v3.6.0-rc1

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.6.0-rc1/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.6.0-rc1/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Features

• bac4616: feat(actions): add hibernate/rehydrate actions for CNPG Cluster (#28478) (@purisev)
• 0df1a4b: feat(appset): Add progressive sync metrics for AppSet (#29202) (@ranakan19)
• ad23d3a: feat(appset): Adding annotations on apps to force reconciliation before proceeding with progressive sync (#27467) (@ranakan19)
• 94564eb: feat(appset): add metrics for count of app refreshes triggered by appset during progressive sync (#29244) (@ranakan19)
• 9ef034e: feat(appset): expose workqueue rate limiter flags on applicationset-controller (#28286) (@om7057)
• 5899f89: feat(appset): surface progressive sync scenario into condition as reasons and messages (#27820) (@ranakan19)
• 4e8ea39: feat(ci): enable Zizmor to enforce secure config (#27304) (@crenshaw-dev)
• ec10f2e: feat(cli): optionally exclude status field when using argocd admin export command (#29219) (@nitishfy)
• 5c3637d: feat(controller): allow metrics label/condition flags via argocd-cmd-params-cm (#28287) (@edgrz)
• d94bcb1: feat(dex): Configure TLS Minversion for Dex web (#28712) (@akhilnittala)
• 465d43b: feat(dex): Making Dex storage type and config configurable from argocd-cm configmap (#28624) (@akhilnittala)
• 2e2f4e4: feat(health): Implement kyverno health checks (#27354) (@sandert-k8s)
• 034ab61: feat(health): add built-in health check for TLSRoute (#26596) (@dnfwlq8054)
• 49aa0ea: feat(health): add health check for AWS ACK resources (#29016) (@philljie)
• e1145c6: feat(health): add health check for CloudNativePG Backup (#28468) (@yugstar)
• 643de0b: feat(health): add health check for CloudNativePG Database CRD (#29511) (@Matthiator)
• ff00ee7: feat(health): add health check for Kro resources (#28743) (@philljie)
• 3825b96: feat(health): add health check for MedusaBackupJob (issue #28009) (#28008) (@mgross2)
• 309594b: feat(health): add health check for MedusaTask (issue #28007) (#28006) (@mgross2)
• 6858a80: feat(health): add health check for Prometheus Operator Alertmanager (#28446) (@yugstar)
• 2338867: feat(health): add health check for Prometheus Operator ThanosRuler (#28463) (@yugstar)
• 831d77b: feat(health): add health check for cert-manager CertificateRequest (#28465) (@yugstar)
• dec470a: feat(health): add health check for cert-manager trust-manager Bundle (#28615) (@yugstar)
• fdf6751: feat(health): add health check for flink.apache.org/FlinkSessionJob (#26626) (@sivchari)
• 21ac508: feat(health): add health checks for Tekton PipelineRun and TaskRun (#28467) (@yugstar)
• 180061c: feat(health): add health checks for Velero Backup, Restore, and Schedule (#28464) (@yugstar)
• 5708801: feat(health): add health checks for cert-manager ACME Order and Challenge (#28466) (@yugstar)
• 291bfab: feat(health): enable a Pipeline labeled 'recyclable-expired' to be deleted (#28532) (@juliev0)
• 463f39a: feat(health): support ListenerSet.gateway.networking.k8s.io (#28388) (@root30)
• ffe66ff: feat(health): support custom deletion messages (#27595) (#27596) (@crenshaw-dev)
• 5e8ed63: feat(health): support various policies _.microgateway.airlock.com (#28268) (@root30)
• 961bd43: feat(hydrator): add metrics to app info (#29512) (#29514) (@crenshaw-dev)
