RATATOSKRATATOSK
Sign in

Argo

v3.6.0CI/CD & App Delivery
Nov 3, 2026

ACTION 4CHECK 1PLAN 1OTHER 418

A substantial feature release adds integrations, health checks, observability, UI and configuration capabilities, along with correctness fixes and dependency refreshes. Operators using the in-process server should note the changed `SyncWithReplaceAllowed` default, and the release includes coordinated security updates.

Action needed (4)

  • securitymediumThe DOMPurify dependency, updated for CVE-2026-49978

    The DOMPurify dependency is updated to 3.4.7 for CVE-2026-49978.

  • securityCoordinated security fixes

    Argo CD includes coordinated security fixes for the 3.6 release.

  • securitySSD CLI secret mask spoofing prevention

    The server prevents secret mask spoofing in the SSD CLI.

  • breakingThe SMD option, removed

    The release defaults to SSD with SSA and removes SMD.

Check if affected (1)

  • breakingThe SyncWithReplaceAllowed default

    Applies if you run an in-process server.

    SyncWithReplaceAllowed is enabled by default for the in-process server.

Plan ahead (1)

  • deprecatedThe --signature-keys deprecation warning

    Applies if you use --signature-keys.

    The release adds a deprecation warning when you use --signature-keys.

All 418 other recorded changesfixes 183 · value changes 140 · additions 78 · constraints 9 · renames 4 · removals 3 · defaults 1

fixes (183)

