitish Kumar)
- 6e227ba ci: pin images of setup-qemu-action, setup-buildx-action and goreleaser CLI version (cherry-pick #27060 for 3.4) (#27731) (argo-cd-cherry-pick-bot[bot], Regina Voloshin)
- 87e9148 fix(gitops-engine): apply HideSecretData to server-side diff results for Secrets (cherry-pick #27598 for 3.4) (#27754) (argo-cd-cherry-pick-bot[bot], Peter Jiang, downfa11)
Full Changelog: v3.4.1...v3.4.2

Important
Following Helm 3.19.0 change in how Helm interprets K8s cluster version, this Argo CD release contains a change that aligns how Argo CD interprets K8s cluster version with Helm behavior.
Impact: Application Sets with Cluster Generators, that fetch clusters based on their Kubernetes version and use argocd.argoproj.io/auto-label-cluster-info on the cluster secret, need to be updated to use argocd.argoproj.io/kubernetes-version with the vMajor.Minor.Patch format instead of the previous Major.Minor format.
More details here: https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/3.3-3.4/#cluster-version-format-change
Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.1/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.1/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Features
- 05504d6 feat(appset): add Health field to ApplicationSet status (#25753) (Peter Jiang)
- f83906d feat(appset): optimize appset controller performance when grabbing cluster secrets (#25624) (#25577) (rumstead)
- ed6d2c5 feat(controller): Annotation to pause reconciliation for a specific cluster (#26442) (Drew Bailey, Drew Bailey)
- 3157fb1 feat(helm): support wildcard glob patterns for valueFiles (cherry-pick #26768 for 3.4) (#26919) (argo-cd-cherry-pick-bot[bot], Nitish Kumar)
- 5072899 feat(hydrator): making configurable authorName/Email used for hydration commit (#22847) (#25746) (Aditya Raj)
- 8ed52b2 feat(notification): add appProject access to notification templates (#26437) (#26470) (Aditya Raj)
- e1aeb79 feat(ui): AppSet Slide Out Summary (#26490) (Peter Jiang, reggie-k)
- 5ab598e feat(ui): add annotation filtering support to applications list (#25590) (Ji Kwan)
- 1391e2f feat(ui): add appset tree-view details page (#26262) (Peter Jiang, reggie-k, Keith Chong)
- 7208578 feat(ui): appset list page and filters (#25837) (Peter Jiang)
- ff45972 feat(ui): enable hydrator support in app create panel (#26485) (jwinters01, Alexandre Gaudreault)
- 1214946 feat(ui): support hydrator properties in summary tab (#26152) (jwinters01, Michael Crenshaw)
- b414432 feat: Add application filter for operation status to UI (#25636) (Dylan Schlager)
- 408e99e feat: Allow custom User-Agent headers for Helm repository requests (#25473) (Yugan)
- 19b41b9 feat: ApplicationSet watch API (#26409) (Peter Jiang, nitishfy)
- b442167 feat: Document and expose K8S API client environment variables(#8527) (#25145) (gami, Alexandre Gaudreault)
- 7a3d6f1 feat: Implement nmstate health checks (#26506) (#26507) (Sander Tervoert)
- 5859065 feat: add ApplicationSet listResourceEvents API (#25537) (Peter Jiang, Alexy Mantha)
- 2793097 feat: add OTEL instrumentation for authentication and handlers (#25296) (Mike Cutsail, Alexandre Gaudreault)
- b7e2027 feat: add Prune and Delete as application level sync option (#23370) (Arthur Outhenin-Chalandre)
- 73b4d98 feat: add --no-install-recommends in argocd-base #25841 (#25852) (Jakub Rudnik, Nitish Kumar)
- 13bc5ae feat: add argocd account session-token command (#15277) (#24638) (Alex Eftimie, Alexandre Gaudreault, Peter Jiang)
- d8635ca feat: add clear-all button to applications list filters (#26007) (Jaewoo Choi)
- c2e594c feat: disable gRPC service config DNS TXT lookups by default (#26077) (Valentin Stoican, Valentin Stoican)
- 3cb4955 feat

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.8/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.8/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- fb727cf: Revert "fix: prevent automatic refreshes from informer resync and status updates (cherry-pick #25290 for 3.3)" (#27400) (@crenshaw-dev)
- 26c8152: fix(appcontroller): application controller in core mode fails to sync when server.secretkey is missing (#26793) (#27462) (@anandf)
- 82b6d45: fix(appset): change appset resource status count to 5000 by default (cherry-pick #26249 for 3.3) (#26263) (@argo-cd-cherry-pick-bot[bot])
- 9bff1c5: fix(cli): uses DrySource revision for app diff/manifests with sourceHydrator (#23817) (cherry-pick #24670 for 3.3) (#27481) (@argo-cd-cherry-pick-bot[bot])
- 6f3ef7d: fix: avoid stale informer cache in RevisionMetadata handler (cherry-pick #27392 for 3.3) (#27396) (@argo-cd-cherry-pick-bot[bot])
- b64eb4f: fix: revert autosync event message format change (cherry-pick #27387 for 3.3) (#27389) (@argo-cd-cherry-pick-bot[bot])
Full Changelog: v3.3.7...v3.3.8

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.7/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.7/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- ea51bd8: [release-3.3] fix: improve perf: switch parentUIDToChildren to map of sets, remove cache rebuild (#26863) (#27108) (@jcogilvie)
- 4d2f261: fix(ci): run yarn install with --frozen-lockfile (cherry-pick #27099 for 3.3) (#27351) (@dudinea)
- 671efff: fix(controller): reduce secret deepcopies and deserialization (#27049) (cherry-pick release-3.3) (#27129) (@rumstead)
- a77c150: fix(docs): Fix manifest path in Source Hydrator docs (cherry-pick #27123 for 3.3) (#27167) (@argo-cd-cherry-pick-bot[bot])
- f0b924f: fix(server): Ensure OIDC config is refreshed at server restart (cherry-pick #26913 for 3.3) (#27114) (@argo-cd-cherry-pick-bot[bot])
- 7eedc7a: fix(ui): OCI revision metadata never renders due to conflicting guard clause (#26948) (cherry-pick #27097 for 3.3) (#27365) (@argo-cd-cherry-pick-bot[bot])
- b0e0415: fix(ui): handle 401 error in stream (cherry-pick #26917 for 3.3) (#27227) (@argo-cd-cherry-pick-bot[bot])
- 3b12b2e: fix: Add X-Frame-Options and CSP headers to Swagger UI endpoints (cherry-pick #26521 for 3.3) (#27154) (@argo-cd-cherry-pick-bot[bot])
- 4939e1f: fix: force attempt http2 with custom tls config (cherry-pick #26976 for 3.3) (#27358) (@SamyDjemai)
- e372a7f: fix: pass repo.insecure flag to helm dependency build (cherry-pick #27078 for 3.3) (#27083) (@argo-cd-cherry-pick-bot[bot])
- 99e88e0: fix: prevent automatic refreshes from informer resync and status updates (cherry-pick #25290 for 3.3) (#27230) (@argo-cd-cherry-pick-bot[bot])
- 2512512: fix: trigger app sync on app-set spec change (cherry-pick #26811 for 3.3) (#27130) (@argo-cd-cherry-pick-bot[bot])
- e451591: fix: use force flag in copyutil symlink to prevent repo-server crashes (cherry-pick #26613 for 3.3) (#27057) (@argo-cd-cherry-pick-bot[bot])
- b948ff0: fix: use unique names for initial commits (cherry-pick #27171 for 3.3) (#27197) (@argo-cd-cherry-pick-bot[bot])
Dependency updates
- 899c5e8: chore(deps): bump fast-xml-parser from 4.5.3 to 4.5.6 in /ui - 3.3 (#27360) (@keithchong)
- 7fd134a: chore(deps): bump go-jose from 4.1.3 to 4.1.4 (cherry-pick #27101 for… (#27208) (@blakepettersson)
- 2daefc0: chore(deps): update notifications-engine dependency in release-3.3 to v0.5.1-0.20260316232552-d27ba0152c1c (#27093) (@pasha-codefresh)
Other work
- 45cbc84: test(e2e): add e2e tests for reverse deletionOrder when progressive sync enabled (cherry-pick #26673 for 3.3) (#27340) (@ranakan19)
Full Changelog: v3.3.6...v3.3.7

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.6/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.6/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- 4a823fe: fix: controller incorrectly detecting diff during app normalization (cherry-pick #27002 for 3.3) (#27013) (@argo-cd-cherry-pick-bot[bot])
- c5d7748: fix: wrong installation id returned from cache (cherry-pick #26969 for 3.3) (#27027) (@argo-cd-cherry-pick-bot[bot])
Full Changelog: v3.3.5...v3.3.6

