AI-analyzed release notes for CNCF graduated and incubating projects.
This release contains routine correctness fixes and a security fix in the server. The security change concerns users of the SSD CLI.
Action needed (1)
securitySSD CLI secret-mask spoofing prevention
The server prevents secret-mask spoofing in the SSD CLI. This fix ships in Argo CD v3.5.1.
A maintenance release with correctness fixes, a server-side secret-mask spoofing fix, and a third-party dependency update. Ordinary fixes and the dependency update require no operator action, while upgrading addresses the security fix.
Action needed (1)
securitySSD CLI secret-mask spoofing prevention
The server now prevents secret-mask spoofing in the SSD CLI. This fix ships in the 3.4 release line.
A maintenance release with fixes for secret masking and pprof endpoint configuration, alongside dependency updates for two listed CVEs. The secret-handling fixes and dependency updates are addressed by upgrading, while the remaining defect fixes require no operator action.
Action needed (2)
securityhighThe /ui brace-expansion dependency update for CVE-2026-69152
The /ui dependency brace-expansion is updated to 2.1.4 and 1.1.18 for CVE-2026-69152.
securitymediumThe DOMPurify dependency update for CVE-2026-49978
The DOMPurify dependency is updated to 3.4.7 for CVE-2026-49978.
Check if affected (2)
securitySSD CLI secret mask spoofing prevention
Applies if you use SSD CLI.
The SSD CLI secret mask spoofing fix ships in the server.
securitySecret hiding in the last-applied-configuration annotation
Applies if you configure last-applied-configuration.
The last-applied-configuration annotation no longer exposes secrets in SSD.
A maintenance release focused on operator-facing bug fixes, with additional feature and configuration work. It also includes dependency updates, including a UI dependency update for CVE-2026-41240.
Action needed (3)
securitymediumThe redoc/dompurify dependency update for CVE-2026-41240
The UI dependency redoc/dompurify is bumped to v3.4.0 to fix CVE-2026-41240.
securityThe formidable dependency update
The formidable dependency is updated to v2.1.3.
breakingThe auto-sync toggle removal from the app top bar
The auto-sync toggle is removed from the app top bar.
Check if affected (1)
breakingThe theme default changed to auto
Applies if theme is not configured.
The default for theme is changed to auto in v3.5.0.
A maintenance release with bug fixes and dependency updates. The form-data update in /ui addresses CVE-2026-12143.
Action needed (1)
securityhighThe form-data dependency update for CVE-2026-12143
The form-data dependency is updated to version 4.0.6 in /ui to address CVE-2026-12143.
This is a bug-fix release for Argo CD v3.4.6. The release notes mention corrections to application behavior and integrations, with no security advisories or explicit security vulnerabilities stated.
Source ↗v3.4.5 is a maintenance release focused on correctness fixes and dependency updates. No security advisory or vulnerability is disclosed.
Source ↗This release focuses on correctness fixes in Argo CD. All Argo CD container images are signed by cosign, and provenance is generated for container images and CLI binaries that meet SLSA Level 3 specifications. No security advisory is disclosed.
Source ↗Argo CD v3.3.12 is a maintenance release containing operator-relevant bug fixes. No security advisories or setup-breaking changes are disclosed.
Source ↗Argo CD v3.3.11 contains bug fixes and a UI dependency update addressing CVE-2026-41240. The release concerns deployments using the affected UI dependency.
Action needed (1)
securitymediumThe redoc/dompurify dependency, updated to v3.4.0
The /ui dependency redoc/dompurify is updated to v3.4.0 to address CVE-2026-41240.
A maintenance release with several correctness fixes across Argo CD and a UI dependency update addressing CVE-2026-41240. The recorded fixes cover CLI, UI, Git, controller startup, and resource handling.
Check if affected (1)
securitymediumThe redoc/dompurify dependency, upgraded for CVE-2026-41240
Applies if you use redoc/dompurify in /ui.
The /ui dependency redoc/dompurify is upgraded to v3.4.0 to address CVE-2026-41240.
A maintenance release that closes the 3.2 series and marks it as end of life. It also contains an operator-visible bug fix and a dependency update.
Plan ahead (1)
deprecatedThe 3. reaches end of life
Applies if you use the 3..
This is the final release of the 3.. As of August 4th, this version has reached end of life and will no longer receive bug fixes or security updates.
This release combines bug fixes with dependency and toolchain updates. The Go update to 1. addresses CVEs and concerns deployments using this release.
Action needed (1)
securityThe Go toolchain, updated to 1.
The Go toolchain is updated to 1. on release-3. to resolve CVEs.
Argo CD v3.4.2 is a maintenance release with bug fixes, dependency updates, and corrected secret handling in server-side diff results. It contains no listed security advisories, and no operator action beyond upgrading is identified.
Source ↗A broad maintenance and feature release with correctness, performance, dependency, and operator-facing changes. Operators should review the cluster-version annotation format and changed defaults, while dependency updates include Kubernetes and Helm changes; no explicitly disclosed exploitable vulnerability or security advisory is identified.
Action needed (4)
securityThe k8s. module, updated to v1.
The k8s. module is updated to v1. as a security-related dependency update.
securityThe helm dependency, updated to 3.
The helm dependency is updated to 3. due to a CVE.
breakinggRPC service config DNS TXT lookups, disabled by default
gRPC service config DNS TXT lookups are disabled by default.
breakingThe appset resource status count, defaulted to 5000
The default appset resource status count is changed to 5000.
Check if affected (2)
breakingThe --client flag in the Helm version command, removed
Applies if you use --client.
The --client flag is removed from the Helm version command.
breakingThe cluster-version annotation format, renamed
Applies if you use Application Sets with Cluster Generators and configure argocd..