  • * dcf03494eff98102a44ea10f1a66d80b8644b948: fix(UI): display sync option dropdowns on separate lines (#28438) (@adityaraj178)
  • * 99f4efc2588306b1d34260295dba7564cc49e529: fix(actions): list Rollout actions when the Rollout has no status (#30291) (cherry-pick #30331 for 3.6) (#30652) (@argo-cd-cherry-pick-bot[bot])
  • * d42eb204e3c2fb6818d562cefab38f03ff33dde8: fix(app): ensure deletion message is printed only for text output fomat (cherry-pick #30600 for 3.6) (#30618) (@argo-cd-cherry-pick-bot[bot])
  • * 20ad5f9922600aaa54b82daa4cd7a5e3f63a709f: fix(application): use server-side timeout query parameter via transport wrapper (#28828) (#28977) (@luwangVMW)
  • * 3bc9cb6ce0cb378dda87637df7aad8b9dcd7649d: fix(appset): do not expose reserved cluster annotations as parameters (cherry-pick #30448 for 3.6) (#30481) (@argo-cd-cherry-pick-bot[bot])
  • * 9bb331250c0d3f8d47d337208866afca93f86b73: fix(appset): don't release finalizer while children still terminate (#28999) (@blakepettersson)
  • * 777f9132b73d6f9b93798f6c4900556c36b1cf7f: fix(appset): fail reverse deletion when a stale cache entry cannot be evicted (#29042) (#29140) (@himeshp)
  • * fea95e66c423f71c393f1303dc6a2a85a858b5d5: fix(appset): fall back to create when patch returns NotFound (#17312) (#28645) (@rickbrouwer)
  • * a619eb81d99e872ba1637e0003f69aeb096bff27: fix(appset): make ParametersGenerated condition message consistent (#30405) (cherry-pick #30438 for 3.6) (#30577) (@argo-cd-cherry-pick-bot[bot])
  • * d1a941e7095d8da75c0ccf53d1af879391252fe8: fix(appset): refresh GitLab pull request generators configured with the project path (#13766) (cherry-pick #30578 for 3.6) (#30623) (@argo-cd-cherry-pick-bot[bot])
  • * a822683efd4a73360b5643b6a2d53d2f2326ee7e: fix(appset): restore ignoreApplicationDifferences after normalization (#29070) (@pjiang-dev)
  • * 3be29876ba77072cfbf4585b2d8a28b2d0912a1a: fix(appset): stop progressive sync reconciling in a tight loop (#27577) (#29044) (@himeshp)
  • * 4891d4f4745ae87b9aebd2577d0fe5a3433b8aab: fix(appset): throw error when generated apps have empty name (#28833) (@nitishfy)
  • * 29faea2da97274e1eba16bd87d026eb50f942880: fix(appset): verify terminating Applications against the API server (#29042) (#29043) (@himeshp)
  • * 780d5405a3c3df162db028334689888c91f7a94f: fix(cli): accept write-repositories in 'argocd admin settings rbac can' (#30457) (cherry-pick #30458 for 3.6) (#30550) (@argo-cd-cherry-pick-bot[bot])
  • * 7b445c1b182592cfc0f6d6e0869213fa1beefbdb: fix(cli): honor HTTP_PROXY/HTTPS_PROXY/NO_PROXY for gRPC-web connections (cherry-pick #29642 for 3.6) (#30498) (@argo-cd-cherry-pick-bot[bot])
  • * 67c4a1237cc0a8bc901eca437823aca1de753ccc: fix(cli): send --header values when refreshing an expired auth token (#30061) (#30511) (@nitishfy)
  • * bb33bb0d1e724bac9e6964af98c76cebe5ab6be9: fix(cli): skip stale destinations in cluster stats (#21808) (#28786) (@AkashKumar7902)
  • * 752958a526cc2055d7b89293016f31dfe7264e35: fix(cmp): clean up tgz stream temporary directories (#29148) (cherry-pick #29156 for 3.6) (#29772) (@argo-cd-cherry-pick-bot[bot])
  • * e76a5d853f50a9605fdd66e8197f66687c14e6f3: fix(controller): allow terminating an operation blocked by a sync window (#26395) (cherry-pick #30267 for 3.6) (#30505) (@argo-cd-cherry-pick-bot[bot])
  • * adbc3dcdc699fb9732ef67b4e27db61a68cc49ce: fix(controller): confirm project references before blocking deletion (cherry-pick #29737 for 3.6) (#29743) (@argo-cd-cherry-pick-bot[bot])
  • * 5f4e24ec353399da81664ea1e04e9c758de21579: fix(controller): correct metrics flag help names. (#28358) (@siddiksawani)
  • * 28334d185e594be8b4b6bae8bbe428316aeb078c: fix(controller): dropping refresh requests during reconcile (#28603) (#28414) (@dudinea)
  • * d419d3b548b916e88b2053f30f9a5ddfc23e3fe6: fix(controller): honor manifest-generate-paths for shallow-cloned repositories (cherry-pick #30485 for 3.6) (#30565) (@argo-cd-cherry-pick-bot[bot])
  • * cb99c80a553aa3eb25b38a8216ddac0b16aa3013: fix(controller): reuse server-side diff result when masking Secret data (#27858) (@1ovsss)
  • * fcb97d8c8c617dc58560b59e7cb9a47dabb9c2aa: fix(controller): rewrite resource tree when an app moves back to a controller (cherry-pick #30313 for 3.6) (#30382) (@argo-cd-cherry-pick-bot[bot])
  • * f8c252b09b2c0213d1635d4f8417dd2d37f66768: fix(controller): show retry wait time in unambiguous format (#29534) (@nitishfy)
  • * b9e9d4117c89a97c84afc98022d1ccef867637c5: fix(controller): treat timeout.reconciliation=0 as disabled soft expiry (#27683) (@aali309)
  • * f4adccd118f0ee0aa8a0149f94db56cc14f9cacd: fix(controller): use diff cache when timeout.reconciliation is disabled (#29073) (@aali309)
  • * 360aa9ba318d11a3c8805561d5fe7b7b771871a8: fix(diff): don't drop manager-owned descendant fields when filtering webhook mutations (#28819) (@pujitha24)
  • * c56c41bbdc47821bb47dd22c7da142b29bae0918: fix(exec): don't leak a goroutine when a command times out without waiting (cherry-pick #30394 for 3.6) (#30433) (@argo-cd-cherry-pick-bot[bot])
  • * de72f7a087d5b2e2c61086361a655b0dae88f0f2: fix(git): send SIGTERM before SIGKILL when a git command is cancelled (cherry-pick #30393 for 3.6) (#30410) (@crenshaw-dev)
  • * 1bb9bd33df59a383f0840d180b32aed2c1c2d3b2: fix(grpc): a workaround to fix SRV _grpclb._tcp SRV lookups (#29989) (cherry-pick #30084 for 3.6) (#30169) (@argo-cd-cherry-pick-bot[bot])
  • * fd04feb4b2b795fcabc67ceb41bffd121c37ad0a: fix(health): AWSManagedControlPlane reports Healthy while EKS control plane is updating (#28936) (#28937) (@moko-poi)
  • * e238e1a4e6aec5285cdfd1b81c6f61dc2c5dd87d: fix(health): Crossplane MRs should report Progressing (not Healthy) whilst provisioning (#29381) (#29382) (@kjothen)
  • * 381b41866746fe7c5161091ddfa40739dbe2142c: fix(health): PromotionStrategy and ChangeTransferPolicy Healthy, not Progressing (#28434) (@crenshaw-dev)
  • * ae1fc9969313e39242663ed6a1b0d6f408456dfc: fix(health): ResourceBinding health check for dependency-propagated bindings (#28299) (@pncloud)
  • * 785005d9096eecd0ce2e2f1af192cb5bf2600324: fix(health): a KubeVirt VirtualMachine declared stopped is Healthy (#29664) (@daixtrose)
  • * d4f229e281f8455d90b2915e55eb908c39cc37d9: fix(health): handle Crossplane Providers missing the Installed or Healthy condition (#23363) (cherry-pick #30429 for 3.6) (#30628) (@argo-cd-cherry-pick-bot[bot])
  • * fd151ade5462d88fa8ffefd51aa14c2e6f9b7ecd: fix(health): report CRDs that are not established yet as Progressing (#26346) (cherry-pick #30441 for 3.6) (#30576) (@argo-cd-cherry-pick-bot[bot])
  • * 9cc2dd35602a955a41c78bbc7f026f776d92379a: fix(health): report inactive Crossplane ManagedResourceDefinitions as Healthy (#25270) (cherry-pick #30404 for 3.6) (#30423) (@argo-cd-cherry-pick-bot[bot])