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.5/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.5/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- e53c10c: fix(UI): show RollingSync step clearly when labels match no step (cherry-pick #26877 for 3.3) (#26884) (@argo-cd-cherry-pick-bot[bot])
- 03dda41: fix(ci): add .gitkeep to images dir (cherry-pick #26892 for 3.3) (#26911) (@argo-cd-cherry-pick-bot[bot])
- ff207a4: fix(server): fix find container logic for terminal (cherry-pick #26858 for 3.3) (#26934) (@argo-cd-cherry-pick-bot[bot])
- 06d960d: fix(ui): Improve message on self-healing disabling panel (#26977) (cherry-pick #26978 for 3.3) (#26981) (@argo-cd-cherry-pick-bot[bot])
- 0dc0a66: fix(ui): include _-prefixed dirs in embedded assets (cherry-pick #26589 for 3.3) (#26910) (@argo-cd-cherry-pick-bot[bot])
- 494b44c: fix: Hook resources not created at PostSync when configured with PreDelete PostDelete hooks (cherry-pick #26996 for 3.3) (#26999) (@argo-cd-cherry-pick-bot[bot])
- 422cabb: fix: stack overflow when processing circular ownerrefs in resource graph (#26783) (cherry-pick #26790 for 3.3) (#26879) (@argo-cd-cherry-pick-bot[bot])
Dependency updates
- 476800e: chore(deps): bump google.golang.org/grpc from 1.77.0 to 1.79.3 for release-3.3 (#26886) (#26953) (@dudinea)
Other work
- ea8a881: ci: test against k8s 1.35.0 (cherry-pick #26062 for 3.3) (#26860) (@argo-cd-cherry-pick-bot[bot])
Full Changelog: v3.3.4...v3.3.5

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.4/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.4/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- 182e4c6: fix(ci): Add missing git-lfs installer checksum for ppc64le (cherry-pick #26835 for 3.3) (#26836) (@argo-cd-cherry-pick-bot[bot])
- 2fcc40a: fix: skip token refresh threshold parsing in unrelated components (cherry-pick 3.3) (#26806) (@gdsoumya)
Documentation
- 01b86e7: docs: clarify cluster version change impact for ClusterGenerator, CMP Plugins and migration (#26851) (@reggie-k)
Other work
- e164f8c: chore: bump otel-sdk (release-3.3) (#26808) (@blakepettersson)
Full Changelog: v3.3.3...v3.3.4

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.3/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.3/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- 6224d67: fix(actions): Use correct annotation for CNPG suspend/resume (cherry-pick #26711 for 3.3) (#26727) (@argo-cd-cherry-pick-bot[bot])
- 968c633: fix(controller): handle comma-separated hook annotations for PreDelete/PostDelete hooks (cherry-pick #26420 for 3.3) (#26586) (@argo-cd-cherry-pick-bot[bot])
- 4411801: fix(health): use note.drySha when available (cherry-pick #26698 for 3.3) (#26750) (@argo-cd-cherry-pick-bot[bot])
- 3d3760f: fix(ui): standard resource icons are not displayed properly.#26216 (cherry-pick #26228 for 3.3) (#26380) (@argo-cd-cherry-pick-bot[bot])
- c6df35d: fix: consistency of kubeversion with helm version 3 3 (#26744) (@ppapapetrou76)
- 5e19021: fix: multi-level cross-namespace hierarchy traversal for cluster-scop… (#26640) (@agaudreault)
Other work
- c61c593: chore: use base ref for cherry-pick prs (cherry-pick #26551 for 3.3) (#26553) (@argo-cd-cherry-pick-bot[bot])
Full Changelog: v3.3.2...v3.3.3

Important
Before upgrading all types of Argo CD installations to this release, please read the upgrade guide first:
https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/3.2-3.3/#breaking-changes
Upgrading Argo CD which is managing itself
Users who have an Argo CD Application that manages their Argo CD installation, must enable ServerSideApply=true sync option on this Application in order for the upgrade to succeed.
In some cases, like when the self-managing of Argo CD is performed with Kustomize, there may be a sync error like Failed to perform client-side apply migration: failed to perform client-side apply migration on manager kubectl-client-side-apply.
We are currently working on a long-term fix to this issue, the progress can be tracked here: #26279
A temporary remediation is to additionally set the ClientSideApplyMigration=false sync option on this Application. This solution is temporary and not recommended for the long run because it may result in conflicts between Argo CD K8s field manager and other field managers at a later point in time, and if you use it, you will need to remove it after the above issue is fixed.
More details here:
https://argo-cd.readthedocs.io/en/stable/user-guide/sync-options/#client-side-apply-migration
Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.1/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.1/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- 8449d9a: fix(server): OIDC config via secrets fails (#18269) (cherry-pick #26214 for 3.3) (#26423) (@argo-cd-cherry-pick-bot[bot])
- d0b2a6c: fix: Fix excessive ls-remote requests on monorepos with Auto Sync enabled apps (26277) (cherry-pick #26278 for 3.3) (#26372) (@argo-cd-cherry-pick-bot[bot])
- e464f6a: fix: AppProject finalizer should consider apps in all allowed namespaces (#24347) (cherry-pick #26416 for 3.3) (#26480) (@argo-cd-cherry-pick-bot[bot])
- 445916f: fix: compressedLayerExtracterStore+isCompressedLayer - allow tar.gzip suffixes (cherry-pick #26355 for 3.3) (#26376) (@argo-cd-cherry-pick-bot[bot])
Dependency updates
- 6126798: chore(deps): Upgrade Kustomize to 5.8.1 (cherry-pick #26367 for 3.3) (#26369) (@argo-cd-cherry-pick-bot[bot])
Other work
- 92df21c: chore(appset): cherry-pick basic progressive sync e2e tests (#26092) (#26191) (@ranakan19)
- 4b0a2c0: chore: bumps ubuntu base docker image to 25.10 (cherry-pick #25758 for 3.3) (#26436) (@argo-cd-cherry-pick-bot[bot])
- 273683b: chore: placate Sonar by ignoring testdata files (cherry-pick #26371 for 3.3) (#26377) (@argo-cd-cherry-pick-bot[bot])
- 8df5e96: test(e2e): CMP test fails locally on Mac (cherry-pick #25901 for 3.3) (#26340) (@argo-cd-cherry-pick-bot[bot])
- 2449314: test(e2e): add isolation by ensuring unique name (cherry-pick #25724 for 3.3) (#26287) (@ranakan19)
- c4f0cd3: test(e2e): configurable tmp dir locally (#25780) (#26339) (@ranakan19)
- 55d0d09: test(e2e): fix TestDeletionConfirmation flakiness (cherry-pick #25902 for 3.3) (#26284) (@argo-cd-cherry-pick-bot[bot])
- 6f270cc: test(e2e): oras binary not found locally if not installed in path (cherry-pick #25751 for 3.3) (#26337) (@argo-cd-cherry-pick-bot[bot])
- 54f2916: test(e2e): unstable CMP e2e test when running locally (cherry-pick #25752 for 3.3) (#26288) (@argo-cd-cherry-pick-bot[bot])
- 0038fce: 

