Argo CD

• *A32fb960058cb1676615987058ff20aec5f99f81: fix(hydrator): retry notes push on cannot lock ref errors (cherry-pick #28469 for 3.5) (#29905) (@argo-cd-cherry-pick-bot[bot])fixed
• *F0f6bdea7090f2ab188ab3f379aa56ed2670be58: fix(reposerver): stale manifests and goroutine leak after CMP failure (#29870) (cherry-pick #29874 for 3.5) (#30140) (@argo-cd-cherry-pick-bot[bot])fixed
• *3d31f1a9bbef941f0149d3270d5fb3dcd93790fe: fix(server): fill event count and timestamps for events.k8s.io events (#30015) (cherry-pick #30017 for 3.5) (#30111) (@rickbrouwer)fixed
• *33a47a550daf4ae407baf04f678a4b5918cb8069: fix(ui): show enableOCI only for Helm (cherry-pick #29974 for 3.5) (#30074) (@argo-cd-cherry-pick-bot[bot])fixed
• *A48be5aa0a2d89988be52bb817e7498f7c248947: fix: cache the OCI tag list (#30117) (cherry-pick #30118 for 3.5) (#30119) (@argo-cd-cherry-pick-bot[bot])fixed
• *Ebf5ac7ff31f1dd6511cc0246e13da4de8125743: fix: correct scheduled-time format in CronWorkflow create-workflow action (#29915) (cherry-pick #29916 for 3.5) (#29953) (@argo-cd-cherry-pick-bot[bot])fixed
• *514141dab1058d72c4bfa4f0f08b63a0a6c1ad14: fix: fix escaped URL routing for write repo (creds) endpoints (cherry-pick #29940 for 3.5) (#29958) (@argo-cd-cherry-pick-bot[bot])fixed
• *4d2194b2b8114aa5eb39b41ae12e82676032aae4: fix: fix untar inbound check if dstPath is symlinked (cherry-pick #28881 release-3.5) (#30053) (@blakepettersson)fixed
• *4d68ee32ca16d0f8382bf88cd4adc3b6b3e09568: fix: fixes flaky tests by making Log capturer thread-safe (cherry-pick #28328 for 3.5) (#30078) (@argo-cd-cherry-pick-bot[bot])fixed
• *1d0585d9b5097822fd49d32ca05d818231d1b497: fix: synchronize OCI cache cleanup with extraction (#30020) (cherry-pick #30023 for 3.5) (#30103) (@argo-cd-cherry-pick-bot[bot])fixed

• *B0db949949fe492c6f6b7dac41e6b185a0ad44d6: fix(hydrator): retry notes push on cannot lock ref errors (cherry-pick #28469 for 3.4) (#29904) (@argo-cd-cherry-pick-bot[bot])fixed
• *114a64e838a0ab41180696b0f725dd26041e56ec: fix(reposerver): stale manifests and goroutine leak after CMP failure (#29870) (cherry-pick #29874 for 3.4) (#30141) (@argo-cd-cherry-pick-bot[bot])fixed
• *A58286e7d30955eedcbc1dc6e442606c2a0bfa31: fix(ui): show enableOCI only for Helm (cherry-pick #29974 for 3.4) (#30080) (@adityaraj178)fixed
• *85e5cc22cd562f9d0493472643db112e72390fa2: fix: cache the OCI tag list (#30117) (cherry-pick #30118 for 3.4) (#30121) (@argo-cd-cherry-pick-bot[bot])fixed
• *E9ec2290abc2e7ebc480be676fe33f0e9d582e95: fix: correct scheduled-time format in CronWorkflow create-workflow action (#29915) (cherry-pick #29916 for 3.4) (#29954) (@argo-cd-cherry-pick-bot[bot])fixed
• *C12374b97d037fbe0b211e7cc48021c529505b02: fix: fix untar inbound check if dstPath is symlinked (cherry-pick #28881 release-3.4) (#30054) (@blakepettersson)fixed
• *33db5f7ebcd94afa97debc38a802394449c1a293: fix: fixes flaky tests by making Log capturer thread-safe (cherry-pick #28328 for 3.4) (#30077) (@argo-cd-cherry-pick-bot[bot])fixed
• *0ef69f371cc52961d5e24dbdca6d426c47670e20: fix: synchronize OCI cache cleanup with extraction (#30020) (cherry-pick #30023 for 3.4) (#30104) (@argo-cd-cherry-pick-bot[bot])fixed