• 2d71dc6: feat(hydrator): sign hydrated commits (Alpha) (#28239) (#28271) (@mladjan-gadzic)
• c2df91b: feat(impersonation): allow to disable strict enforcement (#27084) (#27573) (@agaudreault)
• e2b719a: feat(otel): add spans with configurable sampling (#28396) (@blakepettersson)
• b2e6d1d: feat(perf): configurable serialization and compression for cached manifests (#26897) (#28600) (@adityaraj178)
• e5eb504: feat(perf): count apps per cluster in a single pass (#29570) (@rumstead)
• 4c36558: feat(perf): drop two redundant application copies from the refresh path (#29581) (@rumstead)
• 37273e3: feat(perf): partial json unmarshalling (#29378) (@blakepettersson)
• 0f901d1: feat(perf): resolve the destination server without copying the cluster (#29573) (@rumstead)
• 0c2545d: feat(perf): reuse matrix child params when the generator is unchanged (#29582) (@rumstead)
• 54a740e: feat(resource_customizations): support ignored status for victoriametrics healthcheck (#29351) (@AndrewChubatiuk)
• 4abcbcf: feat(server): Add support for redirect to selected Dex connector (Alpha) (#24221) (@antonu17)
• e4470c5: feat(server): add configHash field to Cluster (#25311) (#27657) (@matmil-dev)
• fc848eb: feat(server): set X-Robots-Tag to prevent indexing of the UI (#28359) (@yugstar)
• 0141bf0: feat(tls): Make TLS Curve prefereneces configurable while setting TLS options for repo-server and server. (#28846) (@akhilnittala)
• ba47c6b: feat(ui): Implement virtual scrolling for Apps list/tiles view when all is selected (#29542) (@aali309)
• bf984ea: feat(ui): Lazy loading (#29087) (@jwinters01)
• ac01194: feat(ui): add regex search toggle to application(sets) list (#27857) (#27889) (@rickbrouwer)
• 8073201: feat(ui): add resources explorer view (#28098) (@agaudreault)
• 5b4b5de: feat(ui): add search bar and pagination to settings pages (#28305) (@agaudreault)
• e2a605e: feat(ui): add server-side name filter to applications list and watch (#29106) (#29242) (@rickbrouwer)
• f495ca5: feat(ui): advanced settings view (#28383) (@agaudreault)
• 4fa944e: feat(ui): enable React Compiler in the build (@jwinters01)
• 9cf8d7c: feat(ui): sidebar anchors (#28527) (@blakepettersson)
• 91f7adc: feat(ui): use anchors instead of divs in app/appset tiles and tablerows (#28005) (@blakepettersson)
• 73bf020: feat(webhook): Add manifest-generate-paths annotation support for BitBucket Server (#27552) (@adityaraj178)
• ca3139e: feat(webhook): add webhook support for harbor (#27810) (#27884) (@adityaraj178)
• 7bdadbf: feat(webhooks): add webhook support for DockerHub (#28022) (@nitishfy)
• 79b0815: feat: Add deprecation warning when using --signature-keys (#28941) (@kuci-JK)
• b5d698a: feat: Add health check for pulumi.com/Stack (#28534) (@guineveresaenger)
• 0703fca: feat: Add health check resource customizations for Envoy Gateway Extension CRDs (#27291) (@obliadp)
• 34427a6: feat: Add reporting component to events list (#25684) (#27678) (@Suven-p)
• 816fcd0: feat: Allow pod healthcheck to ignore restart policy via annotation (#15317) (Alpha) (#28249) (@jskrill)
• 48f9461: feat: Default to SSD with SSA and remove SMD (#29103) (@pjiang-dev)
• 35238e3: feat: Replace SIGNATURE-KEYS with SOURCE-INTEGRITY in proj list (#28920) (@kuci-JK)
• 7a80e4c: feat: accept repository-style Azure keys in repo-creds (#29414) (#29415) (@SHINMH)
• 1828831: feat: add tpl function to ApplicationSet go-templating (#16302)...