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.0/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.0/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Features
- ce2fb70: Revert "feat: Ability to create custom labels for namespaces created … (#455) (@pasha-codefresh)
- e50dd00: feat(actions): Add cloudnativepg reload, restart, promote, suspend and resume actions (#24192) (@rouke-broersma)
- 3ee16c0: feat(actions): PullRequest merge action (#24823) (@crenshaw-dev)
- 0c77f3c: feat(actions): add icons to apps actions (#25343) (#25344) (@rickbrouwer)
- a64933f: feat(actions): add pause action for KEDA ScaledObject and ScaledJob (#25301) (#25302) (@rickbrouwer)
- 97d50a1: feat(appset): add pprof endpoints (#25044) (@rumstead)
- 482440b: feat(appset): use clone instead of replace on sprig templates to reduce function copies (#25576) (@rumstead)
- 64421a7: feat(ci): add run failure link to cherry pick comment (#24838) (@crenshaw-dev)
- 4678361: feat(cli): Add additional examples to proj list command (#25169) (@onasser1)
- ac12ab9: feat(cli): Updated CLI to show Plugins during tab completion (#24758) (@christianh814)
- 53c3542: feat(cli): add powershell completion (#25595) (@onasser1)
- f866959: feat(cli): added support for filtering by group in app get-resource CLI command (#25495) (@sabre1041)
- ac1a2f8: feat(health): add grafana-org-operator Health (#25662) (@sathieu)
- 0c6fa28: feat(hydrator): add inline parameter support to Source Hydrator (#24228) (#24277) (@sangyeong01)
- dea7ead: feat(hydrator): avoid unnecessary repo-server calls (#25150) (@pbhatnagar-oss)
- 6cd30d3: feat(hydrator): don't push commits if manifests don't change (#25056) (@pbhatnagar-oss)
- fe02a8f: feat(redis): Secrets credentials via volume mount (#24597) (@Mangaal)
- bbc3e99: feat(repo): add support for github app authentication without installationid (#25339) (#25374) (@pbhatnagar-oss)
- 1ae13b2: feat(ui): conditionally render app view extensions (#25132) (@jwinters01)
- afaf16b: feat(ui): hide sync option 'replace' if sync with replace is disabled in the server (issue no. #22625) (#22647) (@jan-mrm)
- 528482c: feat(ui): implement abstraction layer for appset ui support (#24916) (@pjiang-dev)
- b74c7aa: feat(ui): improve sync warnings (#25524) (@jwinters01)
- 90b3e85: feat(ui): support custom icons (#20864) (@crenshaw-dev)
- a56a803: feat: Ability to create custom labels for namespaces created with syncOptions CreateNamespace (#443) (@pasha-codefresh)
- 9ab0b2e: feat: Add ability to hide certain annotations on secret resources (#577) (@svghadi)
- 9ee5cca: feat: Add health check for Ceph CRD (#24111) (@afarbos)
- 51c9add: feat: Add health checks for ServiceBinding and ServiceInstance (#25007) (@dzahariev)
- 8c890d4: feat: Add impersonation support for App finalizer deletion (#24524) (@ccjette-logmein)
- ed537d5: feat: Add path flag to ArgoCD CLI app list (#24834) (@onasser1)
- 1c4ef33: feat: Add server-side apply manager config (#418) (@leoluz)
- 7493226: feat: Add support for HPA v2 (autoscaling/v2) (#411) (@EppO)
- 1a6973a: feat: Add the ability to not autogenerate external URLs from ingress object (#13705) (#25383) (@rkevin-arch)
- ed7c77a: feat: Apply out of sync option only (#533) (@pasha-codefresh)
- d65e9d9: feat: Enable SkipDryRunOnMissingResource sync option on App

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.6/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.6/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- 20866f4: fix(hydrator): .gitattributes include deeply nested files (#25870) (cherry-pick #26011 for 3.2) (#26012) (@argo-cd-cherry-pick-bot[bot])
- 508da9c: fix(hydrator): empty links for failed operation (#25025) (cherry-pick #26014 for 3.2) (#26016) (@argo-cd-cherry-pick-bot[bot])
- 2ff406a: fix: cherry pick #25516 to release-3.2 (#26115) (@FourFifthsCode)
- e3b108b: fix: close response body on error paths to prevent connection leak (cherry-pick #25824 for 3.2) (#26006) (@argo-cd-cherry-pick-bot[bot])
- ad117b8: fix: invalid error message on health check failure (#26040) (cherry pick #26039 for 3.2) (#26070) (@dudinea)
Dependency updates
- 76fc92f: chore(deps): update notifications-engine to fix GitHub PR comments nil panic (cherry-pick #26065 for 3.2) (#26074) (@soutar)
Full Changelog: v3.2.5...v3.2.6

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.5/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.5/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Full Changelog: v3.2.4...v3.2.5

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.4/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.4/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Features
- fafbd44: feat: Cherry-pick to 3.2 update notifications engine to v0.5.1 0.20251223091026 8c0c96d8d530 (#25930) (@reggie-k)
Bug fixes
- d7d9674: fix(appset): do not trigger reconciliation on appsets not part of allowed namespaces when updating a cluster secret (cherry-pick #25622 for 3.2) (#25911) (@argo-cd-cherry-pick-bot[bot])
- e6f5403: fix: Only show please update resource specification message when spec… (cherry-pick #25066 for 3.2) (#25895) (@argo-cd-cherry-pick-bot[bot])
Documentation
- e9d03a6: docs: Run make codegen for notifications engine changes (#25958) (@reggie-k)
- b67eb40: docs: link to source hydrator (cherry-pick #25813 for 3.2) (#25814) (@argo-cd-cherry-pick-bot[bot])
Dependency updates
- 8a0633b: chore(deps): bump go to 1.25.5 (cherry-pick) (#25805) (@nitishfy)
Other work
- b414696: chore(cherry-pick-3.2): bump expr to v1.17.7 (#25889) (@nitishfy)
- 51c6375: ci: test against k8s 1.34.2 (cherry-pick #25856 for 3.2) (#25859) (@argo-cd-cherry-pick-bot[bot])
Full Changelog: v3.2.3...v3.2.4

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.3/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.3/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Dependency updates
- 8f903c3: chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.46.0 (#25791) (@anandf)
Full Changelog: v3.2.2...v3.2.3

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.2/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.2/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- 122f4db: fix(hydrator): appset should preserve annotation when hydration is requested (cherry-pick #25644 for 3.2) (#25654) (@argo-cd-cherry-pick-bot[bot])
- 33b5043: fix(oidc): check userinfo endpoint in AuthMiddleware (cherry-pick #23586 for 3.2) (#25415) (@mkilchhofer)
- 784f62c: fix(server): update resourceVersion on Terminate retry (cherry-pick #25650 for 3.2) (#25718) (@argo-cd-cherry-pick-bot[bot])
- 732b16f: fix: create read and write secret for same url (cherry-pick #25581 for 3.2) (#25589) (@argo-cd-cherry-pick-bot[bot])
Documentation
- 26b7fb2: docs: add added healthchecks to upgrade docs (cherry-pick #25487 for 3.2) (#25490) (@argo-cd-cherry-pick-bot[bot])
- 0ace9bb: docs: sync-waves guide: Use markdown formatting (cherry-pick #25372 for 3.2) (#25659) (@lindhe)
Dependency updates
- 95e7cdb: chore(deps): bumped k8s.io/kubernetes v1.34.0 to v1.34.2 - manual cherry-pick of 25682 for 3-2 (#25687) (@reggie-k)
- 88fe638: chore(deps):bumped gitops-engine to v0.7.1-0.20251217140045-5baed5604d2d with bumped k8s.io/kubernetes to 1.34.2 (#25708) (@reggie-k)
Other work
- 024c7e6: chore: reference gitops-engine fork with nil pointer fix (#25522) (@ivanpedersen)
- 6398ec3: chore: release champ 3.3 (cherry-pick #25202 for 3.2) (#25663) (@argo-cd-cherry-pick-bot[bot])
- a297038: test(controller): avoid race in test (cherry-pick #25655 for 3.2) (#25691) (@argo-cd-cherry-pick-bot[bot])
Full Changelog: v3.2.1...v3.2.2

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.1/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.1/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- 6dd5e7a: fix(ui): add null-safe handling for assignedWindows in status panel (cherry-pick #25128 for 3.2) (#25180) (@argo-cd-cherry-pick-bot[bot])
- dabdf39: fix(ui): overlapping UI elements and add resource units to tooltips (cherry-pick #24717 for 3.2) (#25225) (@choejwoo)
- cd8df17: fix: Allow the ISVC to be healthy when the Stopped Condition is False (cherry-pick #25312 for 3.2) (#25318) (@argo-cd-cherry-pick-bot[bot])
- 27c5065: fix: revert #24197 (cherry-pick #25294 for 3.2) (#25314) (@argo-cd-cherry-pick-bot[bot])
- 29f869c: fix: the concurrency issue with git detached processing in Repo Server (#25101) (cherry-pick #25127 for 3.2) (#25448) (@dudinea)
- 7bd02d7: fix:(ui) don't render ApplicationSelector unless the panel is showing (cherry-pick #25201 for 3.2) (#25208) (@argo-cd-cherry-pick-bot[bot])
Documentation
- c11e67d: docs: Document usage of ?. in notifications triggers and fix examples (#25352) (cherry-pick #25418 for 3.2) (#25421) (@argo-cd-cherry-pick-bot[bot])
- a0a1843: docs: Improve switch to annotation tracking docs, clarifying that a new Git commit may be needed to avoid orphan resources - (cherry-pick #25309 for 3.2) (#25338) (@reggie-k)
- 86c9994: docs: update user content for deleting applications (cherry-pick #25124 for 3.2) (#25174) (@argo-cd-cherry-pick-bot[bot])
Other work
- 1545390: fix(cherry-pick): bump gitops-engine ssd regression (#25226) (@pjiang-dev)
Full Changelog: v3.2.0...v3.2.1

