Argo CD · major version change
v2.14.21 →v3.5.7
- v3.0.0: a blocking change
- v3.0.2: not analysed
- v3.0.4: a blocking change
- v3.0.6: a blocking change
- v3.0.12: a blocking change
- v3.0.14: a blocking change
- v3.0.16: not analysed
- v3.0.18: a blocking change
- v3.0.20: a blocking change
- v3.0.22: not analysed
- v3.1.0: a change needing action
- v3.1.2: a blocking change
- v3.1.4: a blocking change
- v3.1.6: a blocking change
- v3.1.8: a blocking change
- v3.1.10: not analysed
- v3.1.12: a blocking change
- v3.1.14: a blocking change
- v3.1.16: a blocking change
- v3.2.1: a blocking change
- v3.2.3: a blocking change
- v3.2.5: a blocking change
- v3.2.7: a blocking change
- v3.2.9: a blocking change
- v3.2.11: a blocking change
- v3.3.0: a blocking change
- v3.3.2: a blocking change
- v3.3.4: a blocking change
- v3.3.6: a blocking change
- v3.3.8: a blocking change
- v3.3.10: a blocking change
- v3.3.12: a blocking change
- v3.3.14: a blocking change
- v3.3.16: a blocking change
- v3.3.18: a blocking change
- v3.4.1: a blocking change
- v3.4.3: a blocking change
- v3.4.5: a blocking change
- v3.4.7: a blocking change
- v3.4.9: a blocking change
- v3.4.11: a blocking change
- v3.4.13: not analysed
- v3.5.1: a blocking change
- v3.5.3: a blocking change
- v3.5.5: a blocking change
- v3.5.7: not analysed
- Releases to cross
- 91
- Spanning
- 18 mo
- Need action
- 127
What breaks
Every item below is quoted from the release notes it came from, and the quote was checked against the source before it was stored.
- blocker
Administrators must read the upgrading documentation before upgrading from a different minor version.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before proceeding.
- blocker
Legacy repository support has been removed, breaking deployments relying on it.
chore!: remove legacy repo support (#19768) (#21249)
Do: Migrate repositories to the new supported format before upgrading.
- high
RBAC logs are now enforced by default, which may block previously allowed log access.
feat!: Logs rbac enforce by default (#21678)
Do: Review RBAC policies to ensure log access is permitted under the new enforcement rules.
- high
Default values for compare options have been updated, potentially changing diff behavior.
feat!: update compareoptions default values (#22230)
Do: Review application comparison settings to account for changed defaults.
- high
Application health status is now stored in Redis by default, changing the storage backend.
feat(appcontroller): store application health status in redis by default (#10312) (#21532)
Do: Ensure Redis is configured and accessible for health status storage.
- high
Known interim resources are now excluded by default, which may affect resource visibility.
feat(config)!: exclude known interim resources by default (#20013) (#21635)
Do: Check if any managed resources were previously considered 'interim' and adjust configuration if needed.
- high
Fine-grained RBAC inheritance is disabled by default, potentially restricting role permissions.
feat(rbac)!: disable fine-grained inheritance by default (#19988) (#20671)
Do: Review RBAC role definitions and inheritance settings to ensure required permissions are maintained.
- high
Upgrades x/crypto to v0.35.0 to address CVE-2025-22869.
fix: upgrade x/crypto to v0.35.0 to solve CVE-2025-22869 (#22048) (@gergelyfabian)
- high
ApplicationSet nested selectors are now always applied, changing previous behavior.
chore(appset)!: always apply nested selectors (#14152) (#21492)
Do: Review ApplicationSet configurations to ensure nested selectors behave as expected.
- high
Default tracking method changed to annotation, potentially affecting sync status.
chore: set default tracking to annotation (#22289)
Do: Update applications to use annotation tracking or switch back to label tracking if required.
- high
Default behavior for ignoring status updates and high churn changes has changed.
chore(config)!: Ignore all `.status` updates & known high churn changes by default (#21760)
Do: Review config management settings if you rely on status updates for sync decisions.
- high
Deprecated metrics have been removed, breaking monitoring dashboards or alerts.
chore(metrics)!: remove deprecated metrics (#21697)
Do: Update monitoring dashboards and alerts to use the new metric names.
- low
A 60s default jitter has been added to sync operations.
chore!: add 60s default jitter (#22342)
Do: Adjust sync timing expectations if precise synchronization is critical.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation before proceeding with the upgrade.