  • * a1e358a57f52d14696d77cdc10eaee61a48c9024: fix(health): report suspended FlinkDeployment as healthy (#26818) (#28995) (@SaiPisey2)
  • * 7cf440730872497c3b32c1c802690a1784e58979: fix(health): surface the Suspended condition message for suspended Jobs (#28738) (@semx)
  • * fd09092b7d46ec7bb36b663a32c9d888cfb5e5d6: fix(health): treat nil return from Lua health status script as n/a instead of unknown (#28269) (@snorwin)
  • * 3ba7162c10620ca3bf7d48f6979d0912643d465d: fix(health): use status.healthy for customize.core.cnrm.cloud.google.com resources (#30164) (cherry-pick #30165 for 3.6) (#30657) (@argo-cd-cherry-pick-bot[bot])
  • * b48e31cfbbbbd1c8233b58620873770757aed3ff: fix(helm): pass registry passwords through stdin (#17821) (#28795) (@AkashKumar7902)
  • * 05c4c4b56e842edfaf4e2b2adde20fe1615a6a06: fix(hydrator): do not report a permanent note push failure as exhausted retries (cherry-pick #29903 for 3.6) (#29909) (@argo-cd-cherry-pick-bot[bot])
  • * 65feaf50238bf8220fbacfc3576ecf12f0a67712: fix(hydrator): retry notes push on cannot lock ref errors (#28469) (@Churi12)
  • * a8529cd025d600882810d8ce5d738351b58a4163: fix(oltp): honor standard oltp tls/header env vars + argocd-tls-certs-cm (#29946) (cherry-pick release-3.6) (#30334) (@blakepettersson)
  • * aeda334c73e682fa2ea0ea0b0a93766e9ebf42a8: fix(progressivesync): check if error == notfound (#28663) (@blakepettersson)
  • * cd44f2784d2222cd0cfb0de1d54f005bcc1b6a53: fix(redis): incorrect fail metrics on RENAME cache miss (#29037) (@agaudreault)
  • * c7457d0668d321444560e1c0db56278c585c417c: fix(reposerver): honor depth of referenced source instead of primary source (#28339) (@alexandresavicki)
  • * 31101a86a62c8352e476fcba192e39b7ef82455d: fix(reposerver): stale manifests and goroutine leak after CMP failure (#29870) (cherry-pick #29874 for 3.6) (#30142) (@argo-cd-cherry-pick-bot[bot])
  • * c73a59ad73e4e4b15f28ec3bdeeec5516038daad: fix(repository): clean repository on revision change (#28771) (@emil-ep)
  • * 2f7eee24a6c5eb08b9c8f4bc62dbf1ea45ec6391: fix(repository): resolve untyped helm source type in UpdateRevisionForPaths (#28904) (@Churi12)
  • * b77bdaa2c76df9da83b26bf484c6deaf109263f5: fix(repository): restore Normalize in UpdateRevisionForPaths to unbreak master (#28979) (@Churi12)
  • * c71119fe756e12550670a78edf2eae08b935aef0: fix(revert): auto-sync skipped when newer commit arrives during sync (#28692) (@blakepettersson)
  • * d1a8d1ebe114821152891e56fef6fecf743e4bae: fix(server): allow the gRPC health check without authentication (#26193) (cherry-pick #30474 for 3.6) (#30567) (@antcybersec)
  • * 011bb47da0f59ca5a44289e51cd2cda6fbad80c0: fix(server): fill event count and timestamps for events.k8s.io events (#30015) (cherry-pick #30017 for 3.6) (#30051) (@argo-cd-cherry-pick-bot[bot])
  • * 323bb8e529b4354488543f18004029ac3df01218: fix(server): keep the gRPC code when manifest generation is interrupted (cherry-pick #30425 for 3.6) (#30551) (@argo-cd-cherry-pick-bot[bot])
  • * 7deb9a89a3af51c11bf52159c6f069e092ea0d3b: fix(server): prevent PodLogs goroutine leak on client disconnect (cherry-pick #30450 for 3.6) (#30461) (@argo-cd-cherry-pick-bot[bot])
  • * 2662e88843f79ba0d29f14d84bc8c0431b3b5bb5: fix(sharding): process apps with an unresolvable destination on one shard (#30456) (cherry-pick #30463 for 3.6) (#30639) (@argo-cd-cherry-pick-bot[bot])
  • * 166cb92ea94c3d46861773e8d5b7d2a65ab7ae8d: fix(sharding): recompute distribution when Update adds an unknown cluster (#29476) (cherry-pick #29477 for 3.6) (#30318) (@argo-cd-cherry-pick-bot[bot])
  • * 994e271bcc3c591540bbe778bf09df303dcbf5f7: fix(ssd): hide secret in last-applied-configuration annotation (#28989) (@pjiang-dev)
  • * a683bdec6afe94c9ed88b6c7744d909407e12ec7: fix(sync): add state information for sync operation (#28758) (@agaudreault)
  • * 9b40474c009cc0a3596da7180501b7f259b90700: fix(sync): correctly set operationState values on retry (#26530) (#28778) (@agaudreault)
  • * ba8600cb76922a8b252052d9a127a3b184446f44: fix(sync): do not pass --force to server-side apply (#29624) (#29626) (@KR-Ravindra)
  • * 5ee2ae0cf42cc5501eb957e3648f66beb0e3008c: fix(sync): reduce unnecessary sync operation caused by refreshes (#28619) (@agaudreault)
  • * 59b49b47450f6782a3385e2a9955eb1e71ae9569: fix(sync): remove hook finalizer when live object is missing from reconciliation cache (cherry-pick #29469 for 3.6) (#30529) (@argo-cd-cherry-pick-bot[bot])
  • * 5da9053d0ebcccf2a5858bd6578b9a5a8ec52255: fix(ui): Fix Hydrate-To revision name in App details (#27134) (@olivergondza)
  • * a1c22f1086166c9023e15bc0929b2a4983ee91be: fix(ui): add ResizeObserver to Monaco editor to fix collapsed rendering (#28810) (@choejwoo)
  • * 7dbd403ef1a43c9948449a50d1bc4e2d05d13c76: fix(ui): align tile favorite icons consistently (cherry-pick #29844 for 3.6) (#29845) (@argo-cd-cherry-pick-bot[bot])
  • * 2fadff2054bbecf1f6283ecbeefdcf2fc3d1ef44: fix(ui): clarify scoped repository copy (#22793) (#29177) (@SHINMH)
  • * 867b2c71e4d5ef55580665709c60717ce61ddf97: fix(ui): don't crash resource panel when desired state is null (#30528) (cherry-pick #30532 for 3.6) (#30538) (@argo-cd-cherry-pick-bot[bot])
  • * 1214aeda6bb23a02bf91427c587112899f3a73ea: fix(ui): enhance Bitbucket Server URL handling in ui for repo and revision links (#27587) (@adityaraj178)
  • * 8a7ab41f6450c3910ef5cec8ddcda50645073e3a: fix(ui): format parent node info with Argo styles (#28385) (@agaudreault)
  • * 51ec3eae5686eb1a6dcc78175716edaaab720df7: fix(ui): guard SSO redirect to stop 401 retry loop (#28807) (@geojaz)
  • * f363af584ab3adff613a481d0c1f5b243c34cd64: fix(ui): hide the pod highlight button when there is only one pod (#29252) (#29255) (@sandaruwijewardhana)
  • * aa4629e50c2ae8c138b9333e4add48a7124d2aff: fix(ui): keep application list names aligned with external links (#29259) (@linghaoSu)
  • * b5850f166d4f8339befbc6af5a67c5e26101b5fe: fix(ui): keep notice icon next to app name in tiles (#29413) (@choejwoo)
  • * 4709e8377b2f25979aa8432b645019e5833e2c5b: fix(ui): keep status panel links readable when focused in dark mode (#29288) (cherry-pick #30493 for 3.6) (#30542) (@argo-cd-cherry-pick-bot[bot])
  • * 14711c7eca960e505bc61d464cdd9d84b6863598: fix(ui): keep the pending New App form update when re-renders (#30248) (cherry-pick #30249 for 3.6) (#30611) (@argo-cd-cherry-pick-bot[bot])
  • * eeef47fc23819f29842ac36267079ca676194cd0: fix(ui): make pod highlight dropdown readable in dark theme (#29605) (@choejwoo)
  • * b5c9f00ef3d1b5609376d6bc5c5648b52b84237e: fix(ui): manifest viewer jumpiness (#29691) (#29692) (@crenshaw-dev)
  • * 49c7d81bcbe3383c2d81d9cab3447faa13cd1e91: fix(ui): navigate to application on appset list view row click (#28789) (@choejwoo)