• *6d4837e72d639ad3309a98c26ad269cf0d3b8934: fix(hydrator): do not report a permanent note push failure as exhausted retries (cherry-pick #29903 for 3.3) (#29910) (@argo-cd-cherry-pick-bot[bot])fixed
• *0dbdfaaa2274be513058275ad67a8547490f0c96: fix: correct scheduled-time format in CronWorkflow create-workflow action (#29915) (cherry-pick #29916 for 3.3) (#29951) (@argo-cd-cherry-pick-bot[bot])fixed
• *F9d20a32f5fa1b31cbded3c0f8ee689371077249: fix: fix escaped URL routing for write repo (creds) endpoints (cherry-pick #29940 for 3.3) (#29956) (@argo-cd-cherry-pick-bot[bot])fixed
• *87c7d845f7d881d3c93b491806ed8fb43588269b: fix: fix untar inbound check if dstPath is symlinked (#28881 cherry-pick release 3.3) (#30055) (@blakepettersson)fixed

Kargo v1.11.8

Kargo v1.11.8 was released with 7 changes, including one security item bumping the step-security/harden-runner GitHub Action from 2.21.1 to 2.22.1. The other six changes are maintenance items such as dependency bumps, CI, tests and docs, which the source condenses and omits.

platform teams Platform teams running Kargo in their delivery pipelines get a patch release with a CI hardening action bump; the source does not describe any change to runtime behavior, configuration, or APIs. The security change is to a build-pipeline action, not a vulnerability fix in Kargo's own code.

written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

• !Bump step-security/harden-runner from 2.21.1 to 2.22.1security

Argo CD v3.5.4 ships 19 changes, 11 of them security fixes, including several critical issues in the repo-server: Kustomize remote refs and Helm config home can run commands, and Jsonnet imports can read files. It also fixes an AppProject restriction bypass via PreDelete/PostDelete hooks and a high-severity command injection through repository proxy URLs on SSH Git repositories. Two changes are marked breaking: Kustomize builds rendering Helm charts no longer honor helmGlobals.configHome, and OCI manifests larger than 4 MiB are now rejected.

platform teams Platform teams running Argo CD 3.5 should upgrade to pick up the repo-server and AppProject fixes. Teams using Kustomize with Helm plugins from a custom config home, or with OCI manifests above 4 MiB, need to check their builds before upgrading because those will fail.

written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

• !!Kustomize builds that render Helm charts no longer honor helmGlobals.configHome. Ordinary http, https, and oci chart repositories still work. Builds that depended on a Helm plugin registered from that directory will not (GHSA-fw5c-w8rc-j7fx).security / breaking
• !!An OCI manifest larger than 4 MiB is now rejected (GHSA-w996-f2wq-x9c6).security / breaking
• !CRITICAL: A Kustomize remote ref can run commands in the repo-server (GHSA-9v9p-x54c-58gc)security
• !CRITICAL: A Kustomize Helm config home can run commands in the repo-server (GHSA-fw5c-w8rc-j7fx)security
• !CRITICAL: A Jsonnet import can read files from the repo-server (GHSA-m3vr-7329-44ww)security
• !CRITICAL: AppProject restrictions bypassed by PreDelete/PostDelete resource hooks (GHSA-fmxq-cgp8-87wp, CVE-2026-77459)security
• !HIGH: Login failure rate limit can be bypassed via concurrent requests (GHSA-4439-h7jw-5cjj, CVE-2025-61560)security
• !HIGH: Command injection via a repository proxy URL on SSH Git repositories (GHSA-j6cw-g6p4-7hch, CVE-2026-55797)security
• !MODERATE: Extension proxy RBAC ignores application namespace when applications-in-any-namespace is enabled (GHSA-g3ff-q88g-chrj)security
• !MODERATE: An oversized OCI manifest can exhaust repo-server memory (GHSA-w996-f2wq-x9c6)security
• !7f0a05834b05103d69d7c150e1ee36541b314696: fix(security): coordinated security fixes (release-3.5) (#30038) (@crenshaw-dev)security
• +F37dc0c742724e1b5f2393839a24d9664f31ede7: feat(server): log username on login attempts (cherry-pick #29841 for 3.5) (#29861) (@argo-cd-cherry-pick-bot[bot])added

