Argo
v3.1.14CI/CD & App DeliveryArgo CD v3.1.14 is a small patch fixing unnecessary app refreshes and a CI lockfile issue, plus a dependency bump for fast-xml-parser.
enhancementUpgrade if informer resync is flooding your refresh queue
The fix for automatic refreshes triggered by informer resync and status updates is the real reason to pick up this patch. If you've been seeing excessive app refresh activity or high controller CPU load during resync windows, this addresses the root cause. Deploy this patch during your next maintenance window — it's low risk.
securityfast-xml-parser bump closes potential parsing vulnerabilities
The fast-xml-parser library was bumped three minor versions. These kinds of XML parser updates often address denial-of-service or entity expansion issues. While Argo CD's exposure surface for this library is limited to the UI, staying current here is straightforward — just upgrade and verify UI functionality in your staging environment.
主な変更 (4)
- Prevents automatic refreshes triggered by informer resync and status updates — a meaningful reduction in unnecessary reconciliation noise
- Fixes yarn install running without --frozen-lockfile in CI, improving build reproducibility
- Bumps fast-xml-parser from 4.5.3 to 4.5.6 in the UI dependency tree
- All container images remain cosign-signed with SLSA Level 3 provenance