# Argo v3.6.0

> CI/CD & App Delivery · 2026-11-03

A substantial feature release adds integrations, health checks, observability, UI and configuration capabilities, along with correctness fixes and dependency refreshes. Operators using the in-process server should note the changed `SyncWithReplaceAllowed` default, and the release includes coordinated security updates.

## Action needed
- **[security · medium]** The `DOMPurify` dependency, updated for `CVE-2026-49978`
  - The `DOMPurify` dependency is updated to 3.4.7 for `CVE-2026-49978`.
- **[security]** Coordinated security fixes
  - Argo CD includes coordinated security fixes for the 3.6 release.
- **[security]** `SSD` CLI secret mask spoofing prevention
  - The server prevents secret mask spoofing in the `SSD` CLI.
- **[breaking]** The `SMD` option, removed
  - The release defaults to `SSD` with `SSA` and removes `SMD`.

## Check if affected
- **[breaking]** The `SyncWithReplaceAllowed` default
  - Applies if you run an in-process server.
  - `SyncWithReplaceAllowed` is enabled by default for the in-process server.

## Plan ahead
- **[deprecated]** The `--signature-keys` deprecation warning
  - Applies if you use `--signature-keys`.
  - The release adds a deprecation warning when you use `--signature-keys`.

## Other recorded changes
- 418 (defect_corrected 183, value_changed 140, added 78, constraint_changed 9, renamed 4, removed 3, default_changed 1)

[Full analysis](https://ratatosk.io/en/releases/argo/v3.6.0)

[Original release notes](https://github.com/argoproj/argo-cd/releases/tag/v3.6.0)