  • * f92e3de98cbb346f4988e96ba4556448bf9df1f8: fix(ui): prefix application-details per-app CSS class to avoid collisions (#24220) (#28573) (@polarAli)
  • * 50f99757f1746f93d165851355ad7b87cb3f3e1a: fix(ui): preserve application tile height and spacing with page all (cherry-pick #29777 for 3.6) (#29803) (@argo-cd-cherry-pick-bot[bot])
  • * 5e8122adab7f7a29958f79e7e15c377e74d2c9e5: fix(ui): prevent content showing through sticky source title (#29107) (@choejwoo)
  • * 903c310230ff68e3b0433d6cac304047638f8af5: fix(ui): prevent crash when deleting ReplicaSet from grouped list (#26167) (@choejwoo)
  • * 705205d22818fff1039f5092b56669d73627b500: fix(ui): prevent delete button from clipping in application tiles view (#28379) (@choejwoo)
  • * a2bd9e8cda9e91498b9b896db9961350bac01f22: fix(ui): prevent resource action buttons from overlapping status icons (#29302) (@linghaoSu)
  • * 624e62a704306b7560edffc011bc2370cacb7367: fix(ui): reduce Applications virtual-scroll flicker on scroll (cherry-pick #29935 for 3.6) (#29972) (@argo-cd-cherry-pick-bot[bot])
  • * 7e44792a057a1932bb60f2fd8ba0ed3ecdc3fb51: fix(ui): refine validation and handling for write credentials in repo settings (cherry-pick #30489 for 3.6) (#30592) (@argo-cd-cherry-pick-bot[bot])
  • * 3d62384914badf7a666bc54c149af3def065afa8: fix(ui): remove kind filter from appset page (#29310) (#29311) (@crenshaw-dev)
  • * 58c7f84ec185d2fc42e6e3095f4cc993a77618e5: fix(ui): remove unnecessary open app icon on list view (#29681) (@agaudreault)
  • * da921411fed9777fb176d1eff0600d6a5b66c04c: fix(ui): show enableOCI only for Helm (cherry-pick #29974 for 3.6) (#30075) (@argo-cd-cherry-pick-bot[bot])
  • * 1fb9b6bbd9e8bed13d1001c33a329a01ad26db10: fix(ui): show full name of app on hover (#29235) (#29262) (@adityaraj178)
  • * 9bc95f9edae447372ee6724a909f438a26d00353: fix(ui): show multi-source plugin env in Parameters tab (#29465) (@lemon0333)
  • * 9a7d50a093e71fdf975d0a1de83a1f3a8a2c4d71: fix(ui): show operation state on applications list page (#29063) (#29064) (@antonu17)
  • * c1f41d4f3f02b677835b8f50786d04b487e3d2f2: fix(ui): show warning in appset-status display (#28445) (@ranakan19)
  • * 25aef12304d0d800a3f87b1b6b99bae62cc0778f: fix(ui): sidebar icon alignment (#28783) (@southball)
  • * f2ba7a0e9bc020b566c39953c20659d13c2d0626: fix(ui): tree view spacing with group nodes (#29660) (@agaudreault)
  • * 83f0886fd3087772a06d1e254297aeefd9e66c20: fix(ui): update cluster count logic in ApplicationsSummary (#28768) (@linghaoSu)
  • * effa730fe4b62aa2c65b215f0755063ffa0b29ed: fix(ui): update icon for consistency in appset list (#28528) (@choejwoo)
  • * a817e9aac691c7309fb1e1599c467d932e9d564d: fix(ui): update title in appset details page (#28529) (@choejwoo)
  • * bbbbaa1647168efeedd363dabb277a693a360e4c: fix(ui): use break-word on sync status message (#5084) (#28961) (@EmilyXinyi)
  • * ae1b83ef7b7663b2b25f65cc442d79b673abe9f7: fix(ui): use distinct icons for open-app and external URLs (#28503) (@choejwoo)
  • * 5f0c9b42c53dad51e647cbe92599f7b7dc1dde57: fix(ui): use groupedResources local variable in parent ref panel (#28399) (@crenshaw-dev)
  • * 53cd3749eef31ae40331da6a74a6c24780bad3fe: fix(ui): use hydrateTo branch name when set (#29554) (#29562) (@crenshaw-dev)
  • * c1be9e9ee2a7ae9b3c08e078403f371080ce248a: fix(ui): use the open-app icon in the ApplicationSet list row (#29264) (@choejwoo)
  • * 14bf22bdf509b3e849f06fd61ff0362653798079: fix(ui): use unfiltered resources for filter counts (#29621) (@choejwoo)
  • * 8c38a6a680f9c28a2a46717d6f3b653e4aa7f1b2: fix(ui): vertical alignment of application tile content (#28412) (@choejwoo)
  • * c9b07104d273873a826d5bc0326166a65705e2b7: fix(ui): wrap GROUP/KIND header instead of overflowing (#29304) (@linghaoSu)
  • * 677ea452284a0a99e5ee22a2782b8afd6b3fa45a: fix(webhook): match Helm OCI apps using repoURL+chart against registry events (#27954) (@adityaraj178)
  • * b642d5f6d5eba8cd644b3ca65b217e7a718645cd: fix: empty SHA256 fingerprint for SSH known hosts entries on the UI (#29401) (@ppapapetrou76)
  • * ce9fdb755cb195cad78600830d19e4ad3bc7d7af: fix: (ui) reduce Applications virtual-scroll flicker on scroll (cherry-pick #29935 for 3.6) - REVERT (#29973) (@keithchong)
  • * 4b52fc284b3edf93153c1a6440755fbae96f4f04: fix: Auto-sync triggers despite selfHeal: false when Sync Status and Last Sync are at different commits #26769 (#26770) (@adityaraj178)
  • * 102ff9f1982bab8d60d3d3fcb5d73b9e34eb7af0: fix: GRPCRoute health check ignores stale observedGeneration conditions (#28086) (#28087) (@obliadp)
  • * f9ee8e94c66e9834df7454fd2573852facdcf72e: fix: Ingress link scheme (https) when tls is enabled without secretName (cherry-pick #28888 for 3.6) (#30509) (@argo-cd-cherry-pick-bot[bot])
  • * eb547130245421e1a966cc6747504de76ffb70a2: fix: Server-Side diff should respect impersonation (#28821) (@pjiang-dev)
  • * 1beb896687b77d579f911e9b73dc4014e95710ab: fix: Support rabbitmq scale to zero in health check (#29119) (@Postremus)
  • * 95019a797a97b45073f0d1f7cd3fad7f348a68da: fix: Watch APIServices like we do CRDs (#28289) (@zachaller)
  • * 96506c592f3bd54f332908ab30e245c4550b4752: fix: add a lock on clusterinformer (#28216) (@blakepettersson)
  • * a4ce58454566452c7145644e0d40448e3d11e3e3: fix: admin cluster shards command does not display shards if there are no clusters assigned to them (#28429) (@cjcocokrisp)
  • * 60d29acbedcc780fd9e6308daf5f801312489e65: fix: auto-sync skipped when newer commit arrives during sync with manifest-generate-paths (#27875) (#28227) (@josef-sotkovsky)
  • * a1962e476dbdbb05adaace4b5b69b08539d50713: fix: badges with short revisions get correct width (#29335) (cherry-pick #29336 for 3.6) (#30583) (@argo-cd-cherry-pick-bot[bot])
  • * c83aeb122104bdea35fe3979ab6a185667fd812b: fix: controller panics in StateDiffs when server-side diff applier fails (#30743) (cherry-pick #30744 for 3.6) (#30755) (@argo-cd-cherry-pick-bot[bot])
  • * 794a2f15ad038ffae2cbe07a8cef430dda2a3c62: fix: correct operator precedence in getAppInstanceValue (#28852) (@magic-peach)
  • * d9e7e38c618b06a69c46cf65085ceb9429001812: fix: correct operator precedence in isDestinationMatched deny pattern (#28854) (@magic-peach)
  • * 814bc4d5e3a93460983ed710f72778f3237b11b4: fix: correct scheduled-time format in CronWorkflow create-workflow action (#29915) (cherry-pick #29916 for 3.6) (#29952) (@argo-cd-cherry-pick-bot[bot])
  • * 746b73a0330e6425c166120921adb3058753c008: fix: deleted resource are incorrectly shown in UI (#28322) (@agaudreault)
  • * 9513c2934e984281fb9fffc2468fbc05600c805a: fix: detect OCI repo type from URL prefix in Normalize() (#28517) (#28518) (@peikk0)
  • * 83156cdf0a023be41d6de6a889b5b6e78a5a4411: fix: don't clobber non-ignored fields on "replace" (#27136) (@blakepettersson)