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.0/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.0/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
> Please note that users operating large monorepos may encounter repo-server lock contention requiring pod restarts. A fix is under review and will be included in the next patch release.
Changelog
Features
- be8e79e: feat(appset): add pprof endpoints (cherry-pick #25044 for 3.2) (#25051) (@rumstead)
- 79f152c: feat(appset): deleting applications in order when Progressive sync enabled on applicationSet (#23465) (@ranakan19)
- b1a9fab: feat(appset): enhance ApplicationSet status debugging logs (#23869) (@somln)
- a5c6898: feat(appset): increase concurrent reconcile maximum to max int64 (#23721) (@rumstead)
- 6a20776: feat(cli): Support Server-Side Diff CLI (#23978) (@pjiang-dev)
- 69f7d39: feat(cli): add 'get-resource' command (#23196) (#23609) (@cjcocokrisp)
- 853b8dd: feat(cli): support password prompt input when --password is not provided in bcrypt cli (#23906) (@gyu-young-park)
- 5a8b427: feat(controller): Permit using newer revision when retrying failed sync (#11494) (#23038) (@olivergondza)
- 5c9a5ef: feat(health): Add healthCheck for CRD DatadogMetric (#23464) (@Nicolas-Richard)
- d3de443: feat(health): CronJob health and suspend, resume and terminate Job actions (#23991) (@agaudreault)
- 36f1a59: feat(health): add health checks for GitOps Promoter (#23663) (@crenshaw-dev)
- 99fea7c: feat(helm): upgrade to 3.18.3 (#23618) (@crenshaw-dev)
- e8e39a9: feat(helm): upgrading helm to 3.18.4 (#23724) (@mubarak-j)
- 6f6c39d: feat(hydrator): Commit message templating (#23679) (#24204) (@pbhatnagar-oss)
- e85e353: feat(hydrator): Credential template to source hydrator (#23999) (@pbhatnagar-oss)
- 562194b: feat(hydrator): add .gitattributes file to hydrated repo root (#23678) (#23725) (@FourFifthsCode)
- 8b2799c: feat(hydrator): parallelize repo-server calls (#24451) (#24436) (@crenshaw-dev)
- a6a78ef: feat(kustomize): upgrade to 5.7.0 (#23619) (@crenshaw-dev)
- d954789: feat(server): 3scale health checks (#24327) (#24326) (@ammachado)
- 5b8e4b5: feat(server): pass authenticated userId as header to extensions (#24356) (@agaudreault)
- 2229f9d: feat(ui): Add hydration in status to dashboard application tiles (#24319) (@adityaraj178)
- 13c47ee: feat(ui): Added repo connection state message (#24175) (@surajyadav1108)
- 72d054d: feat(ui): Requests info for Cpu and Mem added to Pod details (#20637) (@surajyadav1108)
- 762114c: feat(ui): Sort by application-sync-order in the list page (#23521) (#24191) (@downfa11)
- 97af89a: feat(ui): add prune option to application rollback (#23861) (#23932) (@anthisfan)
- 8d018bb: feat(ui): add sortable columns to application list (#24213) (#24535) (@downfa11)
- 6212ea2: feat(ui): adjust line-height and spacing for multi-line text in details row (#24173) (@jiwlee97)
- 26b970b: feat: Add gRPC health check in argocd-server (#24276) (@krapie)
- dcf1965: feat: Add health checks for Coralogix (#23853) (@daniel-leinov)
- 4e63bc7: feat: Adding ExtensionService health-check (#23576) (@solomon-kibret)
- be042c4: feat: AppSet PR generator return 0 results upon repo not found instead of failing (#23447) (@reggie-k)
- 3401d3b: feat: Export metrics to track number of users (#20801) (#23343) (@sathiya06)
- c447628: feat: Implement Altinity clickhouse-operat

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.11/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.11/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- b424210: fix(appset): do not trigger reconciliation on appsets not part of allowed namespaces when updating a cluster secret (cherry-pick #25622 for 3.1) (#25910) (@argo-cd-cherry-pick-bot[bot])
- cc053b2: fix(ci): bump golang.x/tools to v0.35.0 (#25955) (@nitishfy)
- 836d47f: fix: Only show please update resource specification message when spec… (cherry-pick #25066 for 3.1) (#25896) (@argo-cd-cherry-pick-bot[bot])
- 6c3f3ea: fix: Selecting repoType in dropdown doesn't do anything (#23747) (#25945) (@keithchong)
Other work
- 955ea1b: chore(cherry-pick-3.1): bump expr version from v1.17.5 to v1.17.7 (#25907) (@aali309)
- f22ccc2: chore(cherry-pick-3.1): bump go to 1.25.5 and bump expr to v1.17.7 (#25890) (@nitishfy)
- db2004f: ci: test against k8s 1.34.2 (cherry-pick #25856 for 3.1) (#25861) (@argo-cd-cherry-pick-bot[bot])
Full Changelog: v3.1.10...v3.1.11

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.9/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.9/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- 1904de5: fix(server): ensure resource health status is inferred on application retrieval (#24832) (cherry-pick #24851 for 3.1) (#24867) (@argo-cd-cherry-pick-bot[bot])
- a419e47: fix: don't show error about missing appset (cherry-pick #24995 for 3.1) (#24996) (@argo-cd-cherry-pick-bot[bot])
- e53196f: fix: make webhook payload handlers recover from panics (cherry-pick #24862 for 3.1) (#24914) (@argo-cd-cherry-pick-bot[bot])
Dependency updates
- 16ba5f9: chore(deps): bump redis from 7.2.7 to 7.2.11 to address vuln (release-3.1) (#24886) (@carlosrodfern)
Full Changelog: v3.1.8...v3.1.9

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.8/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.8/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- c63c2d8: fix(docs): include v3.1 upgrade docs (#23529) [backport] (#24799) (@SJrX)
- b2fa7dc: fix: #24781 update crossplane healthchecks to V2 version (cherry-pick #24782 for 3.1) (#24783) (@argo-cd-cherry-pick-bot[bot])
- 41eac62: fix: Clear ApplicationSet applicationStatus when ProgressiveSync is d… (#24715) (@aali309)
- 38808d0: fix: allow for backwards compatibility of durations defined in days (cherry-pick #24769 for 3.1) (#24771) (@argo-cd-cherry-pick-bot[bot])
- 54bab39: fix: update ExternalSecret discovery.lua to also include the refreshPolicy (cherry-pick #24707 for 3.1) (#24712) (@argo-cd-cherry-pick-bot[bot])
Other work
- 5c466a4: Merge commit from fork (@crenshaw-dev)
- 1a023f1: Merge commit from fork (@crenshaw-dev)
- 761fc27: Merge commit from fork (@crenshaw-dev)
- e20828f: Merge commit from fork (@thevilledev)
Full Changelog: v3.1.7...v3.1.8

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.7/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.7/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- 4081e29: fix(server): validate new project on update (#23970) (cherry-pick #23973 for 3.1) (#24662) (@argo-cd-cherry-pick-bot[bot])
- c26cd55: fix: Progress Sync Unknown in UI (cherry-pick #24202 for 3.1) (#24643) (@argo-cd-cherry-pick-bot[bot])
- 2e4458b: fix: limit number of resources in appset status (#24690) (#24696) (@alexmt)
- f3d59b0: fix: resolve argocdService initialization issue in notifications CLI (cherry-pick #24664 for 3.1) (#24681) (@argo-cd-cherry-pick-bot[bot])
Other work
- 7f92418: ci(release): only set latest release in github when latest (cherry-pick #24525 for 3.1) (#24685) (@argo-cd-cherry-pick-bot[bot])
Full Changelog: v3.1.6...v3.1.7

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.6/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.6/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- b46a57a: fix(oci): loosen up layer restrictions (cherry-pick #24640 for 3.1) (#24649) (@argo-cd-cherry-pick-bot[bot])
- 468870f: fix: Ensure that symlink targets are not made absolute on extracting a tar (#24145) - backport/cherry-pick to 3.1 (#24519) (@leh-ppi)
- cb95745: fix: correct post-delete finalizer removal when cluster not found (cherry-pick #24415 for 3.1) (#24590) (@argo-cd-cherry-pick-bot[bot])
- 2b3df7f: fix: use informer in webhook handler to reduce memory usage (#24622) (#24626) (@alexmt)
Documentation
- 4ef5663: docs: Delete dangling word in Source Hydrator docs (cherry-pick #24601 for 3.1) (#24603) (@argo-cd-cherry-pick-bot[bot])
Full Changelog: v3.1.5...v3.1.6

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.5/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.5/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Documentation
- 0415c60: docs: Update URL for HA manifests to stable. (#24454) (@Kelketek)
Other work
- 9a3235e: fix(3.1): change the appset namespace to server namespace when generating appset (#24478) (@nitishfy)
- c21141a: fix(cherry pick 3.1): RunResourceAction: error getting Lua resource action: built-in script does not exist #24491 (#24500) (@FourFifthsCode)
- 3320f1e: fix(cherry-pick-3.1): Do not block project update when a cluster referenced in an App doesn't exist (#24450) (@OpenGuidou)
Full Changelog: v3.1.4...v3.1.5

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.4/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.4/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Dependency updates
- 206d57b: chore(deps): bump gitops-engine (#24418) (@agaudreault)
Full Changelog: v3.1.3...v3.1.4

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.3/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.3/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Full Changelog: v3.1.2...v3.1.3

