# Argo v3.4.8

> CI/CD & App Delivery · 2026-08-27

A maintenance release focused on correctness fixes and security-related dependency updates. No configuration or default changes are documented.

## Action needed
- **[security · high]** The `/ui` `brace-expansion` dependency is updated for `CVE-2026-14257` and `CVE-2026-69152`
  - In `/ui`, this release updates `brace-expansion` to versions 2.1.4 and 1.1.18 for `CVE-2026-14257` and `CVE-2026-69152`.
- **[security · high]** The `js-yaml` dependency is updated for `CVE-2026-59869`
  - This release updates the `js-yaml` dependency to address `CVE-2026-59869`.
- **[security · medium]** The `DOMPurify` dependency is updated to 3.4.7 for `CVE-2026-49978`
  - This release updates the `DOMPurify` dependency to 3.4.7 for `CVE-2026-49978`.

## Other recorded changes
- 4 (defect_corrected 4)

[Full analysis](https://ratatosk.io/en/releases/argo/v3.4.8)

[Original release notes](https://github.com/argoproj/argo-cd/releases/tag/v3.4.8)