  • * 77aca0ecc386ee832eedb667ea9e883a62339fb9: fix: don't degrade Cluster API Cluster health while Ready is False during provisioning (#29237) (@jonathanrainer)
  • * b4f5d0e2d0e8e6103ebe6d8c66716aeebe87fa24: fix: don't render status clickable when there is no operation (#27990) (@choejwoo)
  • * 1d58350e31412eafcd8152400af3e25c333151ea: fix: fix escaped URL routing for write repo (creds) endpoints (cherry-pick #29940 for 3.6) (#29957) (@argo-cd-cherry-pick-bot[bot])
  • * 7f84e8c911d052fc2a9ae9e25ceb8583b879e8d9: fix: fix failure on Sync of resources that do not fit into last-applied-configuration (#28421) (#28440) (@dudinea)
  • * f980990402cabca4cfd8e31e499b87ee9d097d25: fix: fix untar inbound check if dstPath is symlinked (cherry-pick #28881 for 3.6) (#29977) (@argo-cd-cherry-pick-bot[bot])
  • * 383ddedbf63d8a1235ad6c0d146472b89894ca4f: fix: fixes a regression of dex config env vars substituion (#28369) (@ppapapetrou76)
  • * d71ffe230bb23d9960cfe9fc88285126f6007ab8: fix: glob compile error (#29699) (@crenshaw-dev)
  • * 21956da8fb3cc970fef2c842abead37223d81d44: fix: handle GrafanaFolder negative-polarity condition (#29395) (#29397) (@Karthik-Chowdary)
  • * 332a0151fc0fe804b0d95a43015bed4f23749a2c: fix: honor UserInfo cache limit when response omits expires (cherry-pick #30462 for 3.6) (#30609) (@argo-cd-cherry-pick-bot[bot])
  • * 2ada1384820651c1a4ace78e0c4efab9aa2918ab: fix: include multi-source revisions in sync completion event (cherry-pick #30446 for 3.6) (#30472) (@gdsoumya)
  • * a16170b2e374db3475bd4f2241b75f454194b625: fix: kustomize: ignore Components directories missing a kustomization file (cherry-pick #26576 for 3.6) (#29936) (@argo-cd-cherry-pick-bot[bot])
  • * 59ea458a7771f04b6a16f160482f9a856edfc679: fix: lua script for Pipeline not to use strings library (#28602) (@juliev0)
  • * 9cd3549715c1f464647d25e42f112787572ab93d: fix: name downloaded deployment and replicaset logs after the resource (#26970) (cherry-pick #29832 for 3.6) (#30518) (@argo-cd-cherry-pick-bot[bot])
  • * 2ab2231986bf9a97676a43064aa4083dc52e587c: fix: normalize Helm valuesObject in source comparison to avoid spurious appdetails 403 (#28288) (#28318) (@bear-san)
  • * e87b872eec4f4ed12ca06ab6ff9b5a917d1f2693: fix: only do annotation backfill if live unset (#28770) (@blakepettersson)
  • * 13dae89db8d01dab9ff28c63c4a65e803bea4f75: fix: pass down context to cli commands instead of using default context.Ba… (#28734) (@Eduard-Voiculescu)
  • * c49f8b7127387d4e45f711487a0b5d5b4ab5d598: fix: prevent panic in glob.MatchStringInList for "/" sourceNamespaces entry (cherry-pick #30572 for 3.6) (#30613) (@argo-cd-cherry-pick-bot[bot])
  • * 0cc7d8aa38c1674781bead51e89879ac3e0bfcf3: fix: propagate command context to kube and HTTP calls in argocd CLI (#28837) (@Eduard-Voiculescu)
  • * 05dcfe7d455cccc583c8c38df0f37e9e1ae7c9e8: fix: recover AuthReconcile visitor panics (#29436) (#29440) (@Karthik-Chowdary)
  • * ef6e460740c0dfc7ca9774a6f8b79f8e3875814b: fix: recover from kubectl panic in AuthReconcile when SA is forbidden (#28669) (@mahesh-sadupalli)
  • * 82c4d4691401f9d21b163c2f83f4d87468b7f6b7: fix: relogin with --argocd-context does not correctly persist credentials (#28453) (#28510) (@octonawish-akcodes)
  • * d7efbae049ef822fa6f18d9cda60486c70898c8d: fix: respect ignore differences for individual array elements in CRDs (#28220) (@nitishfy)
  • * f63d92d7273179933e8ecd219083ddee1c5718b3: fix: restore SSH repository fetch through a SOCKS5 proxy (cherry-pick #30238 for 3.6) (#30252) (@ppapapetrou76)
  • * 74d0f9207b670a41f0a0f4a337c8217b5c363a3c: fix: return InvalidArgument for invalid repo URL in ListRefs (#28631) (@choejwoo)
  • * 7fe7110f65a16f0bd2ee6ac8a4ea5535ea684228: fix: return InvalidArgument for non-existent app path in GetAppDetails (#28699) (@choejwoo)
  • * f2dc6880581e6c2462f537fac4b24db1d24d455d: fix: return InvalidArgument for unresolved revision in GetAppDetails (#28782) (@choejwoo)
  • * 3d2ea09eb8ebba1bf54a49e4f57a6df6f7a7040b: fix: serialize Helm chart cache cleanup with chart extraction (#30253) (cherry-pick #30260 for 3.6) (#30522) (@argo-cd-cherry-pick-bot[bot])
  • * ac0059e093af5be23fdc35f4588636123e9b77f7: fix: server-side diff reports fields removed by other managers as diffs (cherry-pick #30206 for 3.6) (#30231) (@argo-cd-cherry-pick-bot[bot])
  • * 55f3be859257e122ab36eb50d225bd256ba2153a: fix: show 'name does not match' error in delete/sync confirmation dialogs (#28752) (@octonawish-akcodes)
  • * ad7215dba2fd6dbaff6298489388e9b3756fd928: fix: skip dollar escaping when DEX_EXPAND_ENV is disabled (cherry-pick #29181 for 3.6) (#30648) (@argo-cd-cherry-pick-bot[bot])
  • * 63c987d755ff71df1df0b896d28a61bb9eb83413: fix: support bearer token auth on terminal websocket endpoint (#28285) (@amarkdotdev)
  • * 70faa5d80b8c267fda498eece31d17c3e729b9e9: fix: synchronize OCI cache cleanup with extraction (#30020) (cherry-pick #30023 for 3.6) (#30105) (@argo-cd-cherry-pick-bot[bot])
  • * bf8bdaa3a55bf4620198f0e9ec2ddb2555037213: fix: tooltips that are cut in half when the window is to small in the health bar (#28700) (@Molaryy)
  • * 114cde4dd336ff398871dcb1418258d5dcae2748: fix: use Entra ID uti claim as token id when jti is absent (#28625) (#28656) (@magic-peach)
  • * fd0aa39b7339d1e8967de84d38d8ea9cc24938da: fix: validate resolved OIDC config after secret substitution (#29545) (#29555) (@chandan009s)
  • * 97a88b4931b304e12590a30323ae2b03897bb4a7: fix: wait for current SealedSecret generation before reporting health (cherry-pick #29867 for 3.6) (#30354) (@argo-cd-cherry-pick-bot[bot])
  • * dffb797af5f7f07483f86177548134fc19784456: fix: warn when 'rbac can' checks a group without a role binding (#28729) (#28733) (@SamyDjemai)
  • fix(gitops-engine): race condition on empty-uid backfill
  • fix(manifest-generate-paths): Consistent gen manifest cache key for UpdateRevisionForPaths
  • fix(manifest-generate-paths): do not report changes on cache miss without path updates (cherry-pick #29442 for 3.6)
  • fix(notification-controller): deep-copy before mutating object from a shared cache
  • fix(notification-controller): read appprojects from informer cache
  • fix(repo-server): expire cached Helm chart archives using repo cache expiration
  • fix(repo-server): fixes server-side diff with Helm+Kubernetes
  • fix(repo-server): health check timeout resulting in CrashLoopBackOff (cherry-pick #29863 for 3.6)
  • fix(repo-server): honor ARGOCD_REPO_SERVER_OTLP_HEADERS in repo-server
  • fix(repo-server): make git auth errors readable instead of "terminal prompts disabled"
  • fix(util/grpc): don't drop request log entries for Kubernetes-typed messages (cherry-pick #29872 for 3.6)
  • fix: Use EachListItemWithAlloc to prevent page retention
  • fix: use OIDC refresh tokens to renew expired sessions