v3.5.3

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.3/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.3/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• c198be7: fix(health): a KubeVirt VirtualMachine declared stopped is Healthy (cherry-pick #29664 for 3.5) (#29665) (@argo-cd-cherry-pick-bot[bot])
• 4b3f69d: fix(health): report suspended FlinkDeployment as healthy (#26818) (cherry-pick #28995 for 3.5) (#29525) (@argo-cd-cherry-pick-bot[bot])
• dd2cb1a: fix(repository): clean repository on revision change (cherry-pick #28771 for 3.5) (#29486) (@argo-cd-cherry-pick-bot[bot])
• 70b399c: fix(resource_customizations): Crossplane MRs should report Progressing (not Healthy) whilst provisioning [ISSUE: #29381] (cherry-pick #29382 for 3.5) (#29520) (@argo-cd-cherry-pick-bot[bot])
• be8b387: fix(sync): correctly set operationState values on retry (#26530) (cherry-pick #28778 for 3.5) (#29431) (@omkar619-dev)
• a5e5992: fix(ui): guard SSO redirect to stop 401 retry loop (cherry-pick #28807 for 3.5) (#29631) (@argo-cd-cherry-pick-bot[bot])
• 0b0890e: fix(ui): use hydrateTo branch name when set (cherry-pick #29562 for 3.5) (#29564) (@crenshaw-dev)
• 18f0566: fix: GRPCRoute health check ignores stale observedGeneration conditions (#28086) (cherry-pick #28087 for 3.5) (#29517) (@argo-cd-cherry-pick-bot[bot])
• 4d653a6: fix: handle GrafanaFolder negative-polarity condition (#29395) (cherry-pick #29397 for 3.5) (#29524) (@argo-cd-cherry-pick-bot[bot])
• ec58520: fix: recover AuthReconcile visitor panics (cherry-pick #29440 for 3.5) (#29531) (@Karthik-Chowdary)

Full Changelog: v3.5.2...v3.5.3

v3.4.9

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.9/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.9/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• b938a5e: fix(health): a KubeVirt VirtualMachine declared stopped is Healthy (cherry-pick #29664 for 3.4) (#29666) (@argo-cd-cherry-pick-bot[bot])
• 8d84b93: fix(health): report suspended FlinkDeployment as healthy (#26818) (cherry-pick #28995 for 3.4) (#29527) (@argo-cd-cherry-pick-bot[bot])
• bfd48bd: fix(repository): clean repository on revision change (cherry-pick #28771 for 3.4) (#29485) (@argo-cd-cherry-pick-bot[bot])
• 4e0f6b7: fix(resource_customizations): Crossplane MRs should report Progressing (not Healthy) whilst provisioning [ISSUE: #29381] (cherry-pick #29382 for 3.4) (#29521) (@argo-cd-cherry-pick-bot[bot])
• 182c837: fix(sync): correctly set operationState values on retry (#26530) (cherry-pick #28778 for 3.4) (#29432) (@omkar619-dev)
• ae71331: fix(ui): guard SSO redirect to stop 401 retry loop (cherry-pick #28807 for 3.4) (#29632) (@argo-cd-cherry-pick-bot[bot])
• 38b5adf: fix(ui): use hydrateTo branch name when set (cherry-pick #29562 for 3.4) (#29566) (@crenshaw-dev)
• fb9431d: fix: GRPCRoute health check ignores stale observedGeneration conditions (#28086) (cherry-pick #28087 for 3.4) (#29518) (@argo-cd-cherry-pick-bot[bot])
• 51edefd: fix: handle GrafanaFolder negative-polarity condition (#29395) (cherry-pick #29397 for 3.4) (#29523) (@argo-cd-cherry-pick-bot[bot])