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.2/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.2/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- fe6efec: fix(appset): add applicationsets to the built-in readonly role (#24190) (#24318) (#24321) (@crenshaw-dev)
- 30d8ce6: fix(appset): prevent idle connection buildup by cloning http.DefaultTransport in Bitbucket SCM/PR generator (#24264) (@anandf)
- 7982a74: fix(discovery): add missing lua syntax and return to discovery (fixes #24257) - 3.1 (#24268) (@jan-mrm)
- 60c62a9: fix(security): repository.GetDetailedProject exposes repo secrets (#24391) (@crenshaw-dev)
- 20447f7: fix: downgrade go-git (#24288) (release-3.1) (#24317) (@blakepettersson)
Other work
- b3ad040: chore(cherry-pick-3.1): replace bitnami images (#24101) (#24286) (@nitishfy)
- ed9149b: fix(cherry-pick-3.1): custom resource health for flux helm repository of type oci (#24341) (@adberger)
- 6de4f77: fix(cherry-pick-3.1): handle missing resources on UI (#24357) (@pjiang-dev)
Full Changelog: v3.1.1...v3.1.2

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.1/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.1/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- b22566d: fix(lua): allow actions to add items to array (#24137) (@agaudreault)
- eb72a0b: fix(server): Send Azure DevOps token via git extra headers (#23478) (#23631) (#24223) (@rumstead)
- fdd0991: fix(util): Fix default key exchange algorthims used for SSH connection to be FIPS compliant (#24086) (cherry-pick 3.1) (#24166) (@anandf)
- c140eb2: fix: resolve argocd ui error for externalSecrets, fixes #23886 (#24232) (#24236) (@raweber42)
Other work
- a0f0653: chore: add oci env vars to manifests (#24113) (cherry-pick 3.1) (#24153) (@blakepettersson)
- 70dde2c: chore: cherry pick #24235 to release-3.1 (#24238) (@FourFifthsCode)
Full Changelog: v3.1.0...v3.1.1

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.0/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.1.0/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Features
- 6047e91: feat(AppProject): Add sync window description (#20766) (@speedfl)
- 999dbb2: feat(UI): add enabled field to explicitly set in automatedSync in SyncPolicy (#22482) (@aali309)
- 111da39: feat(actions): parametrized actions to scale workloads (#15505) (#20097) (@ratulbasak)
- 76a63a1: feat(api): protect static assets endpoint from symlink traversal (#22936) (@crenshaw-dev)
- 99faf82: feat(appset): add target branch support for bitbucket cloud pull request generator (#22402) (@mihallis)
- 64198e8: feat(ci): don't cancel-in-progress on master (#23392) (@crenshaw-dev)
- 6cf2961: feat(cli): Add Plugin Support to the Argo CD CLI (#20074) (@nitishfy)
- d14ba14: feat(cli): Adding whoami alias (#23385) (@christianh814)
- 7d66044: feat(health): Implement spinkube SpinApp CRD health checks (#21896) (@lukepatrick)
- 65464d8: feat(health): OpenTelemetryCollector CRD Healthcheck (#23156) (@savanipoojan78)
- 8f1f5c7: feat(health): add Logstash resource customization (#22028) (@fprovencherdrw)
- 96039be: feat(health): add Rabbitmq topology resource customizations (#22066) (@fprovencherdrw)
- 9149021: feat(health): add crossplane and upbound health checks (#21479) (#22919) (@crenshaw-dev)
- e578b85: feat(health): add kyverno Policy resource customization (#21552) (@marckhair)
- 7224a15: feat(helm): upgrade to 3.18.3 (cherry-pick #23618) (#23620) (@gcp-cherry-pick-bot[bot])
- 8eaccb7: feat(helm): upgrading helm to 3.18.4 (cherry-pick #23724) (#23731) (@gcp-cherry-pick-bot[bot])
- 81ae77a: feat(hydrator): commit tracing (#19441) (#23361) (@crenshaw-dev)
- d9ef10a: feat(hydrator): handle sourceHydrator fields from webhook (#19397) (#22485) (@alexymantha)
- 563d45b: feat(kustomize): upgrade to 5.7.0 (#23619) (#23625) (@crenshaw-dev)
- 2dafcba: feat(ui): add keydown event to the pod dropdown menu (#20996) (@vivian-xu)
- 3f3ac06: feat(ui): add toggle for fullname of resources in application-details-tree (#20812) (@surajyadav1108)
- bb37b10: feat(ui): allow to sort by age in Pod-view (#20783) (@surajyadav1108)
- 0e95193: feat(ui): allows more convenient sorting of repository. (#19829) (@bianbbc87)
- 30742f6: feat(ui): disable select not running pod and bring back arrow to selected pod (#21576) (@linghaoSu)
- 9675487: feat(ui): integrate Progressive Sync feature (#22781) (@aali309)
- eb794b7: feat(ui): set validate=false for "disable autosync" request during rollback via ui (#22898) (#23101) (@dlemfh)
- ceec669: feat(ui): support delete all expired token in project roles (#21782) (@linghaoSu)
- 2fbace3: feat(webhook): Fixed manifest-generate-paths annotation support for monorepos in BitBucket (#21811) (@anandf)
- 964f269: feat: Add GitHub API rate limit metrics (#22864) (@reggie-k)
- 18ce5c2: feat: Add images to resources in sync result #20896 (#20954) (@Aaron-9900)
- 6d7e75d: feat: Add link to get the list of applications of a cluster/project (#21561) (@almoelda)
- ce4b7a2: feat: Contour HTTPProxy health check support for issue # 22504 (#22596) (@gregbarasch)
- 2bd2488: feat: Enable SkipDryRunOnMissingResource sync option on Application level (#22679) (@pasha-codefresh)
- 5a3a104: feat: Implement grafana-operator Dashboard and Folder CRD health checks (#22493) (@

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.17/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.17/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- a85fa09: fix: correct post-delete finalizer removal when cluster not found (cherry-pick #24415 for 3.0) (#24589) (@argo-cd-cherry-pick-bot[bot])
- 97a8730: fix: use informer in webhook handler to reduce memory usage (#24622) (#24627) (@alexmt)
Documentation
- b729cff: docs: Update URL for HA manifests to stable. (#24455) (@Kelketek)
Other work
- 2a0282d: fix(3.0): change the appset namespace to server namespace when generating appset (#24479) (@nitishfy)
- 0af1833: fix(cherry-pick-3.0): Do not block project update when a cluster referenced in an App doesn't exist (#24449) (@OpenGuidou)
Full Changelog: v3.0.16...v3.0.17

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.16/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.16/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- 50befe9: fix(test): race condition in kubectl metrics (#23382) (#23383) (#24422) (@agaudreault)
Dependency updates
- 9982604: chore(deps): bump gitops-engine (#24419) (@agaudreault)
Full Changelog: v3.0.15...v3.0.16

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.13/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.13/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- b1df89b: fix(lua): allow actions to add items to array (#24136) (@agaudreault)
- 46e7c00: fix(server): Send Azure DevOps token via git extra headers (#23478) (#23631) (#24222) (@rumstead)
- 274ab28: fix(util): Fix default key exchange algorthims used for SSH connection to be FIPS compliant (#24086) (cherry-pick 3.0) (#24165) (@anandf)
- d76cede: fix: kustomize edit add component check (#24100) (cherry-pick 3.0) (#24103) (@blakepettersson)
- d11bf1a: fix: helm GetTags cache writing (cherry-pick #23865) (#23953) (@gcp-cherry-pick-bot[bot])
Documentation
- 7822fbd: docs: 3.0 migration - added remediation for explicitly syncing apps that use ApplyOutOfSyncOnly=true (cherry-pick #23918) (#23957) (@gcp-cherry-pick-bot[bot])
Other work
- d6e0e5c: chore: cherry pick #24235 to release-3.0 (#24237) (@FourFifthsCode)
- 3fb825c: chore: update Go to 1.24.6 (release-3.0) (#24092) (@thevilledev)
Full Changelog: v3.0.12...v3.0.13

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.12/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.12/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- fc27c4d: fix(appset): When Appset is deleted, the controller should reconcile applicationset #23723 (cherry-pick ##23823) (#23834) (@rumstead)
- 5e769f9: fix(metrics): Cherrypick grpc stats fix release 3.0 (#23889) (@pbhatnagar-oss)
Full Changelog: v3.0.11...v3.0.12