value changes (140)

  • * e5eb504a3a2b8ad3013dfc6b9962c2a071a4772d: feat(perf): count apps per cluster in a single pass (#29570) (@rumstead)
  • * 4c36558382aad92ccdc8129f7045db6f84807950: feat(perf): drop two redundant application copies from the refresh path (#29581) (@rumstead)
  • * 0f901d1e2d9f9e9da3e52ddde9d0c97542aa6a91: feat(perf): resolve the destination server without copying the cluster (#29573) (@rumstead)
  • * 0c2545d51db30d8ce5e80a19883f4e8b65bf2947: feat(perf): reuse matrix child params when the generator is unchanged (#29582) (@rumstead)
  • * 79e1229469403a4e9cbab5043f9128948711a330: feat: add which resources caused the app health to change (#28455) (@agaudreault)
  • * 81cd93e553ce915075599a32335032322c44bc23: fix(chore): bump argo-ui for React 19 toast compatibility (#28874) (@choejwoo)
  • * 906ca1166d68e024391012c8605bbebe377c394a: fix(metrics): expose application operation phase in argocd_app_info (#28719) (@vishnu97770)
  • * 33eb5e4efdf2881bce8bfb596fbeb3ffe2ec064a: fix: cache the OCI tag list (#30117) (cherry-pick #30118 for 3.6) (#30120) (@argo-cd-cherry-pick-bot[bot])
  • * 4597065765b65ff1f5579eec7bc501e04f05f93a: fix: stream list requests straight to http writer (#27152) (@blakepettersson)
  • * 0cf2e80c59a72ac1691e66c51896a4e5c9a79333: chore(deps): bump Ubuntu base image digest to 26.04 (resolute-20260811.1) (#29569) (@dudinea)
  • * 615776ac535f4c9263c2ee691317e751198c3bca: chore(deps): bump dompurify (cherry-pick #30014 for 3.6) (#30034) (@argo-cd-cherry-pick-bot[bot])
  • * 0c6c5edfcd002e4842a826c4e955af2767d48fbd: chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.22.0 to 1.23.0 (#29212) (@dependabot[bot])
  • * bb5169caf4fb7b5b7a2f05e75690a7be5affaa66: chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.23.0 to 1.23.1 (#29462) (@dependabot[bot])
  • * 96c6029e300cc29ca7b103f0418e5e96c321e3dc: chore(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.14.0 to 1.14.1 (#29459) (@dependabot[bot])
  • * c50ac5589e6fca41484b5bddcbefe4fcfc69cb7e: chore(deps): bump github.com/Azure/kubelogin from 0.2.18 to 0.2.19 (#28403) (@dependabot[bot])
  • * 259634c04ec40a81164ba1e161bc8bd069d02be5: chore(deps): bump github.com/alicebob/miniredis/v2 from 2.38.0 to 2.39.0 (#29588) (@dependabot[bot])
  • * b138d42840bc0da6f8e64f539df85cdca3521f32: chore(deps): bump github.com/aws/smithy-go from 1.27.2 to 1.27.3 (#28473) (@dependabot[bot])
  • * b34f73175c0e703b9a99363e17fa9d2cf1351157: chore(deps): bump github.com/aws/smithy-go from 1.27.3 to 1.27.4 (#28760) (@dependabot[bot])
  • * dee87aaa41c37ab1e38180d8afb85dbd1f9d0add: chore(deps): bump github.com/aws/smithy-go from 1.27.4 to 1.27.5 (#28931) (@dependabot[bot])
  • * 700aa46a9028bc047abbb36b117ece2950daf9cf: chore(deps): bump github.com/aws/smithy-go from 1.27.5 to 1.27.6 (#29041) (@dependabot[bot])
  • * d49b63b06c2a03512e1d9e5f405189c8be8caa2b: chore(deps): bump github.com/aws/smithy-go from 1.27.6 to 1.27.7 (#29136) (@dependabot[bot])
  • * a8c09bb4cb7018958d95916bdd1fa18ed14bfa88: chore(deps): bump github.com/aws/smithy-go from 1.27.7 to 1.27.8 (#29230) (@dependabot[bot])
  • * b24120eeb74f907146c49432d8e9ad999cc61a85: chore(deps): bump github.com/aws/smithy-go from 1.27.8 to 1.27.9 (#29376) (@dependabot[bot])
  • chore(deps): bump github.com/bombsimon/logrusr/v4 from 4.1.0 to 4.2.0 (#29480) (@dependabot[bot])
  • chore(deps): bump github.com/coreos/go-oidc/v3 from 3.18.0 to 3.19.0 (#28325) (@dependabot[bot])
  • chore(deps): bump github.com/coreos/go-oidc/v3 from 3.19.0 to 3.20.0 (#28643) (@dependabot[bot])
  • chore(deps): bump github.com/coreos/go-oidc/v3 from 3.20.0 to 3.21.0 (#29592) (@dependabot[bot])
  • chore(deps): bump github.com/cyphar/filepath-securejoin from 0.6.1 to 0.7.0 (#28351) (@dependabot[bot])
  • chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.5 (#29589) (@dependabot[bot])
  • chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 (cherry-pick #30284 for 3.6) (#30711) (@argo-cd-cherry-pick-bot[bot])
  • chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.6 to 4.1.7 (cherry-pick #30731 for 3.6) (#30735) (@argo-cd-cherry-pick-bot[bot])
  • chore(deps): bump github.com/go-logr/logr from 1.4.3 to 1.4.4 (#28823) (@dependabot[bot])
  • chore(deps): bump github.com/go-openapi/loads from 0.24.0 to 0.25.0 (#28822) (@dependabot[bot])
  • chore(deps): bump github.com/go-openapi/loads from 0.25.0 to 0.25.1 (#29229) (@dependabot[bot])
  • chore(deps): bump github.com/go-openapi/loads from 0.25.1 to 0.25.2 (#29460) (@dependabot[bot])
  • chore(deps): bump github.com/go-openapi/loads from 0.25.2 to 0.25.3 (#29615) (@dependabot[bot])
  • chore(deps): bump github.com/go-openapi/runtime/server-middleware from 0.32.3 to 0.32.4 (#28372) (@dependabot[bot])
  • chore(deps): bump github.com/go-openapi/runtime/server-middleware from 0.32.4 to 0.32.5 (#28759) (@dependabot[bot])
  • chore(deps): bump github.com/go-openapi/runtime/server-middleware from 0.32.5 to 0.32.6 (#28845) (@dependabot[bot])
  • chore(deps): bump github.com/go-openapi/runtime/server-middleware from 0.32.6 to 0.33.0 (#28933) (@dependabot[bot])
  • chore(deps): bump github.com/go-openapi/runtime/server-middleware from 0.33.0 to 0.33.1 (#29375) (@dependabot[bot])
  • chore(deps): bump github.com/go-openapi/runtime/server-middleware from 0.33.1 to 0.33.2 (#29590) (@dependabot[bot])
  • chore(deps): bump github.com/gobwas/glob from 0.2.3 to 1.0.0 (#29482) (@dependabot[bot])
  • chore(deps): bump github.com/google/gnostic-models from 0.7.0 to 0.7.1 (#28560) (@dependabot[bot])
  • chore(deps): bump github.com/grpc-ecosystem/go-grpc-middleware/v2 from 2.3.3 to 2.3.4 (#29427) (@dependabot[bot])
  • chore(deps): bump github.com/jarcoal/httpmock from 1.4.1 to 1.4.2 (#28953) (@dependabot[bot])
  • chore(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 (#28761) (@dependabot[bot])
  • chore(deps): bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24 (#28883) (@dependabot[bot])
  • chore(deps): bump github.com/prometheus/client_golang from 1.23.2 to 1.24.0 (#28824) (@dependabot[bot])
  • chore(deps): bump github.com/prometheus/client_golang from 1.24.0 to 1.24.1 (#28914) (@dependabot[bot])
  • chore(deps): bump github.com/prometheus/client_model from 0.6.2 to 0.6.3 (#29552) (@dependabot[bot])
  • chore(deps): bump github.com/redis/go-redis/v9 from 9.20.1 to 9.21.0 (#28387) (@dependabot[bot])
  • chore(deps): bump github.com/redis/go-redis/v9 from 9.21.0 to 9.22.0 (#29092) (@dependabot[bot])
  • chore(deps): bump github.com/sirupsen/logrus from 1.10.0 to 1.10.1 (#29341) (@dependabot[bot])
  • chore(deps): bump github.com/sirupsen/logrus from 1.10.1 to 1.10.2 (#29457) (@dependabot[bot])
  • chore(deps): bump github.com/sirupsen/logrus from 1.9.4 to 1.10.0 (#29211) (@dependabot[bot])
  • chore(deps): bump github.com/skeema/knownhosts from 1.3.2 to 1.3.3 (#29458) (@dependabot[bot])
  • chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#29231) (@dependabot[bot])
  • chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#29301) (@dependabot[bot])
  • chore(deps): bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 (#28913) (@dependabot[bot])
  • chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 in the golang-x group (#29587) (@dependabot[bot])
  • chore(deps): bump golang.org/x/net from 0.53.0 to 0.55.0 in /gitops-engine (#28540) (@dependabot[bot])
  • chore(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 (#28640) (@dependabot[bot])
  • chore(deps): bump golang.org/x/net from 0.61.0 to 0.62.0 in the golang-x group (cherry-pick #30699 for 3.6) (#30746) (@argo-cd-cherry-pick-bot[bot])
  • chore(deps): bump golang.org/x/term from 0.44.0 to 0.45.0 (#28642) (@dependabot[bot])
  • chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 (#28513) (@dependabot[bot])
  • chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 (#28525) (@dependabot[bot])
  • chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 (#28739) (@dependabot[bot])
  • chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 (#29020) (@dependabot[bot])
  • chore(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 (#29340) (@dependabot[bot])
  • chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 (#29461) (@dependabot[bot])
  • chore(deps): bump google.golang.org/grpc from 1.83.2 to 1.84.0 (cherry-pick #29790 for 3.6) (#29914) (@argo-cd-cherry-pick-bot[bot])
  • chore(deps): bump js-yaml from 3.14.1 to 4.2.0 in /ui (#28291) (@dependabot[bot])
  • chore(deps): bump js-yaml from 3.14.1 to 5.2.0 in /ui (#28509) (@dependabot[bot])
  • chore(deps): bump js-yaml from 4.3.0 to 4.3.1 in /ui (#29090) (@dependabot[bot])
  • chore(deps): bump js-yaml from 4.3.0 to 5.2.2 in /ui (#28918) (@dependabot[bot])
  • chore(deps): bump js-yaml from 4.3.1 to 5.4.1 in /ui (#29483) (@dependabot[bot])
  • chore(deps): bump k8s client to 0.37.0 (#29597) (#29595) (@dudinea)
  • chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#28696) (@dependabot[bot])
  • chore(deps): bump rxjs from 6.6.7 to 7.8.2 in /ui (#28916) (@dependabot[bot])
  • chore(deps): bump sigs.k8s.io/structured-merge-diff/v6 from 6.4.0 to 6.4.1 (#28604) (@dependabot[bot])
  • chore(deps): bump sigs.k8s.io/structured-merge-diff/v6 from 6.4.1 to 6.4.2 (#28622) (@dependabot[bot])
  • chore(deps): bump slack-go to v0.23.1 and golang.org/x/net to v0.53.0 (#28377) (@ayushi-work)
  • chore(deps): bump the aws-sdk-v2 group with 2 updates (#28639) (@dependabot[bot])
  • chore(deps): bump the aws-sdk-v2 group with 2 updates (#29209) (@dependabot[bot])
  • chore(deps): bump the aws-sdk-v2 group with 5 updates (#28514) (@dependabot[bot])
  • chore(deps): bump the aws-sdk-v2 group with 5 updates (#28603) (@dependabot[bot])
  • chore(deps): bump the aws-sdk-v2 group with 5 updates (#28710) (@dependabot[bot])
  • chore(deps): bump the aws-sdk-v2 group with 5 updates (#29551) (@dependabot[bot])
  • chore(deps): bump the aws-sdk-v2 group with 6 updates (#28537) (@dependabot[bot])
  • chore(deps): bump the aws-sdk-v2 group with 6 updates (#28844) (@dependabot[bot])
  • chore(deps): bump the aws-sdk-v2 group with 6 updates (#28952) (@dependabot[bot])
  • chore(deps): bump the aws-sdk-v2 group with 6 updates (#28975) (@dependabot[bot])
  • chore(deps): bump the aws-sdk-v2 group with 6 updates (#29040) (@dependabot[bot])
  • chore(deps): bump the aws-sdk-v2 group with 6 updates (#29117) (@dependabot[bot])
  • chore(deps): bump the aws-sdk-v2 group with 6 updates (#29192) (@dependabot[bot])
  • chore(deps): bump the aws-sdk-v2 group with 6 updates (#29228) (@dependabot[bot])
  • chore(deps): bump the aws-sdk-v2 group with 6 updates (#29339) (@dependabot[bot])
  • chore(deps): bump the aws-sdk-v2 group with 6 updates (#29455) (@dependabot[bot])
  • chore(deps): bump the aws-sdk-v2 group with 6 updates (#29614) (@dependabot[bot])
  • chore(deps): bump the aws-sdk-v2 group with 6 updates (#29704) (@dependabot[bot])
  • chore(deps): bump the golang-x group with 2 updates (#29210) (@dependabot[bot])
  • chore(deps): bump the golang-x group with 2 updates (cherry-pick #30146 for 3.6) (#30739) (@argo-cd-cherry-pick-bot[bot])
  • chore(deps): bump the golang-x group with 3 updates (#29628) (@dependabot[bot])
  • chore(deps): bump the golang-x group with 3 updates (#29705) (@dependabot[bot])
  • chore(deps): bump the golang-x group with 3 updates (cherry-pick #30198 for 3.6) (#30742) (@argo-cd-cherry-pick-bot[bot])
  • chore(deps): bump the otel group with 2 updates (#29118) (@dependabot[bot])
  • chore(deps): bump the otel group with 4 updates (#29091) (@dependabot[bot])
  • chore(deps): bump the otel group with 6 updates (#29456) (@dependabot[bot])
  • chore(deps): bump timezones-list from 3.0.1 to 3.1.0 in /ui (#29594) (@dependabot[bot])
  • chore(deps): bump uuid from 8.3.2 to 14.0.1 in /ui (#28887) (@dependabot[bot])
  • chore(deps): update dependency dexidp/dex to v2.45.1 (#28850) (@argoproj-renovate[bot])
  • chore(deps): update dependency dexidp/dex to v2.46.0 (cherry-pick #30065 for 3.6) (#30216) (@argo-cd-cherry-pick-bot[bot])
  • chore(deps): update dependency git-lfs/git-lfs to v3.8.0 (#29426) (@argoproj-renovate[bot])
  • chore(deps): update dependency git-lfs/git-lfs to v3.8.1 (cherry-pick #30360 for 3.6) (#30751) (@dudinea)
  • chore(deps): update dependency golang to v1.27.1 (#29490) (@argoproj-renovate[bot])
  • chore(deps): update dependency helm/helm to v4.2.2 (#28457) (@argoproj-renovate[bot])
  • chore(deps): update dependency helm/helm to v4.2.3 (#28851) (@argoproj-renovate[bot])
  • chore(deps): update dependency helm/helm to v4.2.4 (#29187) (@argoproj-renovate[bot])
  • chore(deps): update dependency helm/helm to v4.3.0 (#29648) (@argoproj-renovate[bot])
  • chore(deps): update dependency helm/helm to v4.3.1 (release-3.6) (#30211) (@argoproj-renovate[bot])
  • chore(deps): update dependency kubernetes-sigs/kustomize to v5.8.3 (release-3.6) (#30097) (@argoproj-renovate[bot])
  • chore(deps): update docker.io/bitnamilegacy/kubectl docker tag to v1.33 (#28458) (@argoproj-renovate[bot])
  • chore(deps): update docker.io/library/busybox docker digest to dc2d74
  • chore(deps): update docker.io/library/golang docker tag to v1.27.1
  • chore(deps): update docker.io/library/golang:1.26.4 docker digest to 8c5d338
  • chore(deps): update docker.io/library/redis docker tag to …×3
  • chore(deps): update group golang
  • chore(deps): update group golang (master) (cherry-pick #30090 for 3.6)
  • chore(deps): update group golang to …×2
  • chore(deps): update group golang to v1.27.3 (release-3.6)
  • chore(deps): update group node to v24.17.0
  • chore(bump): enable go 1.27
  • chore(dep): bump go-git dependency (cherry-pick #30013 for 3.6)
  • chore(perf): cache compiled Lua scripts across executions
  • chore: Update Redis to 8.6.4
  • chore: add logs with timing for cluster sync performance