Full Changelog: v3.4.8...v3.4.9

v3.5.2

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.2/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.2/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• f1f109c: fix(appset): restore ignoreApplicationDifferences after normalization (cherry-pick #29070 for 3.5) (#29195) (@argo-cd-cherry-pick-bot[bot])
• a45dd38: fix(repository): resolve untyped helm source type in UpdateRevisionForPaths (cherry-pick #28904 for 3.5) (#29399) (@argo-cd-cherry-pick-bot[bot])
• 417c675: fix(revert): auto-sync skipped when newer commit arrives during sync (cherry-pick #28692 for 3.5) (#29224) (@rumstead)
• 961ee40: fix(ui): remove kind filter from appset page (#29310) (#29311) (cherry-pick 3.5) (#29314) (@crenshaw-dev)
• cc1f3ee: fix(ui): show operation state on applications list page (cherry-pick release-3.5) (#29344) (@antonu17)
• 5accee3: fix: don't degrade Cluster API Cluster health while Ready is False during provisioning (cherry-pick #29237 for 3.5) (#29273) (@argo-cd-cherry-pick-bot[bot])
• 4d99c52: fix: recover from kubectl panic in AuthReconcile when SA is forbidden (cherry-pick #28669 for 3.5) (#29294) (@alexymantha)

Dependency updates

• 8b9e270: chore(deps): update dependency dexidp/dex to v2.45.1 (#29334) (@nitishfy)

Other work

• e258ee2: chore: bump version to 3.5.2 on release-3.5 branch (#29404) (@github-actions[bot])
• a9d94d6: fix(notification-controller): deep-copy before mutating object from a shared cache (cherry-pick #29350 for 3.5) (#29354) (@argo-cd-cherry-pick-bot[bot])
• cc1d7a2: fix(notification-controller): read appprojects from informer cache (#28815) (cherry-pick release-3.5) (#29345) (@antonu17)

Full Changelog: v3.5.1...v3.5.2

v3.4.8

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.8/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.8/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• 90f81d5: fix(revert): auto-sync skipped when newer commit arrives during sync (cherry-pick #28692 for 3.4) (#29225) (@rumstead)
• 924ab35: fix: don't degrade Cluster API Cluster health while Ready is False during provisioning (cherry-pick #29237 for 3.4) (#29274) (@argo-cd-cherry-pick-bot[bot])

Dependency updates

• e4de80d: chore(deps): bump DOMPurify to 3.4.7 for CVE-2026-49978 (#29222) (@aali309)
• 2475426: chore(deps): bump brace-expansion to 2.1.4, 1.1.18 in /ui for fixing CVE-2026-14257 and CVE-2026-69152 (release-3.4) (#29379) (@nmirasch)
• e5bee2c: chore(deps): bump js-yaml to fix CVE-2026-59869 (#28946) (@aali309)

Other work

• 609fa82: chore: bump version to 3.4.8 on release-3.4 branch (#29405) (@github-actions[bot])
• 9c771f6: fix(notification-controller): deep-copy before mutating object from a shared cache (cherry-pick #29350 for 3.4) (#29353) (@argo-cd-cherry-pick-bot[bot])
• bad3c48: fix(notification-controller): read appprojects from informer cache (#28815) (cherry-pick release-3.4) (#29346) (@antonu17)

Full Changelog: v3.4.7...v3.4.8

v3.5.1

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.1/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.1/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• 33f3bc5: fix(appset): stop progressive sync reconciling in a tight loop (#27577) (#29139) (@himeshp)
• d358e75: fix(appset): verify terminating Applications against the API server (#29042) (#29138) (@himeshp)
• ecf3737: fix(controller): cherry-pick treat timeout.reconciliation=0 as disabled soft expiry (#27683) (#29007) (@aali309)
• 978fa65: fix(controller): reuse server-side diff result when masking Secret data (#27858) (#29074) (@1ovsss)
• f399c84: fix(controller): use diff cache when timeout.reconciliation is disabled (cherry-pick #29073 for 3.5) (#29158) (@argo-cd-cherry-pick-bot[bot])
• 960bed7: fix(server): prevent SSD CLI secret mask spoofing (cherry-pick #29089 for 3.5) (#29130) (@argo-cd-cherry-pick-bot[bot])
• 9f360f4: fix(ssd): hide secret in last-applied-configuration annotation (#28989) (#29052) (@pjiang-dev)