Application Sets using Cluster Generators and argocd. on cluster secrets must use argocd. instead. The Kubernetes version format changes from Major. to vMajor..
A maintenance release that ends the 3. series on May 06th 2026, after which it will no longer receive bug fixes or security updates. It also includes a fix for an error when attempting a second delete operation.
Plan ahead (1)
deprecatedThe 3. release series, end of liferemoval planned in May 06th 2026
Applies if you run the 3. release series.
This is the final release of the 3. release series. As of May 06th 2026, it reaches end of life and no longer receives bug fixes or security updates.
v3.3.9 is a maintenance release with a disclosed security fix and a go version update to resolve CVEs. It also includes bug fixes in the release.
Action needed (2)
securitycriticalGHSA-3v3m-wc6v-x4x3 security fix
This release fixes the vulnerability identified by GHSA-3v3m-wc6v-x4x3.
securityThe go version update for CVE resolution
The go version is bumped to resolve CVEs in v3.3.9.
Version v3. includes a disclosed security fix and additional correctness and dependency updates. The security fix is the release change that concerns users evaluating whether to upgrade.
Action needed (1)
securitycriticalSecurity fix for GHSA-3v3m-wc6v-x4x3
Version v3. contains a security fix for the vulnerability identified by GHSA-3v3m-wc6v-x4x3.
Argo v3.3.8 is a patch release focused on operator-relevant bug fixes, including a changed default for the ApplicationSet resource status count. No security advisories or security-specific fixes are disclosed.
Source ↗Argo CD v3.2.10 contains operator-relevant bug fixes. The remaining release-note content does not describe a distinct operator-facing change.
Source ↗Argo v3.1.15 is a focused bug-fix release for operator behavior. The listed fixes affect refresh behavior and application-controller synchronization, while the other release material covers installation, documentation, headings, or release metadata.
Source ↗Argo v3.3.7 is a maintenance release with ordinary bug fixes, performance improvements, and dependency updates. It also documents a known application-reconciliation issue that remains unresolved. No security vulnerability or operator action beyond upgrading is identified.
Source ↗Argo v3.1.14 includes an application refresh defect correction and a fast-xml-parser dependency update in the UI. No security advisories or mandatory operator actions are disclosed.
Argo v3.2.9 is a maintenance release with defect corrections and dependency updates. It also documents a known limitation, so teams should review the release notes if they rely on the affected behavior.
Source ↗This is a maintenance release for Argo CD focused on operator-relevant bug fixes. It addresses incorrect behavior in application normalization and cached installation ID handling.
Source ↗This maintenance release includes a security mitigation for CVE-2026-33186 in grpc-go. It also contains ordinary fixes to application behavior and the user interface.
Action needed (1)
securitycriticalgrpc-go CVE-2026-33186 mitigation
A mitigation for CVE-2026-33186 in grpc-go ships in the release-3. line.
Argo CD v3.1.13 focuses on release artifact provenance and maintenance, with a security mitigation, a UI correction, and a dependency update. Container images are signed, and qualifying container images and CLI binaries receive SLSA Level 3 provenance.
Action needed (1)
securitycriticalgrpc-go CVE-2026-33186 mitigation
The release includes a mitigation for CVE-2026-33186 in grpc-go for release-3.1.
Argo CD v3.3.5 is a maintenance release with six operator-relevant bug fixes and an update to the google. dependency from 1.77.0 to 1.79.3. No security advisories or security-specific fixes are disclosed.
Argo CD v3.3.4 includes signed container images, a fix that skips token refresh threshold parsing in unrelated components, and an otel-sdk dependency update. The release also contains CI-only work, headings, and installation examples without separately actionable operator impact.
A maintenance release with a compatibility update for cluster version labels and several ordinary defect corrections. The compatibility update concerns Application Sets that fetch clusters based on Kubernetes version.
Check if affected (1)
breakingThe argocd. format, changed
Applies if argocd. and argocd. are configured.
Application Sets with Cluster Generators must use argocd. with the vMajor. format instead of the previous Major. format when fetching clusters by Kubernetes version. The affected cluster secret uses argocd..
This release fixes the client-side apply migration issue reported in versions 3. and 3.. No security advisories are disclosed.
Action needed (1)
breakingClient-side apply migration failure
The failed to perform client-side apply migration issue present in versions 3. and 3. is fixed in this release.
Argo CD v3.2.7 is a maintenance release with ordinary bug fixes and a Go dependency update. No security advisory or forced operator action is disclosed.
Source ↗Argo CD v3.3.1 is a maintenance release with correctness fixes and updates to its Kustomize dependency and Ubuntu base image. Operators of self-managing Argo CD installations should account for the documented upgrade prerequisite.
Source ↗Argo v3.3.0 is a substantial feature and maintenance release with changes across synchronization, health, hydration, diff and apply behavior, the UI, and resource operations. It also updates core dependencies and removes an app controller flag.
Action needed (3)
securityThe k8s. module, updated to v1.34.2
The k8s. module is updated to v1.34.2 in Argo v3.3.0.
securityHelm 3.19.4
Helm is updated to 3.19.4 in Argo v3.3.0.
securityRedis, updated to the latest stable release
Redis is updated to the latest stable release in Argo v3.3.0.
Check if affected (1)
breakingThe --self-heal-backoff-cooldown-seconds flag, removed
Applies if your app controller configuration uses --self-heal-backoff-cooldown-seconds.
The app controller no longer includes the unnecessary --self-heal-backoff-cooldown-seconds flag.
Argo CD v3.2.6 is a maintenance release with operator-facing bug fixes and a dependency update. The remaining release-note entries are headings or documentation and release metadata rather than distinct operator-facing changes.
Source ↗
