[public-glueops-renovatebot]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change	Pending
argoproj/argo-cd	minor	3.4.12 → 3.5.5	v3.5.7 (+1)

---

Release Notes

argoproj/argo-cd

v3.5.5

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.5/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.5/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• 3295d0c: fix(ci): use curl in kustomize checksum helper so Renovate can refresh checksums (cherry-pick #​29938 for 3.5) (#​30100) (@​argo-cd-cherry-pick-bot[bot])
• a32fb96: fix(hydrator): retry notes push on cannot lock ref errors (cherry-pick #​28469 for 3.5) (#​29905) (@​argo-cd-cherry-pick-bot[bot])
• f0f6bde: fix(reposerver): stale manifests and goroutine leak after CMP failure (#​29870) (cherry-pick #​29874 for 3.5) (#​30140) (@​argo-cd-cherry-pick-bot[bot])
• 3d31f1a: fix(server): fill event count and timestamps for events.k8s.io events (#​30015) (cherry-pick #​30017 for 3.5) (#​30111) (@​rickbrouwer)
• 33a47a5: fix(ui): show enableOCI only for Helm (cherry-pick #​29974 for 3.5) (#​30074) (@​argo-cd-cherry-pick-bot[bot])
• a48be5a: fix: cache the OCI tag list (#​30117) (cherry-pick #​30118 for 3.5) (#​30119) (@​argo-cd-cherry-pick-bot[bot])
• ebf5ac7: fix: correct scheduled-time format in CronWorkflow create-workflow action (#​29915) (cherry-pick #​29916 for 3.5) (#​29953) (@​argo-cd-cherry-pick-bot[bot])
• 514141d: fix: fix escaped URL routing for write repo (creds) endpoints (cherry-pick #​29940 for 3.5) (#​29958) (@​argo-cd-cherry-pick-bot[bot])
• 4d2194b: fix: fix untar inbound check if dstPath is symlinked (cherry-pick #​28881 release-3.5) (#​30053) (@​blakepettersson)
• 4d68ee3: fix: fixes flaky tests by making Log capturer thread-safe (cherry-pick #​28328 for 3.5) (#​30078) (@​argo-cd-cherry-pick-bot[bot])
• 1d0585d: fix: synchronize OCI cache cleanup with extraction (#​30020) (cherry-pick #​30023 for 3.5) (#​30103) (@​argo-cd-cherry-pick-bot[bot])

Dependency updates

• 6b6f042: chore(deps): bump go-git dependency- #​30013 for v3.5 (#​30047) (@​ranakan19)
• 59e320f: chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.84.0 (cherry-pick release-3.5) (#​30056) (@​dipakkarde)
• d1b3091: chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (cherry-pick #​28696 for 3.5) (#​30057) (@​argo-cd-cherry-pick-bot[bot])
• 29f57d5: chore(deps): bump the golang-x group with 3 updates (#​29705) (cherry-pick release-3.5) (#​30072) (@​blakepettersson)
• f89a094: chore(deps): update group golang to v1.26.9 (release-3.5) (#​30092) (@​argoproj-renovate[bot])

Full Changelog: argoproj/argo-cd@v3.5.4...v3.5.5

v3.5.4

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.4/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.4/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Security fixes

• CRITICAL: A Kustomize remote ref can run commands in the repo-server (GHSA-9v9p-x54c-58gc)
• CRITICAL: A Kustomize Helm config home can run commands in the repo-server (GHSA-fw5c-w8rc-j7fx)
• CRITICAL: A Jsonnet import can read files from the repo-server (GHSA-m3vr-7329-44ww)
• CRITICAL: AppProject restrictions bypassed by PreDelete/PostDelete resource hooks (GHSA-fmxq-cgp8-87wp, CVE-2026-77459)
• HIGH: Login failure rate limit can be bypassed via concurrent requests (GHSA-4439-h7jw-5cjj, CVE-2025-61560)
• HIGH: Command injection via a repository proxy URL on SSH Git repositories (GHSA-j6cw-g6p4-7hch, CVE-2026-55797)
• MODERATE: Extension proxy RBAC ignores application namespace when applications-in-any-namespace is enabled (GHSA-g3ff-q88g-chrj)
• MODERATE: An oversized OCI manifest can exhaust repo-server memory (GHSA-w996-f2wq-x9c6)

Potentially-breaking changes

• Kustomize builds that render Helm charts no longer honor helmGlobals.configHome. Ordinary http, https, and oci chart repositories still work. Builds that depended on a Helm plugin registered from that directory will not (GHSA-fw5c-w8rc-j7fx).
• An OCI manifest larger than 4 MiB is now rejected (GHSA-w996-f2wq-x9c6).

