Argo CD

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.3/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.3/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• c198be7: fix(health): a KubeVirt VirtualMachine declared stopped is Healthy (cherry-pick #29664 for 3.5) (#29665) (@argo-cd-cherry-pick-bot[bot])
• 4b3f69d: fix(health): report suspended FlinkDeployment as healthy (#26818) (cherry-pick #28995 for 3.5) (#29525) (@argo-cd-cherry-pick-bot[bot])
• dd2cb1a: fix(repository): clean repository on revision change (cherry-pick #28771 for 3.5) (#29486) (@argo-cd-cherry-pick-bot[bot])
• 70b399c: fix(resource_customizations): Crossplane MRs should report Progressing (not Healthy) whilst provisioning [ISSUE: #29381] (cherry-pick #29382 for 3.5) (#29520) (@argo-cd-cherry-pick-bot[bot])
• be8b387: fix(sync): correctly set operationState values on retry (#26530) (cherry-pick #28778 for 3.5) (#29431) (@omkar619-dev)
• a5e5992: fix(ui): guard SSO redirect to stop 401 retry loop (cherry-pick #28807 for 3.5) (#29631) (@argo-cd-cherry-pick-bot[bot])
• 0b0890e: fix(ui): use hydrateTo branch name when set (cherry-pick #29562 for 3.5) (#29564) (@crenshaw-dev)
• 18f0566: fix: GRPCRoute health check ignores stale observedGeneration conditions (#28086) (cherry-pick #28087 for 3.5) (#29517) (@argo-cd-cherry-pick-bot[bot])
• 4d653a6: fix: handle GrafanaFolder negative-polarity condition (#29395) (cherry-pick #29397 for 3.5) (#29524) (@argo-cd-cherry-pick-bot[bot])
• ec58520: fix: recover AuthReconcile visitor panics (cherry-pick #29440 for 3.5) (#29531) (@Karthik-Chowdary)

Full Changelog: https://github.com/argoproj/argo-cd/compare/v3.5.2...v3.5.3

<a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/argo-site/master/content/pages/cd/gitops-cd.png" width="25%" ></a>

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.9/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.9/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• b938a5e: fix(health): a KubeVirt VirtualMachine declared stopped is Healthy (cherry-pick #29664 for 3.4) (#29666) (@argo-cd-cherry-pick-bot[bot])
• 8d84b93: fix(health): report suspended FlinkDeployment as healthy (#26818) (cherry-pick #28995 for 3.4) (#29527) (@argo-cd-cherry-pick-bot[bot])
• bfd48bd: fix(repository): clean repository on revision change (cherry-pick #28771 for 3.4) (#29485) (@argo-cd-cherry-pick-bot[bot])
• 4e0f6b7: fix(resource_customizations): Crossplane MRs should report Progressing (not Healthy) whilst provisioning [ISSUE: #29381] (cherry-pick #29382 for 3.4) (#29521) (@argo-cd-cherry-pick-bot[bot])
• 182c837: fix(sync): correctly set operationState values on retry (#26530) (cherry-pick #28778 for 3.4) (#29432) (@omkar619-dev)
• ae71331: fix(ui): guard SSO redirect to stop 401 retry loop (cherry-pick #28807 for 3.4) (#29632) (@argo-cd-cherry-pick-bot[bot])
• 38b5adf: fix(ui): use hydrateTo branch name when set (cherry-pick #29562 for 3.4) (#29566) (@crenshaw-dev)
• fb9431d: fix: GRPCRoute health check ignores stale observedGeneration conditions (#28086) (cherry-pick #28087 for 3.4) (#29518) (@argo-cd-cherry-pick-bot[bot])
• 51edefd: fix: handle GrafanaFolder negative-polarity condition (#29395) (cherry-pick #29397 for 3.4) (#29523) (@argo-cd-cherry-pick-bot[bot])

Full Changelog: https://github.com/argoproj/argo-cd/compare/v3.4.8...v3.4.9

<a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/argo-site/master/content/pages/cd/gitops-cd.png" width="25%" ></a>

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.8/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.8/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• 90f81d5: fix(revert): auto-sync skipped when newer commit arrives during sync (cherry-pick #28692 for 3.4) (#29225) (@rumstead)
• 924ab35: fix: don't degrade Cluster API Cluster health while Ready is False during provisioning (cherry-pick #29237 for 3.4) (#29274) (@argo-cd-cherry-pick-bot[bot])

