Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: ArgoClear ×

Argov3.3.14CI/CD & App DeliveryAug 12, 2026

ACTION 2CHECK 2OTHER 2View full analysis

A maintenance release with fixes for secret masking and pprof endpoint configuration, alongside dependency updates for two listed CVEs. The secret-handling fixes and dependency updates are addressed by upgrading, while the remaining defect fixes require no operator action.

Action needed (2)

securityhighThe /ui brace-expansion dependency update for CVE-2026-69152
The /ui dependency brace-expansion is updated to 2.1.4 and 1.1.18 for CVE-2026-69152.
securitymediumThe DOMPurify dependency update for CVE-2026-49978
The DOMPurify dependency is updated to 3.4.7 for CVE-2026-49978.

Check if affected (2)

securitySSD CLI secret mask spoofing prevention
Applies if you use SSD CLI.
The SSD CLI secret mask spoofing fix ships in the server.
securitySecret hiding in the last-applied-configuration annotation
Applies if you configure last-applied-configuration.
The last-applied-configuration annotation no longer exposes secrets in SSD.

Source ↗

Argov3.5.0CI/CD & App DeliveryAug 4, 2026

ACTION 3CHECK 1OTHER 286View full analysis

A maintenance release focused on operator-facing bug fixes, with additional feature and configuration work. It also includes dependency updates, including a UI dependency update for CVE-2026-41240.

Action needed (3)

securitymediumThe redoc/dompurify dependency update for CVE-2026-41240
The UI dependency redoc/dompurify is bumped to v3.4.0 to fix CVE-2026-41240.
securityThe formidable dependency update
The formidable dependency is updated to v2.1.3.
breakingThe auto-sync toggle removal from the app top bar
The auto-sync toggle is removed from the app top bar.

Check if affected (1)

breakingThe theme default changed to auto
Applies if theme is not configured.
The default for theme is changed to auto in v3.5.0.

Source ↗

Argov3.4.3CI/CD & App DeliveryMay 28, 2026

CHECK 1OTHER 8View full analysis

A maintenance release with several correctness fixes across Argo CD and a UI dependency update addressing CVE-2026-41240. The recorded fixes cover CLI, UI, Git, controller startup, and resource handling.

Check if affected (1)

securitymediumThe redoc/dompurify dependency, upgraded for CVE-2026-41240
Applies if you use redoc/dompurify in /ui.
The /ui dependency redoc/dompurify is upgraded to v3.4.0 to address CVE-2026-41240.

Source ↗

Argov3.4.1CI/CD & App DeliveryMay 6, 2026

ACTION 4CHECK 2OTHER 275View full analysis

A broad maintenance and feature release with correctness, performance, dependency, and operator-facing changes. Operators should review the cluster-version annotation format and changed defaults, while dependency updates include Kubernetes and Helm changes; no explicitly disclosed exploitable vulnerability or security advisory is identified.

Action needed (4)

securityThe k8s.io/kubernetes module, updated to v1.34.2
The k8s.io/kubernetes module is updated to v1.34.2 as a security-related dependency update.
securityThe helm dependency, updated to 3.19.4
The helm dependency is updated to 3.19.4 due to a CVE.
breakinggRPC service config DNS TXT lookups, disabled by default
gRPC service config DNS TXT lookups are disabled by default.
breakingThe appset resource status count, defaulted to 5000
The default appset resource status count is changed to 5000.

Check if affected (2)

breakingThe --client flag in the Helm version command, removed
Applies if you use --client.
The --client flag is removed from the Helm version command.
breakingThe cluster-version annotation format, renamed
Applies if you use Application Sets with Cluster Generators and configure argocd.argoproj.io/auto-label-cluster-info.
Application Sets using Cluster Generators and argocd.argoproj.io/auto-label-cluster-info on cluster secrets must use argocd.argoproj.io/kubernetes-version instead. The Kubernetes version format changes from Major.Minor to vMajor.Minor.Patch.

Source ↗

Argov3.3.3CI/CD & App DeliveryMar 9, 2026

CHECK 1OTHER 5View full analysis

A maintenance release with a compatibility update for cluster version labels and several ordinary defect corrections. The compatibility update concerns Application Sets that fetch clusters based on Kubernetes version.

Check if affected (1)

breakingThe argocd.argoproj.io/kubernetes-version format, changed
Applies if argocd.argoproj.io/auto-label-cluster-info and argocd.argoproj.io/kubernetes-version are configured.
Application Sets with Cluster Generators must use argocd.argoproj.io/kubernetes-version with the vMajor.Minor.Patch format instead of the previous Major.Minor format when fetching clusters by Kubernetes version. The affected cluster secret uses argocd.argoproj.io/auto-label-cluster-info.

Source ↗

Argov3.3.0CI/CD & App DeliveryFeb 2, 2026

ACTION 3CHECK 1OTHER 362View full analysis

Argo v3.3.0 is a substantial feature and maintenance release with changes across synchronization, health, hydration, diff and apply behavior, the UI, and resource operations. It also updates core dependencies and removes an app controller flag.

Action needed (3)

securityThe k8s.io/kubernetes module, updated to v1.34.2
The k8s.io/kubernetes module is updated to v1.34.2 in Argo v3.3.0.
securityHelm 3.19.4
Helm is updated to 3.19.4 in Argo v3.3.0.
securityRedis, updated to the latest stable release
Redis is updated to the latest stable release in Argo v3.3.0.

Check if affected (1)

breakingThe --self-heal-backoff-cooldown-seconds flag, removed
Applies if your app controller configuration uses --self-heal-backoff-cooldown-seconds.
The app controller no longer includes the unnecessary --self-heal-backoff-cooldown-seconds flag.

Source ↗

Browse by month