Other work

• 109ca7c: chore: bump version to 3.5.1 on release-3.5 branch (#29165) (@github-actions[bot])
• b44fbbc: fix(manifest-generate-paths): Consistent gen manifest cache key (#28074 and #29037) (#29049) (@agaudreault)

Full Changelog: v3.5.0...v3.5.1

v3.4.7

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.7/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.7/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• cbd7687: fix(appset): progressive sync fixes (3.4 backports of #29042 and #27577) (#29141) (@himeshp)
• 0781a1a: fix(controller): reuse server-side diff result when masking Secret data (#27858) (#29075) (@1ovsss)
• a09c39c: fix(server): prevent SSD CLI secret mask spoofing (cherry-pick #29089 for 3.4) (#29131) (@argo-cd-cherry-pick-bot[bot])
• 8afda0d: fix(ssd): hide secret in last-applied-configuration annotation (#28989) (#29053) (@pjiang-dev)

Dependency updates

• e0aea00: chore(deps): bump fast-xml-parser from 4.5.3 to 4.5.6 in /ui - 3.4 (#27342) (@keithchong)

Other work

• 7b6113c: chore: bump version to 3.4.7 on release-3.4 branch (#29161) (@github-actions[bot])

Full Changelog: v3.4.6...v3.4.7

v3.3.14

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.14/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.14/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• 7242ed2: fix(controller): reuse server-side diff result when masking Secret data (#27858) (#29076) (@1ovsss)
• d93267f: fix(server): prevent SSD CLI secret mask spoofing (#29089) (#29137) (@pjiang-dev)
• 4e181b9: fix(ssd): hide secret in last-applied-configuration annotation (#28989) (#29054) (@pjiang-dev)
• 80f08f9: fix: register pprof endpoints in repo-server using the params config map (cherry-pick #26237 for 3.3) (#29032) (@gdsoumya)

Dependency updates

• cf38a82: chore(deps): bump DOMPurify to 3.4.7 for CVE-2026-49978 (#28969) (@aali309)
• d3f7e8c: chore(deps): bump brace-expansion to 2.1.4, 1.1.18 in /ui for fixing CVE-2026-69152 (release-3.3) (#29149) (@dkarpele)

Other work

• a0a99e1: chore: bump version to 3.3.14 on release-3.3 branch (#29159) (@github-actions[bot])

Full Changelog: v3.3.13...v3.3.14

v3.5.0

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.0/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.0/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Features