Note: due to build issues, release notes for 3.0.7-3.0.10 are consolidated here.
Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.11/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.11/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
- fix(azure): use compatible workload identity modules by @rumstead in #23004
- fix(applicationset): requeue applicationste when application status changes by @rumstead in #23412
- fix(server): Propagate useAzureWorkloadIdentity flag from during repo validation (#23348) by @rumstead in #23416
- Bump version to 3.0.7 on release-3.0 branch by @github-actions in #23428
- fix(goreleaser): add darwin with CGO enabled to gorelease by @rumstead in #23438
- Bump version to 3.0.8 on release-3.0 branch by @github-actions in #23451
- fix(goreleaser): add darwin with CGO enabled and remove static to gorelease (cherry-pick #23457) by @gcp-cherry-pick-bot in #23459
- Bump version to 3.0.9 on release-3.0 branch by @github-actions in #23462
- fix(appset): Add token to enterprise client (#23240) (cherry-pick #23455) by @gcp-cherry-pick-bot in #23476
- fix(controller): impersonation with destination name (#23309) (cherry-pick #23504) by @gcp-cherry-pick-bot in #23517
- fix: kustomize components + monorepos (cherry-pick #23486) by @gcp-cherry-pick-bot in #23539
- fix(controller): get commit server url from env (cherry-pick #23536) by @gcp-cherry-pick-bot in #23542
- fix(sync): auto-sync loop when FailOnSharedResource (#23357) by @agaudreault in #23639
- fix: improves the ui message when an operation is terminated due to controller sync timeout (cherry-pick #23657) by @gcp-cherry-pick-bot in #23671
- fix(server): infer resource status health for apps-in-any-ns (#22944) by @crenshaw-dev in #23706
- docs(images): add a note about missing images for 3.0 releases (#23612) (cherry-pick #23712) by @gcp-cherry-pick-bot in #23714
- fix(darwin): remove the need for cgo when building a darwin binary on linux (cherry-pick #23507) by @gcp-cherry-pick-bot in #23735
- docs(images): add a note about missing images for 3.0 releases (cherry-pick #23741) by @gcp-cherry-pick-bot in #23742
- fix(health): CRD health check message (#23690) (cherry-pick #23691) by @gcp-cherry-pick-bot in #23739
- Bump version to 3.0.10 on release-3.0 branch by @github-actions in #23744
- Bump version to 3.0.11 on release-3.0 branch by @github-actions in #23745
Full Changelog: v3.0.6...v3.0.11

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.6/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.6/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- fc271d4: fix(metrics): populate dest_server label (#23246) (#23269) (#23308) (@crenshaw-dev)
- 5c24b6b: fix(server): avoid unecessary claims restrictions (#22973) (3.0) (#23207) (@crenshaw-dev)
- 59d4519: fix(tls): validate RSA keys before marshaling (cherry-pick #23295) (#23300) (@gcp-cherry-pick-bot[bot])
- f72ac78: fix: Change workloadidentity token cache expiry based on token expiry (#23100) (#23264) (@agaudreault)
- a31d5c9: fix: parse project with applicationset resource (cherry-pick #23252) (#23267) (@gcp-cherry-pick-bot[bot])
Other work
- d98a0ca: chore(repo-server): unify semver resolution in new versions subpackage (#20216) (#23310) (@rouke-broersma)
- 001848e: chore: replace heptio-images with argocd-e2e-container (cherry-pick #23040) (#23058) (@nitishfy)
- 0ef49b6: chore: upgrade Go from 1.24.1 to 1.24.4 (release-3.0) (#23293) (@thevilledev)
Full Changelog: v3.0.5...v3.0.6

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.5/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.5/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- fe5869d: fix(hydrator): increase max msg size (cherry-pick #23190) (#23191) (@gcp-cherry-pick-bot[bot])
- 0e20cb6: fix: add cooldown to prevent resetting autoheal exp backoff preemptively (cherry-pick #23057) (#23189) (@gdsoumya)
Full Changelog: v3.0.4...v3.0.5

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.4/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.4/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
This release fixes a critical security issue: GHSA-2hj5-g64g-fp6p
Other work
- 040ed44: Merge commit from fork (@crenshaw-dev)
- c27a9d3: fix(commit-server): apply image override (cherry-pick #22916) (#22917) (@gcp-cherry-pick-bot[bot])
Full Changelog: v3.0.3...v3.0.4

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.3/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.3/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- af3d926: fix: Account for batch event processing in e2e tests (cherry-pick #22356) (#23070) (@gcp-cherry-pick-bot[bot])
- ddd6df5: fix: infinite reconciliation loop when app is in error (#23067) (@agaudreault)
- 927ed35: fix: remove default spec.preserveUnknownFields ignoreDifference for CRD (cherry-pick #22948) (#23044) (@gcp-cherry-pick-bot[bot])
Documentation
- b1cafa9: docs: fix jsonpath in 2.14-3.0 upgrade doc (cherry-pick #23045) (#23046) (@gcp-cherry-pick-bot[bot])
Other work
- 866db14: chore: bump gitops-engine ssd fix (#23071) (@pjiang-dev)
Full Changelog: v3.0.2...v3.0.3

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.2/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.2/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- 3fb34b9: fix(haproxy): setting maxconn in haproxy config cherry-pick (#15319) (#18283) (#23037) (@reggie-k)
- cca991a: fix(test): broken e2e test (cherry-pick #22975) (#23017) (@gcp-cherry-pick-bot[bot])
- 90e9d1a: fix: settings request doesn't return default tracking method (#22965) (cherry-pick) (#23034) (@oleksandr-codefresh)
Documentation
- 3d37cfa: docs(server): no resource health when using the list api (cherry-pick #22954) (#22972) (@gcp-cherry-pick-bot[bot])
Full Changelog: v3.0.1...v3.0.2

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.1/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.1/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- edd2358: fix(docs): upgrading 3.0 docs (cherry-pick #22891) (#22894) (@gcp-cherry-pick-bot[bot])
- cb5d6f5: fix(health): handle nil lastTransitionTime (#22897) (cherry-pick #22900) (#22908) (@gcp-cherry-pick-bot[bot])
- 2913d5f: fix: Race condition in nativeGitClient.LsFiles (issue #21754) (cherry-pick #22878) (#22906) (@gcp-cherry-pick-bot[bot])
Full Changelog: v3.0.0...v3.0.1

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.0/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.0.0/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Release Notes Blog Post
For a detailed breakdown of the key changes and improvements in this release, check out the official blog post
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Features
- 402802b: feat!: Logs rbac enforce by default (#21678) (@reggie-k)
- cca7485: feat!: update compareoptions default values (#22230) (@agaudreault)
- 029927b: feat(appcontroller): store application health status in redis by default (#10312) (#21532) (@rumstead)
- f775e7b: feat(appset): Add values to PR generator (#21557) (@dudo)
- b9131c1: feat(cmp): pass empty env vars to plugins (#18720) (#22096) (@crenshaw-dev)
- ac50d8e: feat(config)!: exclude known interim resources by default (#20013) (#21635) (@agaudreault)
- 910b951: feat(controller): enable batch event processing by default (#22338) (@crenshaw-dev)
- 7edaef5: feat(helm): upgrading helm to 3.17.0 (#21722) (@rumstead)
- 3d2c010: feat(hydrator): handle sourceHydrator fields from webhook (#19397) (cherry-pick #22485) (#22753) (@gcp-cherry-pick-bot[bot])
- 88e43cb: feat(kubectl): upgrading kubectl to 1.32.1 (#21724) (@rumstead)
- c675757: feat(kustomize): support --include-templates for labels (#15283) (#22069) (@crenshaw-dev)
- 6f9389c: feat(log): support match case in pod log search (#21919) (@linghaoSu)
- feb7097: feat(metrics): add more kubectl metrics (#21720) (@crenshaw-dev)
- 606bd5b: feat(rbac)!: disable fine-grained inheritance by default (#19988) (#20671) (@fffinkel)
- e3bd569: feat(server): make deep copies of objects returned by informers (#22173) (#22179) (@rumstead)
- 7296201: feat(ui): Added link to start page in argo logo (#21461) (@surajyadav1108)
- 6d27928: feat(ui): highlight log lines by pod name (#21001) (@aali309)
- b8508f2: feat(ui): rename filter message status on SYNC STATUS view (#21061) (@aali309)
- 55f8a43: feat(ui): split arrays in yaml to fix ambiguous collapse when array items have nested objects (#21064) (@aali309)
- 0fab3cf: feat(ui): support display sync wave (#20614) (@linghaoSu)
- 922c9e9: feat(ui): support filter repo when input (#21451) (@linghaoSu)
- 89c4817: feat: Add support for Azure workload identity for Git and OCI repositories. (#21118) (@jagpreetstamber)
- f9ffb6a: feat: Added env reference objects to manifests for otlp.attrs (#21563) (@almoelda)
- 0973409: feat: Kustomize ignore missing components (#18634) (#21674) (@bradkwadsworth)
- 74b3532: feat: Make certain Status panel items look more 'clickable' (#19698) (#22232) (@keithchong)
- c0b2787: feat: Support kube 1.32 (#21805) (@sivchari)
- d301b40: feat: Upgrade notifications engine (#22273) (@sivchari)
- c9c4068: feat: add AND operator opt-in option for sync windows matches (#16846) (@adriananeci)
- f258c45: feat: add ARGOCD_APP_PROJECT_NAME to the build environment (#15185) (#21586) (@MacroPower)
- c71dd1a: feat: add a check for user defined role referential integrity (#21065) (@devopsjedi)
- 8044d68: feat: add bearer token auth (#21462) (@reggie-k)
- fa0b5f5: feat: add force promote actions for Numaplane rollouts (#22141) (@dpadhiar)
- e4311d8: feat: add name and labels in cluster metrics (#17870) (#18453) (@flbla)
- ecb9dba: feat: add support for azure workload identity in Microsoft Entra SSO (#21433) (@jagpreetstamber)
- 951d9d3: feat: add the --redis-compress as the global flag to set redis compression. (#21786) (@nitishfy)
- 561cbef: feat: checking user defined roles and policies for referen

