Argo

v3.5.1CI/CD & App Delivery

Aug 12, 2026

This release contains routine correctness fixes and a security fix in the server. The security change concerns users of the `SSD CLI`.

Action needed (1)

securitySSD CLI secret-mask spoofing prevention
The server prevents secret-mask spoofing in the SSD CLI. This fix ships in Argo CD v3.5.1.

All 7 other recorded changesfixes 7

* 33f3bc59faeec96204cda3a5ae211be17d15f1ac: fix(appset): stop progressive sync reconciling in a tight loop (#27577) (#29139) (@himeshp)
* d358e75b3539c3fc43eb2372317bde7a0d01c55f: fix(appset): verify terminating Applications against the API server (#29042) (#29138) (@himeshp)
* ecf37373a9d3a72b259a73abfee7ce27226b960a: fix(controller): cherry-pick treat timeout.reconciliation=0 as disabled soft expiry (#27683) (#29007) (@aali309)
* 978fa65006565baaaf35894918fd661d610f5953: fix(controller): reuse server-side diff result when masking Secret data (#27858) (#29074) (@1ovsss)
* f399c84f85fc4e3a19ac1e8314ff111493d26fee: fix(controller): use diff cache when timeout.reconciliation is disabled (cherry-pick #29073 for 3.5) (#29158) (@argo-cd-cherry-pick-bot[bot])
* 9f360f4953a1dc0f3474aa9c482d72366863ea33: fix(ssd): hide secret in last-applied-configuration annotation (#28989) (#29052) (@pjiang-dev)
* b44fbbc2e040e303c18a69182fd5dbe2c36cfdf9: fix(manifest-generate-paths): Consistent gen manifest cache key (#28074 and #29037) (#29049) (@agaudreault)

Add Argo to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.