Argo CD v3.4.10 ships fixes for 11 security issues, including several rated critical: command execution via Kustomize remote refs and Helm config home in the repo-server, a Jsonnet import that reads repo-server files, and an AppProject restriction bypass through PreDelete/PostDelete hooks. It also includes two breaking changes: Kustomize no longer honors helmGlobals.configHome for Helm plugins registered from that directory, and OCI manifests larger than 4 MiB are rejected. The release also adds username logging on login attempts and four bug fixes.

platform teams Platform teams running Argo CD 3.4 should upgrade to pick up the critical repo-server and AppProject fixes. Teams using Kustomize with Helm plugins from configHome or OCI manifests above 4 MiB need to check their builds before upgrading because those will now fail.

written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

• !!Kustomize builds that render Helm charts no longer honor helmGlobals.configHome. Ordinary http, https, and oci chart repositories still work. Builds that depended on a Helm plugin registered from that directory will not (GHSA-fw5c-w8rc-j7fx).security / breaking
• !!An OCI manifest larger than 4 MiB is now rejected (GHSA-w996-f2wq-x9c6).security / breaking
• !CRITICAL: A Kustomize remote ref can run commands in the repo-server (GHSA-9v9p-x54c-58gc)security
• !CRITICAL: A Kustomize Helm config home can run commands in the repo-server (GHSA-fw5c-w8rc-j7fx)security
• !CRITICAL: A Jsonnet import can read files from the repo-server (GHSA-m3vr-7329-44ww)security
• !CRITICAL: AppProject restrictions bypassed by PreDelete/PostDelete resource hooks (GHSA-fmxq-cgp8-87wp, CVE-2026-77459)security
• !HIGH: Login failure rate limit can be bypassed via concurrent requests (GHSA-4439-h7jw-5cjj, CVE-2025-61560)security
• !HIGH: Command injection via a repository proxy URL on SSH Git repositories (GHSA-j6cw-g6p4-7hch, CVE-2026-55797)security
• !MODERATE: Extension proxy RBAC ignores application namespace when applications-in-any-namespace is enabled (GHSA-g3ff-q88g-chrj)security
• !MODERATE: An oversized OCI manifest can exhaust repo-server memory (GHSA-w996-f2wq-x9c6)security
• !4bc8085b0a6d2296b849539d3d09fc7be7a4a511: fix(security): coordinated security fixes (release-3.4) (#30039) (@crenshaw-dev)security
• +4469a335a79f7b9ab8e263179f507cd21fc19834: feat(server): log username on login attempts (cherry-pick #29841 for 3.4) (#29860) (@argo-cd-cherry-pick-bot[bot])added

Argo CD v3.3.15 ships fixes for 12 security issues and 11 other fixes, with 2 changes marked breaking. Breaking changes: Kustomize builds that render Helm charts no longer honor helmGlobals.configHome, so builds relying on a Helm plugin registered from that directory will fail, and OCI manifests larger than 4 MiB are now rejected. Critical advisories cover command execution via Kustomize remote refs and Helm config home, Jsonnet file reads from the repo-server, and AppProject restriction bypass via PreDelete/PostDelete hooks.

platform teams Platform teams running Argo CD 3.3 should plan to upgrade, and check any Kustomize-with-Helm pipelines that use a plugin from configHome or OCI manifests over 4 MiB before rolling out. Repo-server exposure from the listed critical issues makes the update a priority.