- blocker
This release fixes a critical security issue (GHSA-2hj5-g64g-fp6p) that requires immediate attention.
This release fixes a critical security issue: GHSA-2hj5-g64g-fp6p
- blocker
Administrators upgrading from a different minor version must read the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation before proceeding with the upgrade.
- blocker
Administrators upgrading from a different minor version must consult the official upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
This release is end-of-life and requires upgrading to a supported version (v3.1 or higher) to receive bug fixes or security updates.
This is the final release of the `v3.0` release series. As of 02 Feb 2026, this version has reached end of life and will no longer receive bug fixes or security updates.
- blocker
Administrators are required to upgrade to a supported version (v3.1 or higher) as this version is end-of-life.
Action Required: Please upgrade to a supported version (v3.1 or higher).
- blocker
Upgrading from a different minor version requires reading the external upgrading documentation.
If upgrading from a different minor version, be sure to read the upgrading documentation.
- high
The default tracking method is no longer returned in settings requests, potentially breaking clients relying on this default value.
fix: settings request doesn't return default tracking method (#22965)
Do: Update clients to handle missing tracking method or explicitly set it.
- high
The field syncPolicy.automated.enable has been renamed to enabled, breaking existing Application resources using the old field name.
fix: update field name from syncPolicy.automated.enable to enabled (#22440)
Do: Update Application resources to use syncPolicy.automated.enabled instead of syncPolicy.automated.enable.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation before proceeding with the upgrade.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation before proceeding with the upgrade.
- blocker
Users upgrading from a different minor version must read the upgrading documentation.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation before proceeding with the upgrade.
- high
Mitigation for grpc-go CVE-2026-33186 is included in this release.
fix: mitigation of grpc-go CVE-2026-33186 for release-3.1 (#26982)
Do: Upgrade to this version to apply the security mitigation.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation.
If upgrading from a different minor version, be sure to read the upgrading documentation.
- high
Application controller may fail to refresh applications, causing sync status to be incorrect.
The application controller may fail to refresh applications, causing an application to not sync / show resources as out of sync.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
This release is the final version of the 3.1 series and has reached end of life, requiring an upgrade to a supported version to receive future updates.
This is the final release of the `3.1` release series. As of May 06th 2026, this version has reached end of life and will no longer receive bug fixes or security updates.
- blocker
Upgrading from a different minor version requires reading the external upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
- blocker
Administrators upgrading from a different minor version must read the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Administrators upgrading from a different minor version must consult the official upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- high
Mitigation for grpc-go CVE-2026-33186 is included in this release.
fix: mitigation of grpc-go CVE-2026-33186 for release-3.2 (#26983) (@dudinea)
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- high
Application controller may fail to refresh applications, causing sync failures or incorrect out-of-sync status.
The application controller may fail to refresh applications, causing an application to not sync / show resources as out of sync.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Critical vulnerability fix requires immediate upgrade to maintain security posture.
This release contains a security fix to a critical vulnerability: https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3
Do: Upgrade to v3.2.11 immediately to address the critical vulnerability.
- blocker
Upgrading from a different minor version requires reading the official upgrading documentation.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation before proceeding with the upgrade.
- blocker
This release is end-of-life and no longer receives bug fixes or security updates; users must upgrade to a supported version.
This is the final release of the 3.2 release series. As of August, 4th, this version has reached end of life and will no longer receive bug fixes or security updates.
- blocker
Users are instructed to upgrade to a supported version (v3.3, v3.4, or v3.5) because this version is end-of-life.
Action Required: Please upgrade to a supported version (v3.3, v3.4, or v3.5).
- blocker
Argo CD Applications managing the Argo CD installation must enable ServerSideApply=true sync option to succeed.
Users who have an Argo CD Application that manages their Argo CD installation, must enable `ServerSideApply=true` sync option on this Application in order for the upgrade to succeed.
- blocker
Argo CD Applications managing the Argo CD installation itself must enable ServerSideApply sync option.
Users who have an Argo CD Application that manages their Argo CD installation, must enable `ServerSideApply=true` sync option on this Application in order for the upgrade to succeed.
Do: Enable `ServerSideApply=true` sync option on the Application managing the Argo CD installation.
- high
If client-side apply migration fails, set ClientSideApplyMigration=false as a temporary workaround.
A temporary remediation is to additionally set the `ClientSideApplyMigration=false` sync option on this Application.
Do: Set `ClientSideApplyMigration=false` sync option if migration fails, and remove it later when the issue is fixed.