Features

• f37dc0c: feat(server): log username on login attempts (cherry-pick #​29841 for 3.5) (#​29861) (@​argo-cd-cherry-pick-bot[bot])

Bug fixes

• 5c8aa46: fix(cmp): clean up tgz stream temporary directories (#​29148) (cherry-pick #​29156 for 3.5) (#​29773) (@​argo-cd-cherry-pick-bot[bot])
• 7f0a058: fix(security): coordinated security fixes (release-3.5) (#​30038) (@​crenshaw-dev)
• 482c71a: fix(ui): manifest viewer jumpiness (#​29691) (cherry pick 3.5) (#​29725) (@​crenshaw-dev)
• 1f8100a: fix: cherry-pick #​29737 (release-3.5) (#​29749) (@​blakepettersson)
• 9886fc1: fix: use ObjectMeta in session login test (release-3.5) (#​29919) (@​crenshaw-dev)

Other work

• a9d0b96: fix(manifest-generate-paths): do not report changes on cache miss without path updates (cherry-pick #​29442 for 3.5) (#​29849) (@​argo-cd-cherry-pick-bot[bot])
• fc2d94d: fix(repo-server): cherry-pick health check timeout resulting in CrashLoopBackOff to release-3.5 branch (#​29901) (@​aali309)
• f0de0be: test(flaky): accept connection reset by peer as valid mTLS rejection (cherry-pick #​28367 for 3.5) (#​29850) (@​argo-cd-cherry-pick-bot[bot])

Full Changelog: argoproj/argo-cd@v3.5.3...v3.5.4

v3.5.3

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.3/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.3/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• c198be7: fix(health): a KubeVirt VirtualMachine declared stopped is Healthy (cherry-pick #​29664 for 3.5) (#​29665) (@​argo-cd-cherry-pick-bot[bot])
• 4b3f69d: fix(health): report suspended FlinkDeployment as healthy (#​26818) (cherry-pick #​28995 for 3.5) (#​29525) (@​argo-cd-cherry-pick-bot[bot])
• dd2cb1a: fix(repository): clean repository on revision change (cherry-pick #​28771 for 3.5) (#​29486) (@​argo-cd-cherry-pick-bot[bot])
• 70b399c: fix(resource_customizations): Crossplane MRs should report Progressing (not Healthy) whilst provisioning [ISSUE: #​29381] (cherry-pick #​29382 for 3.5) (#​29520) (@​argo-cd-cherry-pick-bot[bot])
• be8b387: fix(sync): correctly set operationState values on retry (#​26530) (cherry-pick #​28778 for 3.5) (#​29431) (@​omkar619-dev)
• a5e5992: fix(ui): guard SSO redirect to stop 401 retry loop (cherry-pick #​28807 for 3.5) (#​29631) (@​argo-cd-cherry-pick-bot[bot])
• 0b0890e: fix(ui): use hydrateTo branch name when set (cherry-pick #​29562 for 3.5) (#​29564) (@​crenshaw-dev)
• 18f0566: fix: GRPCRoute health check ignores stale observedGeneration conditions (#​28086) (cherry-pick #​28087 for 3.5) (#​29517) (@​argo-cd-cherry-pick-bot[bot])
• 4d653a6: fix: handle GrafanaFolder negative-polarity condition (#​29395) (cherry-pick #​29397 for 3.5) (#​29524) (@​argo-cd-cherry-pick-bot[bot])
• ec58520: fix: recover AuthReconcile visitor panics (cherry-pick #​29440 for 3.5) (#​29531) (@​Karthik-Chowdary)

Full Changelog: argoproj/argo-cd@v3.5.2...v3.5.3

v3.5.2

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.2/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.2/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• f1f109c: fix(appset): restore ignoreApplicationDifferences after normalization (cherry-pick #​29070 for 3.5) (#​29195) (@​argo-cd-cherry-pick-bot[bot])
• a45dd38: fix(repository): resolve untyped helm source type in UpdateRevisionForPaths (cherry-pick #​28904 for 3.5) (#​29399) (@​argo-cd-cherry-pick-bot[bot])
• 417c675: fix(revert): auto-sync skipped when newer commit arrives during sync (cherry-pick #​28692 for 3.5) (#​29224) (@​rumstead)
• 961ee40: fix(ui): remove kind filter from appset page (#​29310) (#​29311) (cherry-pick 3.5) (#​29314) (@​crenshaw-dev)
• cc1f3ee: fix(ui): show operation state on applications list page (cherry-pick release-3.5) (#​29344) (@​antonu17)
• 5accee3: fix: don't degrade Cluster API Cluster health while Ready is False during provisioning (cherry-pick #​29237 for 3.5) (#​29273) (@​argo-cd-cherry-pick-bot[bot])
• 4d99c52: fix: recover from kubectl panic in AuthReconcile when SA is forbidden (cherry-pick #​28669 for 3.5) (#​29294) (@​alexymantha)

Dependency updates

• 8b9e270: chore(deps): update dependency dexidp/dex to v2.45.1 (#​29334) (@​nitishfy)

Other work

• e258ee2: chore: bump version to 3.5.2 on release-3.5 branch (#​29404) (@​github-actions[bot])
• a9d94d6: fix(notification-controller): deep-copy before mutating object from a shared cache (cherry-pick #​29350 for 3.5) (#​29354) (@​argo-cd-cherry-pick-bot[bot])
• cc1d7a2: fix(notification-controller): read appprojects from informer cache (#​28815) (cherry-pick release-3.5) (#​29345) (@​antonu17)

