Argo
v3.5.0CI/CD & App DeliveryArgo CD v3.5.0 is a major feature release centered on a Helm 3 to Helm 4 migration and several feature promotions (Source Hydrator to beta, ApplicationSet-in-any-namespace to stable, Impersonation to beta). A dompurify DOM flaw is patched; most other changes are enhancements and internal fixes.
breakingHelm integration migrated from Helm 3 to Helm 4
Argo CD now uses Helm 4 instead of Helm 3. Operators managing Helm charts through Argo CD should test for compatibility with Helm 4 behavior, including any changes to chart rendering, value merging, or plugin behavior that may differ from Helm 3. The migration ships in v3.5.0.
securityDOM purification vulnerability fixed in UI (CVE-2026-41240)
A DOM purification flaw in dompurify (CVE-2026-41240) is fixed via an update to v3.4.0 in the UI. The fix ships in v3.5.0.
Key changes (7)
- Helm integration migrated from Helm 3 to Helm 4; test chart rendering and plugin compatibility
- Security: dompurify DOM purification vulnerability fixed (CVE-2026-41240)
- Source Hydrator promoted to beta with opt-in source integrity verification
- ApplicationSet-in-any-namespace promoted to stable
- Impersonation feature promoted to beta with option to disable strict enforcement
- mTLS support added to repo-server; Azure Service Principal authentication for Azure DevOps
- Webhook refresh jitter, ApplicationSet concurrency, health checks for six resource types, and RBAC regression fix
A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.