- blocker
Users managing Argo CD with an Application must enable ServerSideApply=true sync option.
Users who have an Argo CD Application that manages their Argo CD installation, must enable `ServerSideApply=true` sync option on this Application in order for the upgrade to succeed.
- high
Users who applied ClientSideApplyMigration=false as a temporary fix must remove this setting.
For users who have previously upgraded to Argo CD `3.3.0`or `3.3.1` and applied the temporary remediation of `ClientSideApplyMigration=false` sync option on the Application that manages their Argo CD, are required to remove this setting to restore the default behavior of performing the migration.
- blocker
Application Sets using Cluster Generators must update the cluster info annotation format from Major.Minor to vMajor.Minor.Patch.
Application Sets with Cluster Generators, that fetch clusters based on their Kubernetes version and use `argocd.argoproj.io/auto-label-cluster-info` on the cluster secret, need to be updated to use `argocd.argoproj.io/kubernetes-version` with the `vMajor.Minor.Patch` format instead of the previous…
Do: Update the `argocd.argoproj.io/auto-label-cluster-info` annotation to use `argocd.argoproj.io/kubernetes-version` with the `vMajor.Minor.Patch` format.
- blocker
Administrators must consult the external upgrade documentation before upgrading.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at the provided URL.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- high
Application controller may fail to refresh applications, causing sync failures or incorrect out-of-sync status.
A potential bug with application reconciliation has been identified in this release. The application controller may fail to refresh applications, causing an application to not sync / show resources as out of sync.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Critical vulnerability fix requires immediate upgrade to maintain security posture.
This release contains a security fix to a critical vulnerability: https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3
- blocker
Upgrading from a different minor version requires reading the official upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation before proceeding with the upgrade.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the official upgrading documentation.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation before proceeding with the upgrade.
- high
Kustomize builds rendering Helm charts no longer honor helmGlobals.configHome, breaking builds relying on Helm plugins from that directory.
Kustomize builds that render Helm charts no longer honor `helmGlobals.configHome`. Ordinary `http`, `https`, and `oci` chart repositories still work. Builds that depended on a Helm plugin registered from that directory will not
Do: Remove dependencies on Helm plugins registered via helmGlobals.configHome in Kustomize builds.
- high
OCI manifests larger than 4 MiB are now rejected, potentially breaking deployments using large OCI images.
An OCI manifest larger than 4 MiB is now rejected
Do: Ensure OCI manifests are smaller than 4 MiB.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation
If upgrading from a different minor version, be sure to read the upgrading documentation.
- high
Fixes emudhra CA certs compromise in release 3.3
fix(security): emudhra CA certs compromise for release 3.3 (#30349)
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading requires reading the specific migration guide for cluster version format changes.
More details here: https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/3.3-3.4/#cluster-version-format-change
Do: Read the linked upgrade documentation before upgrading.
- high
Application Sets using Cluster Generators must update the cluster info label format from Major.Minor to vMajor.Minor.Patch.
need to be updated to use `argocd.argoproj.io/kubernetes-version` with the `vMajor.Minor.Patch` format instead of the previous `Major.Minor` format.
Do: Update the `argocd.argoproj.io/kubernetes-version` label on cluster secrets to use the `vMajor.Minor.Patch` format.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Administrators upgrading from a different minor version must read the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Administrators upgrading from a different minor version must consult the official upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Critical vulnerability allows command execution via Kustomize remote ref.
CRITICAL: A Kustomize remote ref can run commands in the repo-server
- blocker
Critical vulnerability allows command execution via Kustomize Helm config home.
CRITICAL: A Kustomize Helm config home can run commands in the repo-server
- blocker
Critical vulnerability allows file reading via Jsonnet import.
CRITICAL: A Jsonnet import can read files from the repo-server
- blocker
Critical vulnerability bypasses AppProject restrictions via resource hooks.
CRITICAL: AppProject restrictions bypassed by PreDelete/PostDelete resource hooks
- blocker
Users upgrading from a different minor version must read the upgrading documentation.
If upgrading from a different minor version, be sure to read the upgrading documentation.
- high
High severity login failure rate limit can be bypassed.
HIGH: Login failure rate limit can be bypassed via concurrent requests
- high
High severity command injection via repository proxy URL on SSH Git repositories.
HIGH: Command injection via a repository proxy URL on SSH Git repositories
- high
Kustomize builds rendering Helm charts no longer honor helmGlobals.configHome.