• be19446: feat(Jitter): Add Configurable Jitter for Webhook-Triggered application Refreshes (#25433) (@adityaraj178)
• 5b30739: feat(appset): add concurrency when managing applications (#26642) (@rumstead)
• 29fd8db: feat(appset): filtering repos by archived status #20736 (#21505) (@prune998)
• 57942ce: feat(cli): Add support for Source Integrity configuration (#26997) (@olivergondza)
• 3cc6ba7: feat(cli): add --app-namespace flag to missing argocd app subcommands (#27942) (@Mangaal)
• 0e729cc: feat(cli): add appset-namespace for appset command (#27022) (@Mangaal)
• 744983b: feat(health): Add healthcheck for gardener "Shoot" resources (#25750) (@Sven1410)
• 6cc786d: feat(health): add GatewayClass health check (#26591) (@dnfwlq8054)
• eabd4d6: feat(health): add pause and unpause actions to psmdb resource (#27616) (@KyriosGN0)
• daadf86: feat(health): additional promoter.argoproj.io health checks (#27170) (@crenshaw-dev)
• 4b69a7f: feat(health): finalizer messages for Promoter checks (#27478) (@crenshaw-dev)
• 289a4c0: feat(health): support BackendTLSPolicy.gateway.networking.k8s.io (#27385) (@snorwin)
• 4cdc650: feat(helm): support wildcard glob patterns for valueFiles (#26768) (@nitishfy)
• f7a7deb: feat(hydrator): dynamically manage README template from argocd-cm ConfigMap [updated] (#19067) (#24309) (@gyu-young-park)
• 86936e2: feat(hydrator): make manifest hydration queue concurrency configurable (#27926) (#27948) (@GuruduGanesh)
• 2308e17: feat(hydrator): opt-in source integrity verification for dry sources (Alpha) (#19302) (#28084) (@mladjan-gadzic)
• bf1591d: feat(hydrator): support syncSource repoURL for separate destination repo (#27011) (@boostrack)
• 41b6fee: feat(impersonation): allow to disable strict enforcement (#27084) (cherry-pick #27573 for 3.5) (#28595) (@argo-cd-cherry-pick-bot[bot])
• 0c0140c: feat(metrics): add parallelism limit repo server (#27911) (@pjiang-dev)
• 7d2eb77: feat(renovate): clean up config and remove github app (#27738) (@rumstead)
• 153ec67: feat(resource_customizations): add health checks for VictoriaMetrics (#27451) (@megative)
• 6b84ea9: feat(server): drop objects from non-allowed namespaces before they enter the cache. (#28018) (@christianh814)
• 224b75a: feat(server): use typed Argo CD EventList for event-listing APIs (#25767) (#26322) (@chansuke)
• 64a0417: feat(ui): Add AppSet to Application Resource Tree (#26601) (@pjiang-dev)
• b035a77: feat(ui): ApplicationSet Preview Apps tab in UI (#27799) (@pjiang-dev)
• 566c172: feat(ui): add GitOps Promoter resource icon (#26894) (@crenshaw-dev)
• 0dd8874: feat(ui): add nauth.io resource icon (#28226) (@choufraise)
• f16d08a: feat(ui): add repo url as filter in home page (#26670) (#27418) (@adityaraj178)
• 91e7664: feat(ui): per-application notice banner and info icon (#14405) (#27719) (@gdsoumya)
• 1b405ce: feat(ui): search filter by target revision (#24038) (@choejwoo)
• 706a037: feat(ui): support creating multi-source applications in New App panel [CONTINUED..] (#27095) (@aali309)
• 2fcf104: feat(ui): support spec.sourceHydrator.drySource.repoURL (@crenshaw-dev)
• 74d1fe0: feat(ui): use toggle-auto-sync resource action in app details page (#21564) (#27226) (@shiiyan)
• db7d672: feat(webhooks): add webhook support for GHCR (#26462) (@nitishfy)
• 6d92e17: feat: Add ProvideClusterInfo and Config fields to ExecProviderConfig (#24282) (#27976) (@mikeshng)
• 022f935: feat: Add basic support for git tag path prefixes (#27290) (@k4r1)
• aad3422: feat: Add suspend/resume actions for MariaDB (#27675) (#27674) (@mgross2)
• 586430c: feat: Migrate from Helm 3 to Helm 4 (#28076) (@reggie-k)
• c61c1dc: feat: Render Helm ValuesObject as YAML in log output instead of binary (#18342) (#27649) (@subhramit)
• 9a19735: feat: Support Azure Service Principal authentication for Azure DevOps repositories (#25324) (@allanyung)
• 97082e8: feat: add Gateway API support to network view (#26188) (@tete17)
• 603c900: feat: add action to delete recyclable Numaflow pipelines (#25900) (@dpadhiar)
• de94161: feat: add action to restart StrimziPodSet (#27266) (@KyriosGN0)
• a2b91ce: feat: add depth option to ui (#26618) (@blakepettersson)
• 1dc2ad0: feat: add health check for karpenter.sh/NodeClaim (#26876) (@Navneet072300)
• 611fcb0: feat: add sync overrun option to sync windows (#25361) (#25510) (@puskunalis)
• 48f18e2: feat: add toggle-auto-sync resource action for Application (#21564) (#26477) (@vikasrao23)
• 2df5f75: feat: adds mTLS support in repo-server (#26715) (@ppapapetrou76)
• 4d02fc2: feat: expose Appset UI and fix pie chart summary (#26666) (@pjiang-dev)
• a889f46: feat: make appset proxy-url param a native flag (#27788) (@ppapapetrou76)
• ad310c2: feat: replace error message in webhook handler with metrics (#27215) (@alexmt)
• 01187d1: feat: support Azure AD groups claims overflow via Microsoft Graph API (#27397) (@gravufo)
• f71239c: feat: support destinationServiceAccounts in global projects (#23059) (@enneitex)
• f460a3c: feat: surface root cause in sync failure message and cache discovery errors (#27750) (@ppapapetrou76)
• 3eebbcb: feat: use impersonation for server operations (logs, delete, etc) #22996 (#26898) (@alexymantha)