Dependency updates

• e4de80d: chore(deps): bump DOMPurify to 3.4.7 for CVE-2026-49978 (#29222) (@aali309)
• 2475426: chore(deps): bump brace-expansion to 2.1.4, 1.1.18 in /ui for fixing CVE-2026-14257 and CVE-2026-69152 (release-3.4) (#29379) (@nmirasch)
• e5bee2c: chore(deps): bump js-yaml to fix CVE-2026-59869 (#28946) (@aali309)

Other work

• 609fa82: chore: bump version to 3.4.8 on release-3.4 branch (#29405) (@github-actions[bot])
• 9c771f6: fix(notification-controller): deep-copy before mutating object from a shared cache (cherry-pick #29350 for 3.4) (#29353) (@argo-cd-cherry-pick-bot[bot])
• bad3c48: fix(notification-controller): read appprojects from informer cache (#28815) (cherry-pick release-3.4) (#29346) (@antonu17)

Full Changelog: https://github.com/argoproj/argo-cd/compare/v3.4.7...v3.4.8

<a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/argo-site/master/content/pages/cd/gitops-cd.png" width="25%" ></a>

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.2/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.2/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• f1f109c: fix(appset): restore ignoreApplicationDifferences after normalization (cherry-pick #29070 for 3.5) (#29195) (@argo-cd-cherry-pick-bot[bot])
• a45dd38: fix(repository): resolve untyped helm source type in UpdateRevisionForPaths (cherry-pick #28904 for 3.5) (#29399) (@argo-cd-cherry-pick-bot[bot])
• 417c675: fix(revert): auto-sync skipped when newer commit arrives during sync (cherry-pick #28692 for 3.5) (#29224) (@rumstead)
• 961ee40: fix(ui): remove kind filter from appset page (#29310) (#29311) (cherry-pick 3.5) (#29314) (@crenshaw-dev)
• cc1f3ee: fix(ui): show operation state on applications list page (cherry-pick release-3.5) (#29344) (@antonu17)
• 5accee3: fix: don't degrade Cluster API Cluster health while Ready is False during provisioning (cherry-pick #29237 for 3.5) (#29273) (@argo-cd-cherry-pick-bot[bot])
• 4d99c52: fix: recover from kubectl panic in AuthReconcile when SA is forbidden (cherry-pick #28669 for 3.5) (#29294) (@alexymantha)

Dependency updates

• 8b9e270: chore(deps): update dependency dexidp/dex to v2.45.1 (#29334) (@nitishfy)

Other work

• e258ee2: chore: bump version to 3.5.2 on release-3.5 branch (#29404) (@github-actions[bot])
• a9d94d6: fix(notification-controller): deep-copy before mutating object from a shared cache (cherry-pick #29350 for 3.5) (#29354) (@argo-cd-cherry-pick-bot[bot])
• cc1d7a2: fix(notification-controller): read appprojects from informer cache (#28815) (cherry-pick release-3.5) (#29345) (@antonu17)

Full Changelog: https://github.com/argoproj/argo-cd/compare/v3.5.1...v3.5.2

<a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/argo-site/master/content/pages/cd/gitops-cd.png" width="25%" ></a>

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.1/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.1/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• 33f3bc5: fix(appset): stop progressive sync reconciling in a tight loop (#27577) (#29139) (@himeshp)
• d358e75: fix(appset): verify terminating Applications against the API server (#29042) (#29138) (@himeshp)
• ecf3737: fix(controller): cherry-pick treat timeout.reconciliation=0 as disabled soft expiry (#27683) (#29007) (@aali309)
• 978fa65: fix(controller): reuse server-side diff result when masking Secret data (#27858) (#29074) (@1ovsss)
• f399c84: fix(controller): use diff cache when timeout.reconciliation is disabled (cherry-pick #29073 for 3.5) (#29158) (@argo-cd-cherry-pick-bot[bot])
• 960bed7: fix(server): prevent SSD CLI secret mask spoofing (cherry-pick #29089 for 3.5) (#29130) (@argo-cd-cherry-pick-bot[bot])
• 9f360f4: fix(ssd): hide secret in last-applied-configuration annotation (#28989) (#29052) (@pjiang-dev)

Other work

• 109ca7c: chore: bump version to 3.5.1 on release-3.5 branch (#29165) (@github-actions[bot])
• b44fbbc: fix(manifest-generate-paths): Consistent gen manifest cache key (#28074 and #29037) (#29049) (@agaudreault)

