AI-analyzed release notes for CNCF graduated and incubating projects.
A maintenance release with several correctness fixes across Argo CD and a UI dependency update addressing CVE-2026-41240. The recorded fixes cover CLI, UI, Git, controller startup, and resource handling.
Check if affected (1)
securitymediumThe redoc/dompurify dependency, upgraded for CVE-2026-41240
Applies if you use redoc/dompurify in /ui.
A broad release with breaking API removals, changed defaults and constraints, and many new operator-facing capabilities. It also includes performance improvements and an explicitly described dependency security update.
Action needed (2)
securityModule Federation packages at v2.
Module Federation packages were upgraded to v2. to address known vulnerabilities.
breakingThe @remixicon/react version constraint
The @remixicon/react dependency is limited to versions below 4. because of a license change.
Check if affected (9)
securitySpecific defaults for known MCP clients
Applies if you configure CIMD or DCR.
breakingThe NavItemBlueprint API, removed
Applies if you use NavItemBlueprint.
breakingSidebar and legacy nav-item rendering in renderInTestApp
Applies if you use renderInTestApp.
Plan ahead (4)
deprecatedThe PolicyQueryUser. field, deprecated
Applies if you use PolicyQueryUser..
deprecatedThe EXPERIMENTAL_formDecorators field, deprecated alias
Applies if you configure EXPERIMENTAL_formDecorators.
deprecatedThe catalog. setting, deprecated
Applies if you configure catalog..
A broad maintenance and feature release with correctness, performance, dependency, and operator-facing changes. Operators should review the cluster-version annotation format and changed defaults, while dependency updates include Kubernetes and Helm changes; no explicitly disclosed exploitable vulnerability or security advisory is identified.
Action needed (4)
securityThe k8s. module, updated to v1.
The k8s. module is updated to v1. as a security-related dependency update.
securityThe helm dependency, updated to 3.
The helm dependency is updated to 3. due to a CVE.
breakinggRPC service config DNS TXT lookups, disabled by default
gRPC service config DNS TXT lookups are disabled by default.
breakingThe appset resource status count, defaulted to 5000
The default appset resource status count is changed to 5000.
Check if affected (2)
breakingThe --client flag in the Helm version command, removed
Applies if you use --client.
breakingThe cluster-version annotation format, renamed
Applies if you use Application Sets with Cluster Generators and configure argocd..