written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

• !!Kustomize builds that render Helm charts no longer honor helmGlobals.configHome. Ordinary http, https, and oci chart repositories still work. Builds that depended on a Helm plugin registered from that directory will not (GHSA-fw5c-w8rc-j7fx).security / breaking
• !!An OCI manifest larger than 4 MiB is now rejected (GHSA-w996-f2wq-x9c6).security / breaking
• !CRITICAL: A Kustomize remote ref can run commands in the repo-server (GHSA-9v9p-x54c-58gc)security
• !CRITICAL: A Kustomize Helm config home can run commands in the repo-server (GHSA-fw5c-w8rc-j7fx)security
• !CRITICAL: A Jsonnet import can read files from the repo-server (GHSA-m3vr-7329-44ww)security
• !CRITICAL: AppProject restrictions bypassed by PreDelete/PostDelete resource hooks (GHSA-fmxq-cgp8-87wp, CVE-2026-77459)security
• !HIGH: Login failure rate limit can be bypassed via concurrent requests (GHSA-4439-h7jw-5cjj, CVE-2025-61560)security
• !HIGH: Command injection via a repository proxy URL on SSH Git repositories (GHSA-j6cw-g6p4-7hch, CVE-2026-55797)security
• !MODERATE: Extension proxy RBAC ignores application namespace when applications-in-any-namespace is enabled (GHSA-g3ff-q88g-chrj)security
• !MODERATE: An oversized OCI manifest can exhaust repo-server memory (GHSA-w996-f2wq-x9c6)security
• !1149cdc6e932208c4402183cc3d7b7485239940c: fix(security): coordinated security fixes (release-3.3) (#30040) (@crenshaw-dev)security
• !D697764be580f902fb73587bbceb63c4c268285e: chore(deps): bump js-yaml to 4.3.1 in /ui for CVE-2026-59869 (release-3.3) (#29386) (@aali309)security

• *C198be7e7a00f6e643180c0f9b762f768fefcbb1: fix(health): a KubeVirt VirtualMachine declared stopped is Healthy (cherry-pick #29664 for 3.5) (#29665) (@argo-cd-cherry-pick-bot[bot])fixed
• *4b3f69d204d25aeaf9056bc37c3e4d44f198570c: fix(health): report suspended FlinkDeployment as healthy (#26818) (cherry-pick #28995 for 3.5) (#29525) (@argo-cd-cherry-pick-bot[bot])fixed
• *Dd2cb1aaf12ef19a2bab816fbaecced6422cad7c: fix(repository): clean repository on revision change (cherry-pick #28771 for 3.5) (#29486) (@argo-cd-cherry-pick-bot[bot])fixed
• *70b399c5a8335cd3abb0bf132d63129733a5e3a0: fix(resource_customizations): Crossplane MRs should report Progressing (not Healthy) whilst provisioning [ISSUE: #29381] (cherry-pick #29382 for 3.5) (#29520) (@argo-cd-cherry-pick-bot[bot])fixed
• *Be8b3873521671e3f9418c6e3019f12a472ac3c1: fix(sync): correctly set operationState values on retry (#26530) (cherry-pick #28778 for 3.5) (#29431) (@omkar619-dev)fixed
• *A5e5992f62561d112a6d6a715e6631e3b6817671: fix(ui): guard SSO redirect to stop 401 retry loop (cherry-pick #28807 for 3.5) (#29631) (@argo-cd-cherry-pick-bot[bot])fixed
• *0b0890e0c79d2e2c7f8bf33736cde2772024e2b3: fix(ui): use hydrateTo branch name when set (cherry-pick #29562 for 3.5) (#29564) (@crenshaw-dev)fixed
• *18f0566fb550b1d10d9fb55a72fa887a530eca42: fix: GRPCRoute health check ignores stale observedGeneration conditions (#28086) (cherry-pick #28087 for 3.5) (#29517) (@argo-cd-cherry-pick-bot[bot])fixed
• *4d653a67174ecacd3a7d17ef5f1c923a48304bd6: fix: handle GrafanaFolder negative-polarity condition (#29395) (cherry-pick #29397 for 3.5) (#29524) (@argo-cd-cherry-pick-bot[bot])fixed
• *Ec585202b451045155203736eaa6bca145b19935: fix: recover AuthReconcile visitor panics (cherry-pick #29440 for 3.5) (#29531) (@Karthik-Chowdary)fixed