Full Changelog: https://github.com/argoproj/argo-cd/compare/v3.5.0...v3.5.1

<a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/argo-site/master/content/pages/cd/gitops-cd.png" width="25%" ></a>

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.7/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.7/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• cbd7687: fix(appset): progressive sync fixes (3.4 backports of #29042 and #27577) (#29141) (@himeshp)
• 0781a1a: fix(controller): reuse server-side diff result when masking Secret data (#27858) (#29075) (@1ovsss)
• a09c39c: fix(server): prevent SSD CLI secret mask spoofing (cherry-pick #29089 for 3.4) (#29131) (@argo-cd-cherry-pick-bot[bot])
• 8afda0d: fix(ssd): hide secret in last-applied-configuration annotation (#28989) (#29053) (@pjiang-dev)

Dependency updates

• e0aea00: chore(deps): bump fast-xml-parser from 4.5.3 to 4.5.6 in /ui - 3.4 (#27342) (@keithchong)

Other work

• 7b6113c: chore: bump version to 3.4.7 on release-3.4 branch (#29161) (@github-actions[bot])

Full Changelog: https://github.com/argoproj/argo-cd/compare/v3.4.6...v3.4.7

<a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/argo-site/master/content/pages/cd/gitops-cd.png" width="25%" ></a>

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.14/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.14/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• 7242ed2: fix(controller): reuse server-side diff result when masking Secret data (#27858) (#29076) (@1ovsss)
• d93267f: fix(server): prevent SSD CLI secret mask spoofing (#29089) (#29137) (@pjiang-dev)
• 4e181b9: fix(ssd): hide secret in last-applied-configuration annotation (#28989) (#29054) (@pjiang-dev)
• 80f08f9: fix: register pprof endpoints in repo-server using the params config map (cherry-pick #26237 for 3.3) (#29032) (@gdsoumya)

Dependency updates

• cf38a82: chore(deps): bump DOMPurify to 3.4.7 for CVE-2026-49978 (#28969) (@aali309)
• d3f7e8c: chore(deps): bump brace-expansion to 2.1.4, 1.1.18 in /ui for fixing CVE-2026-69152 (release-3.3) (#29149) (@dkarpele)

Other work

• a0a99e1: chore: bump version to 3.3.14 on release-3.3 branch (#29159) (@github-actions[bot])

Full Changelog: https://github.com/argoproj/argo-cd/compare/v3.3.13...v3.3.14

<a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/argo-site/master/content/pages/cd/gitops-cd.png" width="25%" ></a>

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.0/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.0/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Features