additions (78)

  • All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the [documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/signed-release-assets) on how to verify.
  • * bac4616ca429ba92af1b312cb8a2cac36e1cfdea: feat(actions): add hibernate/rehydrate actions for CNPG Cluster (#28478) (@purisev)
  • * 0df1a4bcced9a8400d6ddafaf168e6e847209ec8: feat(appset): Add progressive sync metrics for AppSet (#29202) (@ranakan19)
  • * ad23d3a9c04134f42661b5cbdb5aaeac46a1cdad: feat(appset): Adding annotations on apps to force reconciliation before proceeding with progressive sync (#27467) (@ranakan19)
  • * 94564eba18592d1bc2fc20e64415c9214203a5d4: feat(appset): add metrics for count of app refreshes triggered by appset during progressive sync (#29244) (@ranakan19)
  • * 9ef034e688e86f45fa63465710d5883d88c2ddde: feat(appset): expose workqueue rate limiter flags on applicationset-controller (#28286) (@om7057)
  • * 5899f89f745513f324ff0999cf7770821b7b7fd0: feat(appset): surface progressive sync scenario into condition as reasons and messages (#27820) (@ranakan19)
  • * ec10f2e627042e29044b6de5f550f6bacf19708e: feat(cli): optionally exclude status field when using argocd admin export command (#29219) (@nitishfy)
  • * 5c3637def4bef8daf16311877d9bc6f98f39f4ec: feat(controller): allow metrics label/condition flags via argocd-cmd-params-cm (#28287) (@edgrz)
  • * 5f8562e90a9310a9e521e5aa6ae529060a567279: feat(dex): Configure Dex TLS Cipher Suites and Curve Preferences (cherry-pick #29658 for 3.6) (#30217) (@argo-cd-cherry-pick-bot[bot])
  • * d94bcb1215c15bbe12835b4653e7c58f42b9241f: feat(dex): Configure TLS Minversion for Dex web (#28712) (@akhilnittala)
  • * 465d43b2455fa60c45c02041b553054921934e3d: feat(dex): Making Dex storage type and config configurable from argocd-cm configmap (#28624) (@akhilnittala)
  • * 2e2f4e450d57bafa249aaa330d61901f76d424df: feat(health): Implement kyverno health checks (#27354) (@sandert-k8s)
  • * 034ab6150952f23071d452f0f6fc0b400124d7e1: feat(health): add built-in health check for TLSRoute (#26596) (@dnfwlq8054)
  • * 49aa0eab6d876ba8a69b198e8319495c9931dcfb: feat(health): add health check for AWS ACK resources (#29016) (@philljie)
  • * e1145c626c7dee9ba7e437447bc2b3319e042f3f: feat(health): add health check for CloudNativePG Backup (#28468) (@yugstar)
  • * 643de0bcff5a48076ce582d8b096a3f5fc1402ff: feat(health): add health check for CloudNativePG Database CRD (#29511) (@Matthiator)
  • * ff00ee7d69ffc3d85b175bf37bbc40c7e814d183: feat(health): add health check for Kro resources (#28743) (@philljie)
  • * 3825b96ac9ce29b500f8895e47fd44fa26901a74: feat(health): add health check for MedusaBackupJob (issue #28009) (#28008) (@mgross2)
  • * 309594ba94218770caa0e922530962b915741b0f: feat(health): add health check for MedusaTask (issue #28007) (#28006) (@mgross2)
  • * 6858a80b2af7fde484986ea4bc282c85a489d1fd: feat(health): add health check for Prometheus Operator Alertmanager (#28446) (@yugstar)
  • * 2338867cea9ca0390ae5ad33a9b045f72a797f73: feat(health): add health check for Prometheus Operator ThanosRuler (#28463) (@yugstar)
  • * 831d77b52c809dec1ae8b7107ccb264825402d7d: feat(health): add health check for cert-manager CertificateRequest (#28465) (@yugstar)
  • * dec470a0ab16b7c6a97fe4eb58f9ae430eb0a04f: feat(health): add health check for cert-manager trust-manager Bundle (#28615) (@yugstar)
  • * fdf6751b85a04b0b60a23ec0bcd5641c814b09ec: feat(health): add health check for flink.apache.org/FlinkSessionJob (#26626) (@sivchari)
  • * 21ac508ef6aaae8238710688fbf26e0c20d2b9d7: feat(health): add health checks for Tekton PipelineRun and TaskRun (#28467) (@yugstar)
  • * 180061c9b2cd879b966f60a46e09a83001acc4d8: feat(health): add health checks for Velero Backup, Restore, and Schedule (#28464) (@yugstar)
  • * 57088014f10c71331ce6719f1c85d778ccfd5b14: feat(health): add health checks for cert-manager ACME Order and Challenge (#28466) (@yugstar)
  • * 291bfab82175b7580165a7a11be282151eac0ad8: feat(health): enable a Pipeline labeled 'recyclable-expired' to be deleted (#28532) (@juliev0)
  • * ffe66fff46708bbbe4183b13f3d2cde657664c4b: feat(health): support custom deletion messages (#27595) (#27596) (@crenshaw-dev)
  • * 961bd434659679dd9d80e8a4d83acb71dfcec2cd: feat(hydrator): add metrics to app info (#29512) (#29514) (@crenshaw-dev)
  • * 2d71dc6b6e4e1ddda65f950bb3f538e04ca7c76e: feat(hydrator): sign hydrated commits (Alpha) (#28239) (#28271) (@mladjan-gadzic)
  • * c2df91b70ff69c24b1b5fc457e384fafab573544: feat(impersonation): allow to disable strict enforcement (#27084) (#27573) (@agaudreault)
  • * e2b719ad65d7b09002e0b17b8f1bdf8640c6e7e8: feat(otel): add spans with configurable sampling (#28396) (@blakepettersson)
  • * b2e6d1d929cdca79f774075bfaef9f738f1d1524: feat(perf): configurable serialization and compression for cached manifests (#26897) (#28600) (@adityaraj178)
  • * 37273e31438a571e337058efb6e3fbbe1b28044b: feat(perf): partial json unmarshalling (#29378) (@blakepettersson)
  • * 4abcbcf1a904e2ec6ba3310f22d5763b3e4bc772: feat(server): Add support for redirect to selected Dex connector (Alpha) (#24221) (@antonu17)
  • * e4470c5ff3cd0a4b948714c3f3c19731d26be05b: feat(server): add configHash field to Cluster (#25311) (#27657) (@matmil-dev)
  • * c2e39d87739338f7c57792bb394e14321a899c27: feat(server): log username on login attempts (cherry-pick #29841 for 3.6) (#29859) (@argo-cd-cherry-pick-bot[bot])
  • * fc848eb1b454870ebab17d1092c44ae6017b3991: feat(server): set X-Robots-Tag to prevent indexing of the UI (#28359) (@yugstar)
  • * 0141bf077dea55a15437401e7a61ab07fd2f9ad3: feat(tls): Make TLS Curve prefereneces configurable while setting TLS options for repo-server and server. (#28846) (@akhilnittala)
  • * ba47c6b6b0015a9939cd630db444a1e9aa1f957f: feat(ui): Implement virtual scrolling for Apps list/tiles view when all is selected (#29542) (@aali309)
  • * bf984eaa6c17dc1d832bbbfd44760cd1e82ada06: feat(ui): Lazy loading (#29087) (@jwinters01)
  • * ac0119467ed8bcccf960fffdbe2603f9c6b95efb: feat(ui): add regex search toggle to application(sets) list (#27857) (#27889) (@rickbrouwer)
  • * 807320130714a5939242a47f32e48e28a97a02fa: feat(ui): add resources explorer view (#28098) (@agaudreault)
  • * 5b4b5def23bce4e7a0d26478ba1674361aab12b1: feat(ui): add search bar and pagination to settings pages (#28305) (@agaudreault)
  • * e2a605e0d0a1f2c154c4f2215f8c66a02beba602: feat(ui): add server-side name filter to applications list and watch (#29106) (#29242) (@rickbrouwer)
  • * f495ca51ee8f5d725c3ea38c4b7d1a8c227b5f29: feat(ui): advanced settings view (#28383) (@agaudreault)
  • * 4fa944edff93a4116eee008e6b018057d4da6965: feat(ui): enable React Compiler in the build (@jwinters01)
  • * 14333597102184e784a6f2adae70b84d989e3e74: feat(ui): show last scheduled and successful times for CronJob in summary panel (cherry-pick #30690 for 3.6) (#30748) (@dudinea)
  • * 9cf8d7c125ac534aa58c1ee089fb48dbe80cd1d4: feat(ui): sidebar anchors (#28527) (@blakepettersson)
  • * 91f7adcbcfecfdeb21e87678ccdb1bc1ae15172a: feat(ui): use anchors instead of divs in app/appset tiles and tablerows (#28005) (@blakepettersson)
  • * 73bf020633ecd20cd4d96ec9af504b8aab4c98aa: feat(webhook): Add manifest-generate-paths annotation support for BitBucket Server (#27552) (@adityaraj178)
  • * ca3139e842d84130ec9ed39bdfaa57ee3998bd1d: feat(webhook): add webhook support for harbor (#27810) (#27884) (@adityaraj178)
  • * 7bdadbf693502e8ac5cdfda281e2972eaa2a04da: feat(webhooks): add webhook support for DockerHub (#28022) (@nitishfy)
  • * b5d698a00a2797cbadb8c6d7769b0161daea0f18: feat: Add health check for pulumi.com/Stack (#28534) (@guineveresaenger)
  • * 0703fcacf7c7411ffbc3fabf511b7eadc5ec3927: feat: Add health check resource customizations for Envoy Gateway Extension CRDs (#27291) (@obliadp)
  • * 34427a68b08f46f0bd43846213a2aaf24452cbd6: feat: Add reporting component to events list (#25684) (#27678) (@Suven-p)
  • * 816fcd02cf47cdfaebd93df9bd9d9dac332ff7ab: feat: Allow pod healthcheck to ignore restart policy via annotation (#15317) (Alpha) (#28249) (@jskrill)
  • * 43637e4b85a697bc83c27fac50362f5cd20a12a8: feat: Persist and reuse client certificates if they were using in argocd login call (cherry-pick #29718 for 3.6) (#29781) (@argo-cd-cherry-pick-bot[bot])
  • * 1828831237e85645081cb4483061de4f1687ce4f: feat: add tpl function to ApplicationSet go-templating (#16302) (#26614) (@twobiers)
  • * 58d427f5391887092d1ff36c61157a865fadea8d: feat: add a button to clear logs in the pod logs viewer (#27149) (@gcadoret)
  • * eb15eb4a23c8820c35a45756ff3a28bd77b3a0c6: feat: add bundled health check for KServe LLMInferenceService (#29599) (#29620) (@sarfarazgit)
  • * dcdf8e4026450611d23077271705a44a9f21d10b: feat: add clear all button to ApplicationSet filters (#28593) (@choejwoo)
  • * 619c642457581e5929b8628676a7c4517e358c87: feat: add configurable SSO login button text via ui.loginButtonText (#28254) (@NotKiwy)
  • * bcb771e29326321b7be0c4bfe2d2a7c742ac7955: feat: add oci generator for applicationsets (#26121) (@robinlieb)
  • * 68b8af21e358fa01ea42ba34aa26ab3bd854c4ab: feat: add option to disable Swagger UI endpoint (#28717) (@smahadik-27)
  • * e8e5ba20f7a2449a254cc2a380c293099159da38: feat: adds a server-proxy-url flag in cluster add command (#28134) (@ppapapetrou76)
  • * bcf18220b76d55a00599da0b8993276c2a419f72: feat: allow optionally setting a prefix for redis keys (closes #12978) (#26169) (@healthy-pod)
  • * 7cfc6cfd2e7b5de1b9e29ee497a07135405047d2: feat: allow to create Jobs from CronJobs with OwnerReferencesPermissionEnforcement admission (#26009) (@sathieu)
  • * 7d05a395eb4149c9c8d41cad3f27a20c3d6367fd: feat: support separate RBAC permission for application rollback (#28924) (@ppapapetrou76)
  • * 187de3f426933d469f21c93058aef692da7073db: fix: add service for application controller statefulset (#29498) (#29499) (@chandan009s)
  • * 702c6d6c99ebff09f855bebdc5b8d746a773148e: fix: mount argocd-cmd-params-cm in repo-server so pprof can be enabled (#28863) (@rumstead)
  • chore(cmp): add OpenTelemetry spans for CMP internal phases
  • chore: add prometheus argocd version gauge
  • feat(azure-spn-auth): optionally allow pop tokens for azure hybrid aks clusters
  • feat(repo-server): support custom extensions for application directory source
  • feat(resource-customization): add healthchecks and actions for Project Capsule resources

