Argo CD
v3.3.6 →v3.5.7
- v3.3.7: a blocking change
- v3.3.8: a blocking change
- v3.3.9: a blocking change
- v3.3.10: a blocking change
- v3.3.11: a blocking change
- v3.3.12: a blocking change
- v3.3.13: a blocking change
- v3.3.14: a blocking change
- v3.3.15: a blocking change
- v3.3.16: a blocking change
- v3.3.17: a blocking change
- v3.3.18: a blocking change
- v3.3.19: a blocking change
- v3.4.1: a blocking change
- v3.4.2: a blocking change
- v3.4.3: a blocking change
- v3.4.4: a blocking change
- v3.4.5: a blocking change
- v3.4.6: a blocking change
- v3.4.7: a blocking change
- v3.4.8: a blocking change
- v3.4.9: a blocking change
- v3.4.10: a blocking change
- v3.4.11: a blocking change
- v3.4.12: a blocking change
- v3.4.13: not analysed
- v3.5.0: a blocking change
- v3.5.1: a blocking change
- v3.5.2: a blocking change
- v3.5.3: a blocking change
- v3.5.4: a blocking change
- v3.5.5: a blocking change
- v3.5.6: a blocking change
- v3.5.7: not analysed
- Releases to cross
- 34
- Spanning
- 7 mo
- Need action
- 53
What breaks
Every item below is quoted from the release notes it came from, and the quote was checked against the source before it was stored.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- high
Application controller may fail to refresh applications, causing sync failures or incorrect out-of-sync status.
A potential bug with application reconciliation has been identified in this release. The application controller may fail to refresh applications, causing an application to not sync / show resources as out of sync.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Critical vulnerability fix requires immediate upgrade to maintain security posture.
This release contains a security fix to a critical vulnerability: https://github.com/argoproj/argo-cd/security/advisories/GHSA-3v3m-wc6v-x4x3
- blocker
Upgrading from a different minor version requires reading the official upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation before proceeding with the upgrade.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the official upgrading documentation.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation before proceeding with the upgrade.
- high
Kustomize builds rendering Helm charts no longer honor helmGlobals.configHome, breaking builds relying on Helm plugins from that directory.
Kustomize builds that render Helm charts no longer honor `helmGlobals.configHome`. Ordinary `http`, `https`, and `oci` chart repositories still work. Builds that depended on a Helm plugin registered from that directory will not
Do: Remove dependencies on Helm plugins registered via helmGlobals.configHome in Kustomize builds.
- high
OCI manifests larger than 4 MiB are now rejected, potentially breaking deployments using large OCI images.
An OCI manifest larger than 4 MiB is now rejected
Do: Ensure OCI manifests are smaller than 4 MiB.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation
If upgrading from a different minor version, be sure to read the upgrading documentation.
- high
Fixes emudhra CA certs compromise in release 3.3
fix(security): emudhra CA certs compromise for release 3.3 (#30349)
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading requires reading the specific migration guide for cluster version format changes.
More details here: https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/3.3-3.4/#cluster-version-format-change
Do: Read the linked upgrade documentation before upgrading.
- high
Application Sets using Cluster Generators must update the cluster info label format from Major.Minor to vMajor.Minor.Patch.
need to be updated to use `argocd.argoproj.io/kubernetes-version` with the `vMajor.Minor.Patch` format instead of the previous `Major.Minor` format.
Do: Update the `argocd.argoproj.io/kubernetes-version` label on cluster secrets to use the `vMajor.Minor.Patch` format.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Administrators upgrading from a different minor version must read the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Administrators upgrading from a different minor version must consult the official upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Critical vulnerability allows command execution via Kustomize remote ref.
CRITICAL: A Kustomize remote ref can run commands in the repo-server
- blocker
Critical vulnerability allows command execution via Kustomize Helm config home.
CRITICAL: A Kustomize Helm config home can run commands in the repo-server
- blocker
Critical vulnerability allows file reading via Jsonnet import.
CRITICAL: A Jsonnet import can read files from the repo-server
- blocker
Critical vulnerability bypasses AppProject restrictions via resource hooks.
CRITICAL: AppProject restrictions bypassed by PreDelete/PostDelete resource hooks
- blocker
Users upgrading from a different minor version must read the upgrading documentation.
If upgrading from a different minor version, be sure to read the upgrading documentation.
- high
High severity login failure rate limit can be bypassed.
HIGH: Login failure rate limit can be bypassed via concurrent requests
- high
High severity command injection via repository proxy URL on SSH Git repositories.
HIGH: Command injection via a repository proxy URL on SSH Git repositories
- high
Kustomize builds rendering Helm charts no longer honor helmGlobals.configHome.
Kustomize builds that render Helm charts no longer honor `helmGlobals.configHome`.
- high
OCI manifests larger than 4 MiB are now rejected.
An OCI manifest larger than 4 MiB is now rejected
- low
Moderate severity extension proxy RBAC ignores application namespace.