• be19446: feat(Jitter): Add Configurable Jitter for Webhook-Triggered application Refreshes (#25433) (@adityaraj178)
• 5b30739: feat(appset): add concurrency when managing applications (#26642) (@rumstead)
• 29fd8db: feat(appset): filtering repos by archived status #20736 (#21505) (@prune998)
• 57942ce: feat(cli): Add support for Source Integrity configuration (#26997) (@olivergondza)
• 3cc6ba7: feat(cli): add --app-namespace flag to missing argocd app subcommands (#27942) (@Mangaal)
• 0e729cc: feat(cli): add appset-namespace for appset command (#27022) (@Mangaal)
• 744983b: feat(health): Add healthcheck for gardener "Shoot" resources (#25750) (@Sven1410)
• 6cc786d: feat(health): add GatewayClass health check (#26591) (@dnfwlq8054)
• eabd4d6: feat(health): add pause and unpause actions to psmdb resource (#27616) (@KyriosGN0)
• daadf86: feat(health): additional promoter.argoproj.io health checks (#27170) (@crenshaw-dev)
• 4b69a7f: feat(health): finalizer messages for Promoter checks (#27478) (@crenshaw-dev)
• 289a4c0: feat(health): support BackendTLSPolicy.gateway.networking.k8s.io (#27385) (@snorwin)
• 4cdc650: feat(helm): support wildcard glob patterns for valueFiles (#26768) (@nitishfy)
• f7a7deb: feat(hydrator): dynamically manage README template from argocd-cm ConfigMap [updated] (#19067) (#24309) (@gyu-young-park)
• 86936e2: feat(hydrator): make manifest hydration queue concurrency configurable (#27926) (#27948) (@GuruduGanesh)
• 2308e17: feat(hydrator): opt-in source integrity verification for dry sources (Alpha) (#19302) (#28084) (@mladjan-gadzic)
• bf1591d: feat(hydrator): support syncSource repoURL for separate destination repo (#27011) (@boostrack)
• 41b6fee: feat(impersonation): allow to disable strict enforcement (#27084) (cherry-pick #27573 for 3.5) (#28595) (@argo-cd-cherry-pick-bot[bot])
• 0c0140c: feat(metrics): add parallelism limit repo server (#27911) (@pjiang-dev)
• 7d2eb77: feat(renovate): clean up config and remove github app (#27738) (@rumstead)
• 153ec67: feat(resource_customizations): add health checks for VictoriaMetrics (#27451) (@megative)
• 6b84ea9: feat(server): drop objects from non-allowed namespaces before they enter the cache. (#28018) (@christianh814)
• 224b75a: feat(server): use typed Argo CD EventList for event-listing APIs (#25767) (#26322) (@chansuke)
• 64a0417: feat(ui): Add AppSet to Application Resource Tree (#26601) (@pjiang-dev)
• b035a77: feat(ui): ApplicationSet Preview Apps tab in UI (#27799) (@pjiang-dev)
• 566c172: feat(ui): add GitOps Promoter resource icon (#26894) (@crenshaw-dev)
• 0dd8874: feat(ui): add nauth.io resource icon (#28226) (@choufraise)
• f16d08a: feat(ui): add repo url as filter in home page (#26670) (#27418) (@adityaraj178)
• 91e7664: feat(ui): per-application notice banner and info icon (#14405) (#27719) (@gdsoumya)
• 1b405ce: feat(ui): search filter by target revision (#24038) (@choejwoo)
• 706a037: feat(ui): support creating multi-source applications in New App panel [CONTINUED..] (#27095) (@aali309)
• 2fcf104: feat(ui): support spec.sourceHydrator.drySource.repoURL (@crenshaw-dev)
• 74d1fe0: feat(ui): use toggle-auto-sync resource action in app details page (#21564) (#27226) (@shiiyan)
• db7d672: feat(webhooks): add webhook support for GHCR (#26462) (@nitishfy)
• 6d92e17: feat: Add ProvideClusterInfo and Config fields to ExecProviderConfig (#24282) (#27976) (@mikeshng)
• 022f935: feat: Add basic support for git tag path prefixes (#27290) (@k4r1)
• aad3422: feat: Add suspend/resume actions for MariaDB (#27675) (#27674) (@mgross2)
• 586430c: feat: Migrate from Helm 3 to Helm 4 (#28076) (@reggie-k)
• c61c1dc: feat: Render Helm ValuesObject as YAML in log output instead of binary (#18342) (#27649) (@subhramit)
• 9a19735: feat: Support Azure Service Principal authentication for Azure DevOps repositories (#25324) (@allanyung)
• 97082e8: feat: add Gateway API support to network view (#26188) (@tete17)
• 603c900: feat: add action to delete recyclable Numaflow pipelines (#25900) (@dpadhiar)
• de94161: feat: add action to restart StrimziPodSet (#27266) (@KyriosGN0)
• a2b91ce: feat: add depth option to ui (#26618) (@blakepettersson)
• 1dc2ad0: feat: add health check for karpenter.sh/NodeClaim (#26876) (@Navneet072300)
• 611fcb0: feat: add sync overrun option to sync windows (#25361) (#25510) (@puskunalis)
• 48f18e2: feat: add toggle-auto-sync resource action for Application (#21564) (#26477) (@vikasrao23)
• 2df5f75: feat: adds mTLS support in repo-server (#26715) (@ppapapetrou76)
• 4d02fc2: feat: expose Appset UI and fix pie chart summary (#26666) (@pjiang-dev)
• a889f46: feat: make appset proxy-url param a native flag (#27788) (@ppapapetrou76)
• ad310c2: feat: replace error message in webhook handler with metrics (#27215) (@alexmt)
• 01187d1: feat: support Azure AD groups claims overflow via Microsoft Graph API (#27397) (@gravufo)
• f71239c: feat: support destinationServiceAccounts in global projects (#23059) (@enneitex)
• f460a3c: feat: surface root cause in sync failure message and cache discovery errors (#27750) (@ppapapetrou76)
• 3eebbcb: feat: use impersonation for server operations (logs, delete, etc) #22996 (#26898) (@alexymantha)