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.18/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.18/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- caa4dc1: fix(util): Fix default key exchange algorthims used for SSH connection to be FIPS compliant (#24499) (@anandf)
- 4f6686f: fix: correct post-delete finalizer removal when cluster not found (cherry-pick #24415 for 2.14) (#24591) (@argo-cd-cherry-pick-bot[bot])
- 4359b3c: fix: use informer in webhook handler to reduce memory usage (#24622) (#24628) (@alexmt)
Documentation
- 3d76aa5: docs: Update URL for HA manifests to stable. (#24456) (@Kelketek)
Other work
- 981e7f7: fix(2.14): change the appset namespace to server namespace when generating appset (#24481) (@nitishfy)
Full Changelog: v2.14.17...v2.14.18

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.14/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.14/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- a2361bf: fix: add cooldown to prevent resetting autoheal exp backoff preemptively (cherry-pick #23057) (#23188) (@gdsoumya)
- 14fa0e0: fix: parse project with applicationset resource (cherry-pick #23252) (#23268) (@gcp-cherry-pick-bot[bot])
- 2aceb1d: fix: update broken yarn.lock (#23212) (@svghadi)
Other work
- 3c68b26: chore: upgrade Go from 1.23.4 to 1.24.4 (release-2.14) (#23294) (@thevilledev)
- e24ee58: chore: upgrade golangci-lint to v2 (release-2.14) (#23305) (@thevilledev)
- 5f89062: chore: upgrade mockery to v2.53.4 (release-2.14) (#23316) (@thevilledev)
Full Changelog: v2.14.13...v2.14.14

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.13/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.13/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Other work
- 24d5722: Merge commit from fork (@crenshaw-dev)
- d213c30: chore: bump gitops-engine ssd fix (#23072) (@pjiang-dev)
Full Changelog: v2.14.12...v2.14.13

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.12/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.12/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- f7ad2ad: fix(ApplicationSet): Check strategy type to verify it's a progressive sync (cherry-pick #22563) (#22833) (@gcp-cherry-pick-bot[bot])
- ced6a78: fix(health): handle nil lastTransitionTime (#22897) (cherry-pick #22900) (#22909) (@gcp-cherry-pick-bot[bot])
- 25235fb: fix(test): broken e2e test (cherry-pick #22975) (#23052) (@gcp-cherry-pick-bot[bot])
- 78e61ba: fix: Only port-forward to ready pods (#10610) (cherry-pick #22794) (#22826) (@mikebryant)
- fe93963: fix: do not normalize resource tracking on live crds (#22722) - cherrypick 2.14 (#22746) (@blakepettersson)
- 5bc6f47: fix: infinite reconciliation loop when app is in error (#23047) (@agaudreault)
- b163de0: fix: remove project from cache key for project scoped credentials (#22816) (@pjiang-dev)
Dependency updates
- efe5d29: chore(deps): resolve CVE GO-2025-3540, GO-2025-3503, GO-2025-3487 within 2.14.10 (#22709) (@nathanlaceyraft)
Other work
- 3a9ab77: fix(commit-server): apply image override (cherry-pick #22916) (#22918) (@gcp-cherry-pick-bot[bot])
Full Changelog: v2.14.11...v2.14.12

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.11/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.11/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Features
- 91f5445: feat(hydrator): handle sourceHydrator fields from webhook (#19397) (cherry-pick #22485) (#22754) (@gcp-cherry-pick-bot[bot])
Bug fixes
- 0451723: fix(appset): generated app errors should use the default requeue (#21887) (cherry-pick #21936) (#22672) (@gcp-cherry-pick-bot[bot])
- f6f7d29: fix(ui): avoid spurious error on hydration (#22506) (cherry-pick #22711) (#22714) (@gcp-cherry-pick-bot[bot])
Full Changelog: v2.14.10...v2.14.11

## Quick Start

### Non-HA:

```bash
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.10/manifests/install.yaml
```

### HA:

```bash
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.10/manifests/ha/install.yaml
```

## Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for
container images and CLI binaries which meet the SLSA Level 3 specifications.
See the documentation on how to verify.

## Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

## Changelog

### Bug fixes

- b31d700: fix(cli): wrong variable to store --no-proxy value (cherry-pick #21226) (#22590)
(@gcp-cherry-pick-bot[bot])
- 6b15a04: fix: [cherry-pick] selfhealattemptscount needs to be reset at times (#22095, #20978)
(#22583) (@Aaron-9900)
- be81419: fix: login return_url doesn't work with custom server paths (cherry-pick #21588)
(#22594) (@gcp-cherry-pick-bot[bot])
- 3b308d6: fix: respect delete confirmation for argocd app deletion (cherry-pick #22657)
(#22664) (@gcp-cherry-pick-bot[bot])

### Dependency updates

- 4826fb0: chore(deps): Update github.com/expr-lang/expr to v1.17.0 fixing CVE-2025-29786
(#22651) (@heshamelsherif97)

#### Full Changelog: https://github.com/argoproj/argo-cd/compare/v2.14.9...v2.14.10

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.9/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.9/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- 31a5545: fix: Check for semver constraint matching in application webhook handler (cherry-pick #21648) (#22508) (@gcp-cherry-pick-bot[bot])
Other work
- c868711: chore(dep): bump gitops-engine 2.14 (#22520) (@pjiang-dev)
Full Changelog: v2.14.8...v2.14.9

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.8/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.8/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- 9a9e62d: fix(server): fully populate app destination before project checks (#22408) (#22426) (@crenshaw-dev)
- 7acdaa9: fix: CVE-2025-26791 upgrading redoc dep to 2.4.0 to avoid DOMPurify b… (#21997) (@nmirasch)
- 872319e: fix: handle annotated git tags correctly in repo server cache (#21771) (#22424) (@aali309)
Dependency updates
- 9f832cd: chore(deps): bump github.com/golang-jwt/jwt to 4.5.2/5.2.2 (#22465) (@crenshaw-dev)
Other work
- ec45e33: fix(ui, rbac): project-roles (#21829) (2.14 backport) (#22461) (@blakepettersson)
Full Changelog: v2.14.7...v2.14.8

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.7/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.7/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Dependency updates
- 3940782: chore(deps): bump gitops engine (#22405) (@crenshaw-dev)
Full Changelog: v2.14.6...v2.14.7

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.3/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.3/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- aaed35c: fix(applicationset): ApplicationSets with rolling sync stuck in Pending (cherry-pick #20230) (#21948) (@gcp-cherry-pick-bot[bot])
- d79185a: fix(hydrator): don't get cluster or API versions for hydrator (#21985) (#22038) (@crenshaw-dev)
- 2dd70de: fix(hydrator): don't use manifest-generate-paths (#22039) (cherry-pick #22015) (#22061) (@gcp-cherry-pick-bot[bot])
- 3adb83c: fix(hydrator): refresh by annotation instead of work queue (#22016) (#22067) (@crenshaw-dev)
- 71fd4e5: fix: Check placement exists before length check (#22060) (cherry-pick #22057) (#22089) (@gcp-cherry-pick-bot[bot])
- 896a461: fix: New kube applier for server side diff dry run with refactoring (#21488) (#21819) (@andrii-korotkov-verkada)
- 63edc3e: fix: accidental v3 imports (#22068) (@crenshaw-dev)
- cb1df5d: fix: correct lookup for the kustomization file when applying patches (cherry-pick #22024) (#22086) (@nitishfy)
- 92a3c3d: fix: correctly set compareWith when requesting app refresh with delay (fixes #18998) (cherry-pick #21298) (#21952) (@gcp-cherry-pick-bot[bot])
- 8f925c6: fix: fetch syncedRevision in UpdateRevisionForPaths (#21014) (cherry-pick #21015) (#22011) (@gcp-cherry-pick-bot[bot])
Documentation
- b5be1df: docs: document source hydrator maturity (cherry-pick #21969) (#21970) (@gcp-cherry-pick-bot[bot])
Other work
- 2b422d2: chore: add cherry pick for v2.14 (#21901) (@nitishfy)
Full Changelog: v2.14.2...v2.14.3