Bug fixes

• b982144: Revert "fix: prevent automatic refreshes from informer resync and status updates" (#27562) (@agaudreault)
• c5d1c91: fix(UI): show RollingSync step clearly when labels match no step (#26877) (@aali309)
• c52bf66: fix(appcontroller): application controller in core mode fails to sync when server.secretkey is missing (#26793) (@anandf)
• e81969f: fix(applicationset): include repo URL in git file generator errors (#28075) (@morning-verlu)
• e4fe7f6: fix(appset): don't release finalizer while children still terminate (cherry-pick #28999 for 3.5) (#29006) (@argo-cd-cherry-pick-bot[bot])
• 06fae9d: fix(appset): fall back to create when patch returns NotFound (#17312) (cherry-pick #28645 for 3.5) (#28716) (@argo-cd-cherry-pick-bot[bot])
• 45a84df: fix(ci): add .gitkeep to images dir (#26892) (@blakepettersson)
• 4c42071: fix(ci): openssf scorecard doesn't allow global vars (#27203) (@crenshaw-dev)
• 36f4ff7: fix(ci): pin goreman version used in ci-build.yaml (#27062) (#27061) (@dudinea)
• 25b3037: fix(ci): pnpm sbom generation (#27337) (#27339) (@crenshaw-dev)
• 99c51df: fix(ci): renovatebot action uses floating image tag (#27023) (#27024) (@dudinea)
• fb82b16: fix(ci): run yarn install with --frozen-lockfile (#27098) (#27099) (@dudinea)
• b403f5c: fix(cli): hi...

v3.4.6

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.6/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.6/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• aa9970b: fix(appset): fall back to create when patch returns NotFound (#17312) (cherry-pick #28645 for 3.4) (#28718) (@rickbrouwer)
• 9a91802: fix(diff): don't drop manager-owned descendant fields when filtering webhook mutations (cherry-pick #28819 for 3.4) (#28894) (@argo-cd-cherry-pick-bot[bot])
• 4907a99: fix(helm): pass registry passwords through stdin (#17821) (#28835) (@nitishfy)
• b6d7c82: fix: mount argocd-cmd-params-cm in repo-server so pprof can be enabled (cherry-pick #28863 for 3.4) (#28864) (@argo-cd-cherry-pick-bot[bot])
• cf7c4a7: fix: only do annotation backfill if live unset (cherry-pick #28770 for 3.4) (#28776) (@argo-cd-cherry-pick-bot[bot])
• a3d8e28: fix: progressive sync fixes (3.4 cherry-picks) (#29000) (@blakepettersson)
• 2aa646b: fix: use Entra ID uti claim as token id when jti is absent (#28625) (cherry-pick #28656 for 3.4) (#28676) (@argo-cd-cherry-pick-bot[bot])
• 275d11e: fix: use OIDC refresh tokens to renew expired sessions (#27041, #12189) (cherry-pick #27777 for 3.4) (#28688) (@argo-cd-cherry-pick-bot[bot])

Other work

• e1becb7: chore: bump version to 3.4.6 on release-3.4 branch (#28959) (@github-actions[bot])

Full Changelog: v3.4.5...v3.4.6