Bug fixes

• b982144: Revert "fix: prevent automatic refreshes from informer resync and status updates" (#27562) (@agaudreault)
• c5d1c91: fix(UI): show RollingSync step clearly when labels match no step (#26877) (@aali309)
• c52bf66: fix(appcontroller): application controller in core mode fails to sync when server.secretkey is missing (#26793) (@anandf)
• e81969f: fix(applicationset): include repo URL in git file generator errors (#28075) (@morning-verlu)
• e4fe7f6: fix(appset): don't release finalizer while children still terminate (cherry-pick #28999 for 3.5) (#29006) (@argo-cd-cherry-pick-bot[bot])
• 06fae9d: fix(appset): fall back to create when patch returns NotFound (#17312) (cherry-pick #28645 for 3.5) (#28716) (@argo-cd-cherry-pick-bot[bot])
• 45a84df: fix(ci): add .gitkeep to images dir (#26892) (@blakepettersson)
• 4c42071: fix(ci): openssf scorecard doesn't allow global vars (#27203) (@crenshaw-dev)
• 36f4ff7: fix(ci): pin goreman version used in ci-build.yaml (#27062) (#27061) (@dudinea)
• 25b3037: fix(ci): pnpm sbom generation (#27337) (#27339) (@crenshaw-dev)
• 99c51df: fix(ci): renovatebot action uses floating image tag (#27023) (#27024) (@dudinea)
• fb82b16: fix(ci): run yarn install with --frozen-lockfile (#27098) (#27099) (@dudinea)
• b403f5c: fix(cli): hide

…(truncated)

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.13/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.13/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• 1853165: fix(health): configconnectorcontext and configconnector (#26308) (#26309) (3.3) (#28611) (@crenshaw-dev)
• 2536ce3: fix(helm): pass registry passwords through stdin (#17821) (cherry-pic… (#28836) (@nitishfy)
• 853e2c0: fix(reposerver): honor depth of referenced source instead of primary source (cherry-pick #28339 for 3.3) (#28342) (@alexandresavicki)
• fac2752: fix(ssa): do not run auth reconcile with SSA (cherry pick of #28027 and #27601 to 3.3) (#28266) (@akhilnittala)
• d73c512: fix: Revert "fix: avoid calling UpdateRevisionForPaths unnecessary (#25151)" (cherry-pick #27241 for 3.3) (#28949) (@ranakan19)
• 91a603b: fix: deleted resource are incorrectly shown in UI (cherry-pick #28322 for 3.3) (#28336) (@argo-cd-cherry-pick-bot[bot])
• f6faa38: fix: don't clobber non-ignored fields on "replace" (cherry-pick #27136 for 3.3) (#28506) (@argo-cd-cherry-pick-bot[bot])
• ea08dfa: fix: fixes a regression of dex config env vars substituion - Cherry pick of #28369 in 3.3 (#28410) (@ppapapetrou76)
• 28d47f4: fix: mount argocd-cmd-params-cm in repo-server so pprof can be enabled (cherry-pick #28863 for 3.3) (#28865) (@argo-cd-cherry-pick-bot[bot])

Dependency updates

• 676d6f5: chore(deps): bump form-data to 4.0.6 in /ui for fixing CVE-2026-12143 (#28831) (@alkakumari016)
• 5aa0bef: chore(deps): bump golang.org/x/crypto to 0.53.0 (release-3.3) (#28338) (@nmirasch)

Other work

• 58a3ab2: chore: bump version to 3.3.13 on release-3.3 branch (#28960) (@github-actions[bot])

Full Changelog: https://github.com/argoproj/argo-cd/compare/v3.3.12...v3.3.13

<a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/argo-site/master/content/pages/cd/gitops-cd.png" width="25%" ></a>

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.6/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.6/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• aa9970b: fix(appset): fall back to create when patch returns NotFound (#17312) (cherry-pick #28645 for 3.4) (#28718) (@rickbrouwer)
• 9a91802: fix(diff): don't drop manager-owned descendant fields when filtering webhook mutations (cherry-pick #28819 for 3.4) (#28894) (@argo-cd-cherry-pick-bot[bot])
• 4907a99: fix(helm): pass registry passwords through stdin (#17821) (#28835) (@nitishfy)
• b6d7c82: fix: mount argocd-cmd-params-cm in repo-server so pprof can be enabled (cherry-pick #28863 for 3.4) (#28864) (@argo-cd-cherry-pick-bot[bot])
• cf7c4a7: fix: only do annotation backfill if live unset (cherry-pick #28770 for 3.4) (#28776) (@argo-cd-cherry-pick-bot[bot])
• a3d8e28: fix: progressive sync fixes (3.4 cherry-picks) (#29000) (@blakepettersson)
• 2aa646b: fix: use Entra ID uti claim as token id when jti is absent (#28625) (cherry-pick #28656 for 3.4) (#28676) (@argo-cd-cherry-pick-bot[bot])
• 275d11e: fix: use OIDC refresh tokens to renew expired sessions (#27041, #12189) (cherry-pick #27777 for 3.4) (#28688) (@argo-cd-cherry-pick-bot[bot])