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.2/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.2/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- efd9c32: fix: Add proxy registry key by dest server + name (cherry-pick #21791) (#21794) (@gcp-cherry-pick-bot[bot])
Full Changelog: v2.14.1...v2.14.2

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.12.13/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.12.13/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- 3033ba1: fix(security): repository.GetDetailedProject exposes repo secrets (#24387) (#24461) (@alexmt)
Dependency updates
- 46fcb4f: chore(deps): bump slsa-framework/slsa-github-generator from 2.0.0 to 2.1.0 (#23166) (#24471) (@alexmt)
- 94e7134: chore(deps): update github.com/antonmedv/expr v1.15.2 to github.com/expr-lang/expr v1.17.0 (#22611) (@aali309)
Full Changelog: v2.12.12...v2.12.13

Quick Start
Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.12.6/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.12.6/manifests/ha/install.yaml

Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries
which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Bug fixes
- fix: avoid cache miss in server-side diff (#20423) (#20424) (#20450) (@gcp-cherry-pick-bot[bot])
- fix: don't disable buttons for multi-source apps (#20446) (#20448) (@gcp-cherry-pick-bot[bot])
Full Changelog: https://github.com/argoproj/argo-cd/compare/v2.12.5...v2.12.6

Quick Start
Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.12.4/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.12.4/manifests/ha/install.yaml

Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.Changelog
Bug fixes
- fix(appset): Fix perpetual appset reconciliation (#19822) (#19995) (@gcp-cherry-pick-bot[bot])
- fix: CVE-2024-45296 Backtracking regular expressions cause ReDoS by upgrading path-to-regexp from 1.8.0 to 1.9.0 (#20087) (#20090) (@gcp-cherry-pick-bot[bot])
- fix: diffing should not fail if resource fail schema validation (#19714) (#19729) (@gcp-cherry-pick-bot[bot])
Documentation
- docs: note cluster scoping changes in 2.12x (#19684) (#19702) (@gcp-cherry-pick-bot[bot])
Dependency updates
- cherry-pick chore(deps-dev): bump webpack from 5.84.1 to 5.94.0 in /ui (#20056) (@ishitasequeira)
- chore(deps): bump dompurify from 2.3.6 to 2.5.6 in /ui (#19955) (#20016) (@gcp-cherry-pick-bot[bot])
- chore(deps): bump express from 4.19.2 to 4.20.0 in /ui (#19883) (#19987) (@chengfang)
Full Changelog: https://github.com/argoproj/argo-cd/compare/v2.12.3...v2.12.4

Quick Start
Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.3/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.11.3/manifests/ha/install.yaml

Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.Changelog
Bug fixes
- fix: app names with non-alphanumeric characters in position 63 break syncs (issue #18237) (#18256) (#18439) (@gcp-cherry-pick-bot[bot])
Other work
- Merge pull request from GHSA-3cqf-953p-h5cp (@pasha-codefresh)
- Merge pull request from GHSA-87p9-x75h-p4j2 (@blakepettersson)
- fix source ordering issue in manifest generation for multi-source app while using manifests and diff commands (#18395) (#18408) (@gcp-cherry-pick-bot[bot])
Full Changelog: https://github.com/argoproj/argo-cd/compare/v2.11.2...v2.11.3

Quick Start
Non-HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.10.19/manifests/install.yaml
HA:
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.10.19/manifests/ha/install.yaml
Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.
Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.
Changelog
Bug fixes
- a80f192: fix(security): repository.GetDetailedProject exposes repo secrets (#24387) (#24462) (@alexmt)
Full Changelog: v2.10.18...v2.10.19

Quick Start
Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.10.4/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.10.4/manifests/ha/install.yaml

Release Signatures and Provenance
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.Upgrading
If upgrading from a different minor version, be sure to read the upgrading documentation.Changelog
Full Changelog:

What's Changed
- fix(14912): Fix helm valuesObject with ApplicationSet (cherry-pick #14920) by @gcp-cherry-pick-bot in #15175
- fix: stop creating new otel interceptor to avoid memory leak (cherry-pick #15174) by @gcp-cherry-pick-bot in #15178
- fix(ui): switch podgroup notification to tooltip message (cherry-pick #14821) by @gcp-cherry-pick-bot in #15224
- fix: spec.executor.instances is Optional, Support a flexible number of executors (cherry-pick #11877) by @gcp-cherry-pick-bot in #15200
- fix(appset): bitbucket server scm provider EOF on empty repo (cherry-pick #14411) by @gcp-cherry-pick-bot in #15203
- fix(appset): requeue ApplicationSet if there are validation errors (#14184) (cherry-pick #14429) by @gcp-cherry-pick-bot in #15206
- docs: add example jq path expression (cherry-pick #15130) by @gcp-cherry-pick-bot in #15209
- docs: document sourceNamespaces field (cherry-pick #15195) by @gcp-cherry-pick-bot in #15212
- fix(ui): Update default and max count for maxCookieNumber (cherry-pick #14979) by @gcp-cherry-pick-bot in #15230
- Bump version to 2.8.2 on release-2.8 branch by @github-actions in #15232

Changelog
Features
- : feat: add css to support external custom style (#13279) (#13746) (@gcp-cherry-pick-bot[bot])
- : feat: add ssh.github.com to SSH known hosts (#13592) (#13765) (@gcp-cherry-pick-bot[bot])
Bug fixes
- : fix(appset): add ApplicationSet ProgressiveSync handling to clean up old appStatus entries when Applications are removed or RollingSync is disabled (#13419) (#13759) (@gcp-cherry-pick-bot[bot])
- : fix(appset): Post selector with Go templates in ApplicationSet (cherry-pick #13584) (#13822) (@m13t)
- : fix(appset): allow cluster urls to be matched (#13715) (#13770) (@blakepettersson)
- : fix(doc): deep links example fix (#13855) (#13857) (@gcp-cherry-pick-bot[bot])
- : fix(kustomize): allow using build env in images (#13745) (#13756) (@gcp-cherry-pick-bot[bot])
- : fix(ui): Fix Link warnings (#13694) (#13854) (#13890) (@gcp-cherry-pick-bot[bot])
- : fix(ui): Patch Resource missing appNamespace (#13839) (#13840) (@gcp-cherry-pick-bot[bot])
- : fix(ui): Stop using the deprecated url format for gitlab instances (#13687) (#13767) (@gcp-cherry-pick-bot[bot])
- : fix: CMPv2 does not allow symlinks to adjacent files in same git repo.
Fixes #13342 (#13360) (#13669) (@gcp-cherry-pick-bot[bot])
- : fix: CVE-2023-1732 (#13748) (#13893) (@jmeridth)
- : fix: Regression in signature verification for git tags (#12797) (#13113) (@gcp-cherry-pick-bot[bot])
- : fix: argocd app sync/wait falsely failed with completed with phase: Running (#13637) (#13672) (@gcp-cherry-pick-bot[bot])
- : fix: do not replace namespaces (#13758) (#13769) (@blakepettersson)
- : fix: ensure repositories are correctly marked with inherited creds in CLI output (#13428) (#13789) (@gcp-cherry-pick-bot[bot])
Documentation
- : docs: Fixed titles in app deletion doc (#13469) (#13782) (@gcp-cherry-pick-bot[bot])
- : docs: Update disaster_recovery.md to reflect quay.io as docker container registry (#13520) (#13790) (@gcp-cherry-pick-bot[bot])
- : docs: add helm values declarative syntax (#13661) (#13778) (@gcp-cherry-pick-bot[bot])
- : docs: correct indentation for gke ingress (#13680) (#13761) (@gcp-cherry-pick-bot[bot])
- : docs: fix deep links docs formatting (#13747) (#13837) (@gcp-cherry-pick-bot[bot])
- : docs: fix incorrect instructions for site documentation (#13209) (#13773) (@gcp-cherry-pick-bot[bot])
- : docs: redirect old CMP page to new one (#13877) (#13878) (@gcp-cherry-pick-bot[bot])
- : docs: update openunison authChainName (#13531) (#13793) (@gcp-cherry-pick-bot[bot])
Other work
- : fix(appset) [ISSUE-13501] adjust NotIn operator behavior of AppSet Progressive Syncs to match documentation (#13551) (#13760) (@gcp-cherry-pick-bot[bot])

Changelog
Bug fixes
- : fix: interpolate gen fix (#12716) (#13061) (#13485) (@gcp-cherry-pick-bot[bot])
- : fix: surface errors when compressing files (#13491) (#13494) (@gcp-cherry-pick-bot[bot])
- : fix: update log view on container select (#13474) (#13546) (@gcp-cherry-pick-bot[bot])
Documentation
- : docs: fix typo (#12960) (#13436) (@gcp-cherry-pick-bot[bot])