MODERATE: Extension proxy RBAC ignores application namespace when applications-in-any-namespace is enabled
- low
Moderate severity oversized OCI manifest can exhaust repo-server memory.
MODERATE: An oversized OCI manifest can exhaust repo-server memory
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the official upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Administrators upgrading from a different minor version must read the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Administrators upgrading from a different minor version must read the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Critical vulnerability allowing Kustomize remote refs to run commands on the repo-server.
CRITICAL: A Kustomize remote ref can run commands in the repo-server (GHSA-9v9p-x54c-58gc)
- blocker
Critical vulnerability allowing Kustomize Helm config home to run commands on the repo-server.
CRITICAL: A Kustomize Helm config home can run commands in the repo-server (GHSA-fw5c-w8rc-j7fx)
- blocker
Critical vulnerability allowing Jsonnet imports to read files from the repo-server.
CRITICAL: A Jsonnet import can read files from the repo-server (GHSA-m3vr-7329-44ww)
- blocker
Critical vulnerability bypassing AppProject restrictions via PreDelete/PostDelete resource hooks.
CRITICAL: AppProject restrictions bypassed by PreDelete/PostDelete resource hooks (GHSA-fmxq-cgp8-87wp, CVE-2026-77459)
- high
High severity login failure rate limit can be bypassed via concurrent requests.
HIGH: Login failure rate limit can be bypassed via concurrent requests (GHSA-4439-h7jw-5cjj, CVE-2025-61560)
- high
High severity command injection via repository proxy URL on SSH Git repositories.
HIGH: Command injection via a repository proxy URL on SSH Git repositories (GHSA-j6cw-g6p4-7hch, CVE-2026-55797)
- high
Kustomize builds rendering Helm charts no longer honor helmGlobals.configHome, breaking builds dependent on Helm plugins from that directory.
Kustomize builds that render Helm charts no longer honor `helmGlobals.configHome`. Ordinary `http`, `https`, and `oci` chart repositories still work. Builds that depended on a Helm plugin registered from that directory will not ([GHSA-fw5c-w8rc-j7fx](https://github.com/argoproj/argo-cd/security/adv…
- low
Moderate extension proxy RBAC ignores application namespace when applications-in-any-namespace is enabled.
MODERATE: Extension proxy RBAC ignores application namespace when applications-in-any-namespace is enabled (GHSA-g3ff-q88g-chrj)
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
- blocker
Upgrading from a different minor version requires reading the upgrading documentation before proceeding.
If upgrading from a different minor version, be sure to read the upgrading documentation.
Do: Read the upgrading documentation at https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/ before upgrading.
Releases in this span
| Version | Released | Changes | Source |
|---|---|---|---|
| v3.3.7 | 2026-04-16 | 2 | changelog |
| v3.3.8 | 2026-04-21 | 1 | changelog |
| v3.3.9 | 2026-04-30 | 2 | changelog |
| v3.3.10 | 2026-05-12 | 1 | changelog |
| v3.3.11 | 2026-05-28 | 1 | changelog |
| v3.3.12 | 2026-06-18 | 1 | changelog |
| v3.3.13 | 2026-07-31 | 1 | changelog |
| v3.3.14 | 2026-08-12 | 1 | changelog |
| v3.3.15 | 2026-10-06 | 3 | changelog |
| v3.3.16 | 2026-10-12 | 1 | changelog |
| v3.3.17 | 2026-10-21 | 1 | changelog |
| v3.3.18 | 2026-10-22 | 2 | changelog |
| v3.3.19 | 2026-11-02 | 1 | changelog |
| v3.4.1 | 2026-05-06 | 2 | changelog |
| v3.4.2 | 2026-05-12 | 1 | changelog |
| v3.4.3 | 2026-05-28 | 1 | changelog |
| v3.4.4 | 2026-06-18 | 1 | changelog |
| v3.4.5 | 2026-07-09 | 1 | changelog |
| v3.4.6 | 2026-07-31 | 1 | changelog |
| v3.4.7 | 2026-08-12 | 1 | changelog |
| v3.4.8 | 2026-08-27 | 1 | changelog |
| v3.4.9 | 2026-09-14 | 1 | changelog |
| v3.4.10 | 2026-10-06 | 11 | changelog |
| v3.4.11 | 2026-10-12 | 1 | changelog |
| v3.4.12 | 2026-10-20 | 1 | changelog |
| v3.4.13 | 2026-11-02 | not analysed | changelog |
| v3.5.0 | 2026-08-04 | 1 | changelog |
| v3.5.1 | 2026-08-12 | 1 | changelog |
| v3.5.2 | 2026-08-27 | 1 | changelog |
| v3.5.3 | 2026-09-14 | 1 | changelog |
| v3.5.4 | 2026-10-06 | 9 | changelog |
| v3.5.5 | 2026-10-12 | 1 | changelog |
| v3.5.6 | 2026-10-20 | 1 | changelog |
| v3.5.7 | 2026-11-02 | not analysed | changelog |