Other work

• e1becb7: chore: bump version to 3.4.6 on release-3.4 branch (#28959) (@github-actions[bot])

Full Changelog: https://github.com/argoproj/argo-cd/compare/v3.4.5...v3.4.6

<a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/argo-site/master/content/pages/cd/gitops-cd.png" width="25%" ></a>

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.5/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.5/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• e77e4b6: fix(reposerver): honor depth of referenced source instead of primary source (cherry-pick #28339 for 3.4) (#28341) (@alexandresavicki)
• 63e67d5: fix(ssa): do not run auth reconcile with SSA (cherry pick of #27624 and #27601 to 3.4) (#28265) (@Mangaal)
• 2403907: fix: auto-sync skipped when newer commit arrives during sync with manifest-generate-paths (#27875) (cherry-pick #28227 for 3.4) (#28331) (@argo-cd-cherry-pick-bot[bot])
• 2d18587: fix: deleted resource are incorrectly shown in UI (cherry-pick #28322 for 3.4) (#28337) (@argo-cd-cherry-pick-bot[bot])
• a82e158: fix: don't clobber non-ignored fields on "replace" (cherry-pick #27136 for 3.4) (#28507) (@argo-cd-cherry-pick-bot[bot])
• d4c8f1c: fix: fixes a regression of dex config env vars substituion - Cherry pick of #28369 in 3.4 (#28411) (@ppapapetrou76)

Dependency updates

• 8c7ece5: chore(deps): bump golang.org/x/crypto to 0.53.0 (release-3.4) (#28375) (@nmirasch)
• a8f245b: chore(deps): update Ubuntu base image to 26.04 LTS (3.4) (#28430) (@suii2210)

Full Changelog: https://github.com/argoproj/argo-cd/compare/v3.4.4...v3.4.5

<a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/argo-site/master/content/pages/cd/gitops-cd.png" width="25%" ></a>

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.4/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.4/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• 146184e: fix(health): PromotionStrategy stuck Progressing after no-op re-hydration (#28124) (cherry-pick #28125 for 3.4) (#28135) (@argo-cd-cherry-pick-bot[bot])
• e515f51: fix(rbac): resolve RBAC regression for project-scoped resources in multi-namespace architecture (#25289) (#26573) (#28062) (@wanddynosios)
• 7f2fe95: fix(ssd): regression causing diff to error on new objects (#27679) (cherry-pick #27703 for 3.4) (#28241) (@argo-cd-cherry-pick-bot[bot])
• 5199ea6: fix: add a lock on clusterinformer (cherry-pick #28216 for 3.4) (#28312) (@blakepettersson)
• 7a64081: fix: exclude live status from normalization (cherry-pick #28201 for 3.4) (#28204) (@argo-cd-cherry-pick-bot[bot])
• 0b3436f: fix: fixes parsing of dex passwords with dollar sign (cherry pick of #28027 to 3.4) (#28197) (@ppapapetrou76)
• 9ccf66b: fix: resolve cross-generator Values templates in RenderGeneratorParams (#27827) (cherry-pick #27830 for 3.4) (#28128) (@argo-cd-cherry-pick-bot[bot])

Other work

• 14ad471: Merge pull request #28162 from argoproj/cherry-pick-28158-to-release-3.4 (@dudinea)
• 0fd000b: Merge pull request #28164 from argoproj/cherry-pick-28155-to-release-3.4 (@dudinea)
• ff25519: chore(ci): bump codecov action to 7.0.0 to fix the GPG issue (cherry-pick #28159 for 3.4) (#28172) (@dudinea)
• e9ff0c5: ci: bump goreleaser (cherry-pick #28033 for 3.4) (#28072) (@argo-cd-cherry-pick-bot[bot])
• 1c5e37d: ci: use github release notes in goreleaser (cherry-pick #28048 for 3.4) (#28071) (@argo-cd-cherry-pick-bot[bot])
• 0c14cfb: fix(manifest-generate-paths): Normalize repo before using type repo (#28113) (@fm1ck3y)
• c2003f4: test(e2e): Add test for second Sync after initial for different resources/options (#28156) (#28155) (@dudinea)
• 9810fa2: test(e2e): fix cleanup of CRDs for e2e tests (#28157) (#28158) (@dudinea)