• *B938a5e7238c5993534156acdd39953d0aab2bc0: fix(health): a KubeVirt VirtualMachine declared stopped is Healthy (cherry-pick #29664 for 3.4) (#29666) (@argo-cd-cherry-pick-bot[bot])fixed
• *8d84b9380186ef6e1b694c718128ddb4b4cbb5ee: fix(health): report suspended FlinkDeployment as healthy (#26818) (cherry-pick #28995 for 3.4) (#29527) (@argo-cd-cherry-pick-bot[bot])fixed
• *Bfd48bd87729d1675509d89cf9eeb41d83d6a967: fix(repository): clean repository on revision change (cherry-pick #28771 for 3.4) (#29485) (@argo-cd-cherry-pick-bot[bot])fixed
• *4e0f6b78ce57547415eaac042a35a29f7fa0345c: fix(resource_customizations): Crossplane MRs should report Progressing (not Healthy) whilst provisioning [ISSUE: #29381] (cherry-pick #29382 for 3.4) (#29521) (@argo-cd-cherry-pick-bot[bot])fixed
• *182c837b67b7176e03342b19e0a7d23a4da347af: fix(sync): correctly set operationState values on retry (#26530) (cherry-pick #28778 for 3.4) (#29432) (@omkar619-dev)fixed
• *Ae7133151cd1ad803455a18a810c7a091de09b69: fix(ui): guard SSO redirect to stop 401 retry loop (cherry-pick #28807 for 3.4) (#29632) (@argo-cd-cherry-pick-bot[bot])fixed
• *38b5adf870e5aa0521a0a2e2638af11cf087a518: fix(ui): use hydrateTo branch name when set (cherry-pick #29562 for 3.4) (#29566) (@crenshaw-dev)fixed
• *Fb9431d44e8f61fe0b156a1abb9289b9d85dbe2c: fix: GRPCRoute health check ignores stale observedGeneration conditions (#28086) (cherry-pick #28087 for 3.4) (#29518) (@argo-cd-cherry-pick-bot[bot])fixed
• *51edefdfb252547d408b70da03fceb78a3e0e387: fix: handle GrafanaFolder negative-polarity condition (#29395) (cherry-pick #29397 for 3.4) (#29523) (@argo-cd-cherry-pick-bot[bot])fixed

• *F1f109cc20895275ebae2dc62e51cba6c788586b: fix(appset): restore ignoreApplicationDifferences after normalization (cherry-pick #29070 for 3.5) (#29195) (@argo-cd-cherry-pick-bot[bot])fixed
• *A45dd38594f6f30bcc6c743e6f11080187cc84a1: fix(repository): resolve untyped helm source type in UpdateRevisionForPaths (cherry-pick #28904 for 3.5) (#29399) (@argo-cd-cherry-pick-bot[bot])fixed
• *417c675b17207730f3b89ed579132267c9af4892: fix(revert): auto-sync skipped when newer commit arrives during sync (cherry-pick #28692 for 3.5) (#29224) (@rumstead)fixed
• *961ee40cc32717bad323629284085b9f2cd7173f: fix(ui): remove kind filter from appset page (#29310) (#29311) (cherry-pick 3.5) (#29314) (@crenshaw-dev)fixed
• *Cc1f3eef40dfee35842cc5a4c27a80b5f5dbe82e: fix(ui): show operation state on applications list page (cherry-pick release-3.5) (#29344) (@antonu17)fixed
• *5accee3440f1a140de32071a035b783d653ce452: fix: don't degrade Cluster API Cluster health while Ready is False during provisioning (cherry-pick #29237 for 3.5) (#29273) (@argo-cd-cherry-pick-bot[bot])fixed
• *4d99c524afda80d091dff81e8745eb3365285874: fix: recover from kubectl panic in AuthReconcile when SA is forbidden (cherry-pick #28669 for 3.5) (#29294) (@alexymantha)fixed
• *A9d94d68c8a5bee4e1708f6640e7922b91736fec: fix(notification-controller): deep-copy before mutating object from a shared cache (cherry-pick #29350 for 3.5) (#29354) (@argo-cd-cherry-pick-bot[bot])fixed
• *Cc1d7a2601ce87695808a2632687975a84900a54: fix(notification-controller): read appprojects from informer cache (#28815) (cherry-pick release-3.5) (#29345) (@antonu17)fixed