constraints (9)

  • * 463f39afe5d91882e51c345fe5bce6ead40adeae: feat(health): support ListenerSet.gateway.networking.k8s.io (#28388) (@root30)
  • * 5e8ed632babda75965940a0f175010bb974b50b7: feat(health): support various policies _.microgateway.airlock.com (#28268) (@root30)
  • * 54a740e1048b80eb3f4856e2cdc25c9bae51df94: feat(resource_customizations): support ignored status for victoriametrics healthcheck (#29351) (@AndrewChubatiuk)
  • * 7a80e4ca9272889d9c452cedca7fe459b06bc127: feat: accept repository-style Azure keys in repo-creds (#29414) (#29415) (@SHINMH)
  • * 0984033236c695ee20ae344c402fa0d30e8a30fd: feat: support REDIS_SENTINEL and REDIS_SENTINELMASTER env vars (#28391) (@suii2210)
  • * 127dbe7bcd94f3f6883eae1f2f3465763e5a5282: feat: support filtering out managed resources using label selector (#29423) (@alexmt)
  • * 9e9c2f1e751242cb3c26aaa9cc5d4cbe6426139e: feat: support ignore-differences annotation on resources (#29616) (@ranakan19)
  • * e28c40095375aae6af48e3e87931db52d3836455: fix: accept IP and port as OCI Helm repository URL (#21374) (cherry-pick #30233 for 3.6) (#30517) (@argo-cd-cherry-pick-bot[bot])
  • * 427bfb249d9d4b63b8c199ef730368f6bb0a6f44: fix: modify GPG regex to support additional key algorithms (cherry-pick #27638 for 3.6) (#30495) (@argo-cd-cherry-pick-bot[bot])

renames (4)

  • * 35238e3472a27604de22939d217bdf98c3ca9b0b: feat: Replace SIGNATURE-KEYS with SOURCE-INTEGRITY in proj list (#28920) (@kuci-JK)
  • * 545bcb5eeba8240ffa47299ee9ace8bb54c61dc8: fix(SyncWindow): rename SyncWindow to InlineSyncWindow (#29152) (@adityaraj178)
  • * 57c9433cb1926459115bd8321549c90c9fa015a0: fix: migrate react-ga to react-ga4 (#28945) (@FZhg)
  • chore(ui): use swagger-ui-dist instead of redoc

removals (3)

  • * c8f7f2ab51fbd5c2173e47c4662dea5e181a7963: fix: remove generation from ssd (#30398) (cherry-pick #30402 for 3.6) (#30443) (@argo-cd-cherry-pick-bot[bot])
  • * cb5d5fc083e9efc59a8ae53c3e71d8f551daf4a6: fix: replace k8s.io/cri-streaming (#28315) (@blakepettersson)
  • chore: remove dompurify (cherry-pick #30181 for 3.6)

defaults (1)

  • * 48f94615f072046d6621287e0b5c86c07efafed9: feat: Default to SSD with SSA and remove SMD (#29103) (@pjiang-dev)
Add Argo to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All Argo releases →