Full Changelog: https://github.com/argoproj/argo-cd/compare/v3.4.3...v3.4.4

<a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/argo-site/master/content/pages/cd/gitops-cd.png" width="25%" ></a>

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.12/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.12/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• 47da184: fix(health): PromotionStrategy stuck Progressing after no-op re-hydration (#28124) (cherry-pick #28125 for 3.3) (#28136) (@argo-cd-cherry-pick-bot[bot])
• e385760: fix: add a lock on clusterinformer (cherry-pick #28216 for 3.3) (#28313) (@blakepettersson)
• 516314b: fix: exclude live status from normalization (cherry-pick #28201 for 3.3) (#28203) (@argo-cd-cherry-pick-bot[bot])
• 3205f8b: fix: fixes parsing of dex passwords with dollar sign (cherry pick of #28027 to 3.3 (#28198) (@ppapapetrou76)
• 703ad3f: fix: honor repo depth setting in gitSourceHasChanges and fetch functions (cherry-pick #27838 for 3.3) (#28065) (@alexandresavicki)

Other work

• c4c07e3: Merge pull request #28161 from argoproj/cherry-pick-28158-to-release-3.3 (@dudinea)
• cdfc9a5: Merge pull request #28166 from argoproj/cherry-pick-28155-to-release-3.3 (@dudinea)
• 6aecd33: chore(ci): bump codecov action to 7.0.0 to fix the GPG issue (cherry-pick #28159 for 3.3) (#28173) (@dudinea)
• b9f2a3b: test(e2e): Add test for second Sync after initial for different resources/options (#28156) (#28155) (@dudinea)
• fe3fea2: test(e2e): fix cleanup of CRDs for e2e tests (#28157) (#28158) (@dudinea)

Full Changelog: https://github.com/argoproj/argo-cd/compare/v3.3.11...v3.3.12

<a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/argo-site/master/content/pages/cd/gitops-cd.png" width="25%" ></a>

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.11/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.11/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• cd3b64d: fix(lint): unnecessary nesting (cherry-pick #27815 for 3.3) (#27818) (@argo-cd-cherry-pick-bot[bot])
• 82dd8ce: fix(ui): don't prefetch errors (#27877) (cherry-pick #27925 for 3.3) (#28023) (@argo-cd-cherry-pick-bot[bot])
• da10473: fix: nil-check (cherry-pick #28039 for 3.3) (#28041) (@argo-cd-cherry-pick-bot[bot])
• d556067: fix: prevent InvalidSpecError race in application controller startup (cherry-pick #27672 for 3.3) (#27844) (@argo-cd-cherry-pick-bot[bot])
• 21d5538: fix: remove resourceVersion from ssd (#27406) (cherry-pick release-3.3) (#28016) (@blakepettersson)
• 120eb31: fix: truncate labels for deletion hook resources (cherry-pick #27542 for 3.3) (#27715) (@choejwoo)

Dependency updates

• 1cb5892: chore(deps): bump redoc/dompurify to v3.4.0 in /ui for fixing CVE-2026-41240(cherry-pick 3.3) (#27912) (@alkakumari016)

Other work

• 9e25303: fix(gitops-engine): fix nil pointer dereference error in removeWebookMutation() (cherry-pick #27749 for 3.3) (#28032) (@argo-cd-cherry-pick-bot[bot])

Full Changelog: https://github.com/argoproj/argo-cd/compare/v3.3.10...v3.3.11

<a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/argo-site/master/content/pages/cd/gitops-cd.png" width="25%" ></a>