Kustomize builds that render Helm charts no longer honor `helmGlobals.configHome`.
- high
OCI manifests larger than 4 MiB are now rejected.
An OCI manifest larger than 4 MiB is now rejected
- low
Moderate severity extension proxy RBAC ignores application namespace.
MODERATE: Extension proxy RBAC ignores application namespace when applications-in-any-namespace is enabled
- low
Moderate severity oversized OCI manifest can exhaust repo-server memory.
MODERATE: An oversized OCI manifest can exhaust repo-server memory
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the official upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Administrators upgrading from a different minor version must read the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Administrators upgrading from a different minor version must read the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Critical vulnerability allowing Kustomize remote refs to run commands on the repo-server.
CRITICAL: A Kustomize remote ref can run commands in the repo-server (GHSA-9v9p-x54c-58gc)
- blocker
Critical vulnerability allowing Kustomize Helm config home to run commands on the repo-server.
CRITICAL: A Kustomize Helm config home can run commands in the repo-server (GHSA-fw5c-w8rc-j7fx)
- blocker
Critical vulnerability allowing Jsonnet imports to read files from the repo-server.
CRITICAL: A Jsonnet import can read files from the repo-server (GHSA-m3vr-7329-44ww)
- blocker
Critical vulnerability bypassing AppProject restrictions via PreDelete/PostDelete resource hooks.
CRITICAL: AppProject restrictions bypassed by PreDelete/PostDelete resource hooks (GHSA-fmxq-cgp8-87wp, CVE-2026-77459)
- high
High severity login failure rate limit can be bypassed via concurrent requests.
HIGH: Login failure rate limit can be bypassed via concurrent requests (GHSA-4439-h7jw-5cjj, CVE-2025-61560)
- high
High severity command injection via repository proxy URL on SSH Git repositories.
HIGH: Command injection via a repository proxy URL on SSH Git repositories (GHSA-j6cw-g6p4-7hch, CVE-2026-55797)
- high
Kustomize builds rendering Helm charts no longer honor helmGlobals.configHome, breaking builds dependent on Helm plugins from that directory.
Kustomize builds that render Helm charts no longer honor `helmGlobals.configHome`. Ordinary `http`, `https`, and `oci` chart repositories still work. Builds that depended on a Helm plugin registered from that directory will not ([GHSA-fw5c-w8rc-j7fx](https://github.com/argoproj/argo-cd/security/adv…
- low
Moderate extension proxy RBAC ignores application namespace when applications-in-any-namespace is enabled.
MODERATE: Extension proxy RBAC ignores application namespace when applications-in-any-namespace is enabled (GHSA-g3ff-q88g-chrj)
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
Releases in this span
| Version | Released | Changes | Source |
|---|---|---|---|
| v3.0.0 | 2025-05-06 | 13 | changelog |
| v3.0.1 | 2025-05-14 | not analysed | changelog |
| v3.0.2 | 2025-05-19 | not analysed | changelog |
| v3.0.3 | 2025-05-21 | 1 | changelog |
| v3.0.4 | 2025-05-28 | 2 | changelog |
| v3.0.5 | 2025-05-29 | not analysed | changelog |
| v3.0.6 | 2025-06-09 | 1 | changelog |
| v3.0.11 | 2025-07-10 | 1 | changelog |
| v3.0.12 | 2025-07-25 | 1 | changelog |
| v3.0.13 | 2025-08-25 | 1 | changelog |
