Argo
v3.3.10CI/CD & App DeliveryArgo CD v3.3.10 is a patch release fixing a nil-pointer panic in permission validation, a log line UI overflow bug, and bumping Go to 1.25.9 to address CVEs.
securityUpgrade immediately — Go 1.25.9 fixes CVEs in the runtime
The Go runtime was bumped from a prior version to 1.25.9 specifically to resolve CVEs. The release notes don't enumerate the CVE IDs, but any patch that upgrades the runtime for security reasons on a stable branch deserves prompt action. If you're running 3.3.x, upgrade to 3.3.10 now rather than waiting for your next maintenance window.
breakingServer-side diff now correctly hides secrets — verify diff outputs if you rely on them
The fix to apply HideSecretData to server-side diff results means that previously exposed secret values in diff views will now be redacted. If any automation, alerting, or audit tooling parses diff output expecting raw secret values, it will break. Review your diff-dependent workflows before upgrading.
enhancementNil APIResource panic fix prevents unexpected controller crashes
The permission validator could panic when an APIResource was nil — a condition that can occur with certain custom or non-standard API groups. If you've seen intermittent ArgoCD controller restarts without clear cause, this is a likely culprit. Upgrade to 3.3.10 to stabilize those environments.
主な変更 (5)
- Go runtime updated to 1.25.9 to resolve unspecified CVEs affecting the 3.3 branch
- Panic fix in permission validator when APIResource is nil — previously could crash the controller
- Log viewer wrap-lines toggle no longer causes lines to overflow the container
- HideSecretData now correctly applied to server-side diff results in gitops-engine
- OpenTelemetry SDK bumped to 1.43.0