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.3/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.3/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• f435b0f fix(cli): return immediately from 'app wait' when app is already in desired state (#12211) (#27503) (#27713) (jheyduk)
• b39fe4f fix(lint): unnecessary nesting (cherry-pick #27815 for 3.4) (#27817) (argo-cd-cherry-pick-bot[bot], Michael Crenshaw)
• 668f2c5 fix(ui): don't prefetch errors (#27877) (cherry-pick #27925 for 3.4) (#28024) (argo-cd-cherry-pick-bot[bot], Blake Pettersson)
• b796979 fix(ui): return full source for non-hydrator apps in Parameters tab (cherry-pick #26946 for 3.4) (#27964) (Gabriel Barreto, himeshp)
• 5d3f8a0 fix: honor repo depth setting in gitSourceHasChanges and fetch functions (cherry-pick #27838 for 3.4) (#28043) (argo-cd-cherry-pick-bot[bot], alexandresavicki, Cursor)
• 35ed877 fix: nil-check (cherry-pick #28039 for 3.4) (#28040) (argo-cd-cherry-pick-bot[bot], Blake Pettersson, Soumya Ghosh Dastidar)
• b0f1553 fix: prevent InvalidSpecError race in application controller startup (cherry-pick #27672 for 3.4) (#27845) (argo-cd-cherry-pick-bot[bot], Michele Baldessari)
• 4fa0950 fix: truncate labels for deletion hook resources (cherry-pick #27542 for 3.4) (#27714) (argo-cd-cherry-pick-bot[bot], Jaewoo Choi)

Dependency updates

• 0edd404 chore(deps): bump redoc/dompurify to v3.4.0 in /ui for fixing CVE-2026-41240(cherry-pick 3.4) (#27913) (Alka Kumari)

Other work

• ce55c85 fix(gitops-engine): fix nil pointer dereference error in removeWebookMutation() (cherry-pick #27749 for 3.4) (#28031) (argo-cd-cherry-pick-bot[bot], Pierre Guinoiseau)

Full Changelog: https://github.com/argoproj/argo-cd/compare/v3.4.2...v3.4.3

<a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/argo-site/master/content/pages/cd/gitops-cd.png" width="25%" ></a>

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.12/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.12/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• 2d1a0bb: fix(lint): unnecessary nesting (cherry-pick #27815 for 3.2) (#27819) (@argo-cd-cherry-pick-bot[bot])
• 4caf270: fix: export url validation function (#27816) (@crenshaw-dev)
• d6e96fc: fix: wrap lines toggle causes log lines to overflow container - Fixes [Issue #27586] (cherry-pick #27627 for 3.2) (#27668) (@argo-cd-cherry-pick-bot[bot])

Dependency updates

• cff8c03: chore(deps): bump github.com/moby/spdystream from 0.5.0 to 0.5.1 (cherry-pick #27401 for 3.2) (#27735) (@argo-cd-cherry-pick-bot[bot])

Other work

• 3f7237b: Merge commit from fork (@pjiang-dev)
• c8df5ff: Merge commit from fork (@blakepettersson)

Full Changelog: https://github.com/argoproj/argo-cd/compare/v3.2.11...v3.2.12

<a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/argo-site/master/content/pages/cd/gitops-cd.png" width="25%" ></a>

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.2/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.2/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• b15e9e3 fix: Revert "fix: avoid calling UpdateRevisionForPaths unnecessary (#25151)" (cherry-pick #27241 for 3.4) (#27251) (argo-cd-cherry-pick-bot[bot], Alexander Matyushentsev)
• 570ccbc fix: prevent panic on nil APIResource in permission validator (cherry-pick #26610 for 3.4) (#27752) (argo-cd-cherry-pick-bot[bot], Andy Lo-A-Foe)

Dependency updates

• 6eb6215 chore(deps): bump github.com/moby/spdystream from 0.5.0 to 0.5.1 (cherry-pick #27401 for 3.4) (#27734) (argo-cd-cherry-pick-bot[bot], dependabot[bot])

Other work

• 35ea43c Merge commit from fork (Blake Pettersson)
• bcb4298 Merge commit from fork (Peter Jiang)
• 4e71577 chore: bump otel/sdk to 1.43.0 (release-3.4) (#27806) (Nitish Kumar)
• 6e227ba ci: pin images of setup-qemu-action, setup-buildx-action and goreleaser CLI version (cherry-pick #27060 for 3.4) (#27731) (argo-cd-cherry-pick-bot[bot], Regina Voloshin)
• 87e9148 fix(gitops-engine): apply HideSecretData to server-side diff results for Secrets (cherry-pick #27598 for 3.4) (#27754) (argo-cd-cherry-pick-bot[bot], Peter Jiang, downfa11)

Full Changelog: https://github.com/argoproj/argo-cd/compare/v3.4.1...v3.4.2

<a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/argo-site/master/content/pages/cd/gitops-cd.png" width="25%" ></a>