• !E4de80d7eee32f93416d9722719d4b8b1c1d47bf: chore(deps): bump DOMPurify to 3.4.7 for CVE-2026-49978 (#29222) (@aali309)security
• !24754268593ae81a052bec378b8e967af787987f: chore(deps): bump brace-expansion to 2.1.4, 1.1.18 in /ui for fixing CVE-2026-14257 and CVE-2026-69152 (release-3.4) (#29379) (@nmirasch)security
• !E5bee2c2bbbff7b0c65b213addaf84e30ad66f94: chore(deps): bump js-yaml to fix CVE-2026-59869 (#28946) (@aali309)security
• *90f81d5bc27491a97fb6d0ab0dc284a69ed14a08: fix(revert): auto-sync skipped when newer commit arrives during sync (cherry-pick #28692 for 3.4) (#29225) (@rumstead)fixed
• *924ab35b93689ddba28731bdaa45a189ac653ddc: fix: don't degrade Cluster API Cluster health while Ready is False during provisioning (cherry-pick #29237 for 3.4) (#29274) (@argo-cd-cherry-pick-bot[bot])fixed
• *Bad3c481d2ceeaff1ad0e48b6c7c9fe23f77f118: fix(notification-controller): read appprojects from informer cache (#28815) (cherry-pick release-3.4) (#29346) (@antonu17)fixed
• ·609fa82ba26de2369c7b5138279f06a2af1d13a5: chore: bump version to 3.4.8 on release-3.4 branch (#29405) (@github-actions[bot])other
• ·9c771f6f7cbd4448fef1a11fb03be7579c1e2fd3: fix(notification-controller): deep-copy before mutating object from a shared cache (cherry-pick #29350 for 3.4) (#29353) (@argo-cd-cherry-pick-bot[bot])other

• *33f3bc59faeec96204cda3a5ae211be17d15f1ac: fix(appset): stop progressive sync reconciling in a tight loop (#27577) (#29139) (@himeshp)fixed
• *D358e75b3539c3fc43eb2372317bde7a0d01c55f: fix(appset): verify terminating Applications against the API server (#29042) (#29138) (@himeshp)fixed
• *Ecf37373a9d3a72b259a73abfee7ce27226b960a: fix(controller): cherry-pick treat timeout.reconciliation=0 as disabled soft expiry (#27683) (#29007) (@aali309)fixed
• *978fa65006565baaaf35894918fd661d610f5953: fix(controller): reuse server-side diff result when masking Secret data (#27858) (#29074) (@1ovsss)fixed
• *F399c84f85fc4e3a19ac1e8314ff111493d26fee: fix(controller): use diff cache when timeout.reconciliation is disabled (cherry-pick #29073 for 3.5) (#29158) (@argo-cd-cherry-pick-bot[bot])fixed
• *960bed7f2efcdc8b43fe392dd6d17cf95507c9f2: fix(server): prevent SSD CLI secret mask spoofing (cherry-pick #29089 for 3.5) (#29130) (@argo-cd-cherry-pick-bot[bot])fixed
• *9f360f4953a1dc0f3474aa9c482d72366863ea33: fix(ssd): hide secret in last-applied-configuration annotation (#28989) (#29052) (@pjiang-dev)fixed
• *B44fbbc2e040e303c18a69182fd5dbe2c36cfdf9: fix(manifest-generate-paths): Consistent gen manifest cache key (#28074 and #29037) (#29049) (@agaudreault)fixed
• ·109ca7ca71139e514114499d294a492e7910a965: chore: bump version to 3.5.1 on release-3.5 branch (#29165) (@github-actions[bot])other