| v3.0.14 | 2025-09-04 | 1 | changelog |
| v3.0.15 | 2025-09-04 | 1 | changelog |
| v3.0.16 | 2025-09-05 | not analysed | changelog |
| v3.0.17 | 2025-09-18 | 1 | changelog |
| v3.0.18 | 2025-09-22 | 1 | changelog |
| v3.0.19 | 2025-09-30 | 1 | changelog |
| v3.0.20 | 2025-10-17 | 1 | changelog |
| v3.0.21 | 2026-01-01 | 1 | changelog |
| v3.0.22 | 2026-01-13 | not analysed | changelog |
| v3.0.23 | 2026-01-22 | 3 | changelog |
| v3.1.0 | 2025-08-13 | 2 | changelog |
| v3.1.1 | 2025-08-25 | 1 | changelog |
| v3.1.2 | 2025-09-04 | 1 | changelog |
| v3.1.3 | 2025-09-04 | 1 | changelog |
| v3.1.4 | 2025-09-05 | 1 | changelog |
| v3.1.5 | 2025-09-10 | 1 | changelog |
| v3.1.6 | 2025-09-18 | 1 | changelog |
| v3.1.7 | 2025-09-22 | 1 | changelog |
| v3.1.8 | 2025-09-30 | 1 | changelog |
| v3.1.9 | 2025-10-17 | not analysed | changelog |
| v3.1.10 | 2025-12-24 | not analysed | changelog |
| v3.1.11 | 2026-01-13 | 1 | changelog |
| v3.1.12 | 2026-01-22 | 1 | changelog |
| v3.1.13 | 2026-03-25 | 2 | changelog |
| v3.1.14 | 2026-04-16 | 2 | changelog |
| v3.1.15 | 2026-04-21 | 1 | changelog |
| v3.1.16 | 2026-05-05 | 2 | changelog |
| v3.2.0 | 2025-11-04 | 1 | changelog |
| v3.2.1 | 2025-11-30 | 1 | changelog |
| v3.2.2 | 2025-12-18 | 1 | changelog |
| v3.2.3 | 2025-12-24 | 1 | changelog |
| v3.2.4 | 2026-01-13 | not analysed | changelog |
| v3.2.5 | 2026-01-14 | 1 | changelog |
| v3.2.6 | 2026-01-22 | 1 | changelog |
| v3.2.7 | 2026-02-18 | 1 | changelog |
| v3.2.8 | 2026-03-26 | 2 | changelog |
| v3.2.9 | 2026-04-16 | 2 | changelog |
| v3.2.10 | 2026-04-21 | 1 | changelog |
| v3.2.11 | 2026-04-30 | 2 | changelog |
| v3.2.12 | 2026-05-13 | 2 | changelog |
| v3.3.0 | 2026-02-02 | 1 | changelog |
| v3.3.1 | 2026-02-18 | 2 | changelog |
| v3.3.2 | 2026-02-22 | 2 | changelog |
| v3.3.3 | 2026-03-09 | 2 | changelog |
| v3.3.4 | 2026-03-16 | 1 | changelog |
| v3.3.5 | 2026-03-25 | 1 | changelog |
| v3.3.6 | 2026-03-27 | 1 | changelog |
| v3.3.7 | 2026-04-16 | 2 | changelog |
| v3.3.8 | 2026-04-21 | 1 | changelog |
| v3.3.9 | 2026-04-30 | 2 | changelog |
| v3.3.10 | 2026-05-12 | 1 | changelog |
| v3.3.11 | 2026-05-28 | 1 | changelog |
| v3.3.12 | 2026-06-18 | 1 | changelog |
| v3.3.13 | 2026-07-31 | 1 | changelog |
| v3.3.14 | 2026-08-12 | 1 | changelog |
| v3.3.15 | 2026-10-06 | 3 | changelog |
| v3.3.16 | 2026-10-12 | 1 | changelog |
| v3.3.17 | 2026-10-21 | 1 | changelog |
| v3.3.18 | 2026-10-22 | 2 | changelog |
| v3.3.19 | 2026-11-02 | 1 | changelog |
| v3.4.1 | 2026-05-06 | 2 | changelog |
| v3.4.2 | 2026-05-12 | 1 | changelog |
| v3.4.3 | 2026-05-28 | 1 | changelog |
| v3.4.4 | 2026-06-18 | 1 | changelog |
| v3.4.5 | 2026-07-09 | 1 | changelog |
| v3.4.6 | 2026-07-31 | 1 | changelog |
| v3.4.7 | 2026-08-12 | 1 | changelog |
| v3.4.8 | 2026-08-27 | 1 | changelog |
| v3.4.9 | 2026-09-14 | 1 | changelog |
| v3.4.10 | 2026-10-06 | 11 | changelog |
| v3.4.11 | 2026-10-12 | 1 | changelog |
| v3.4.12 | 2026-10-20 | 1 | changelog |
| v3.4.13 | 2026-11-02 | not analysed | changelog |
| v3.5.0 | 2026-08-04 | 1 | changelog |
| v3.5.1 | 2026-08-12 | 1 | changelog |
| v3.5.2 | 2026-08-27 | 1 | changelog |
| v3.5.3 | 2026-09-14 | 1 | changelog |
| v3.5.4 | 2026-10-06 | 9 | changelog |
| v3.5.5 | 2026-10-12 | 1 | changelog |
| v3.5.6 | 2026-10-20 | 1 | changelog |
| v3.5.7 | 2026-11-02 | not analysed | changelog |