Full Changelog: argoproj/argo-cd@v3.5.1...v3.5.2

v3.5.1

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.1/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.1/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• 33f3bc5: fix(appset): stop progressive sync reconciling in a tight loop (#​27577) (#​29139) (@​himeshp)
• d358e75: fix(appset): verify terminating Applications against the API server (#​29042) (#​29138) (@​himeshp)
• ecf3737: fix(controller): cherry-pick treat timeout.reconciliation=0 as disabled soft expiry (#​27683) (#​29007) (@​aali309)
• 978fa65: fix(controller): reuse server-side diff result when masking Secret data (#​27858) (#​29074) (@​1ovsss)
• f399c84: fix(controller): use diff cache when timeout.reconciliation is disabled (cherry-pick #​29073 for 3.5) (#​29158) (@​argo-cd-cherry-pick-bot[bot])
• 960bed7: fix(server): prevent SSD CLI secret mask spoofing (cherry-pick #​29089 for 3.5) (#​29130) (@​argo-cd-cherry-pick-bot[bot])
• 9f360f4: fix(ssd): hide secret in last-applied-configuration annotation (#​28989) (#​29052) (@​pjiang-dev)

Other work

• 109ca7c: chore: bump version to 3.5.1 on release-3.5 branch (#​29165) (@​github-actions[bot])
• b44fbbc: fix(manifest-generate-paths): Consistent gen manifest cache key (#​28074 and #​29037) (#​29049) (@​agaudreault)

Full Changelog: argoproj/argo-cd@v3.5.0...v3.5.1

v3.5.0

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.0/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.0/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Features

• be19446: feat(Jitter): Add Configurable Jitter for Webhook-Triggered application Refreshes (#​25433) (@​adityaraj178)
• 5b30739: feat(appset): add concurrency when managing applications (#​26642) (@​rumstead)
• 29fd8db: feat(appset): filtering repos by archived status #​20736 (#​21505) (@​prune998)
• 57942ce: feat(cli): Add support for Source Integrity configuration (#​26997) (@​olivergondza)
• 3cc6ba7: feat(cli): add --app-namespace flag to missing argocd app subcommands (#​27942) (@​Mangaal)
• 0e729cc: feat(cli): add appset-namespace for appset command (#​27022) (@​Mangaal)
• 744983b: feat(health): Add healthcheck for gardener "Shoot" resources (#​25750) (@​Sven1410)
• 6cc786d: feat(health): add GatewayClass health check (#​26591) (@​dnfwlq8054)
• eabd4d6: feat(health): add pause and unpause actions to psmdb resource (#​27616) (@​KyriosGN0)
• daadf86: feat(health): additional promoter.argoproj.io health checks (#​27170) (@​crenshaw-dev)
• 4b69a7f: feat(health): finalizer messages for Promoter checks (#​27478) (@​crenshaw-dev)
• 289a4c0: feat(health): support BackendTLSPolicy.gateway.networking.k8s.io (#​27385) (@​snorwin)
• 4cdc650: feat(helm): support wildcard glob patterns for valueFiles (#​26768) (@​nitishfy)
• f7a7deb: feat(hydrator): dynamically manage README template from argocd-cm ConfigMap [updated] (#​19067) (#​24309) (@​gyu-young-park)
• 86936e2: feat(hydrator): make manifest hydration queue concurrency configurable (#​27926) (#​27948) (@​GuruduGanesh)
• 2308e17: feat(hydrator): opt-in source integrity verification for dry sources (Alpha) (#​19302) (#​28084) (@​mladjan-gadzic)
• bf1591d: feat(hydrator): support syncSource repoURL for separate destination repo (#​27011) (@​boostrack)
• 41b6fee: feat(impersonation): allow to disable strict enforcement (#​27084) (cherry-pick #​27573 for 3.5) (#​28595) (@​argo-cd-cherry-pick-bot[bot])
• 0c0140c: feat(metrics): add parallelism limit repo server (#​27911) (@​pjiang-dev)
• 7d2eb77: feat(renovate): clean up config and remove github app (#​27738) (@​rumstead)
• 153ec67: feat(resource_customizations): add health checks for VictoriaMetrics (#​27451) (@​megative)
• 6b84ea9: feat(server): drop objects from non-allowed namespaces before they enter the cache. (#​28018) (@​christianh814)
• 224b75a: feat(server): use typed Argo CD EventList for event-listing APIs (#​25767) (#​26322) (@​chansuke)
• 64a0417: feat(ui): Add AppSet to Application Resource Tree (#​26601) (@​pjiang-dev)
• b035a77: feat(ui): ApplicationSet Preview Apps tab in UI (#​27799) (@​pjiang-dev)
• 566c172: feat(ui): add GitOps Promoter resource icon (#​26894) (@​crenshaw-dev)
• 0dd8874: feat(ui): add nauth.io resource icon (#​28226) (@​choufraise)
• f16d08a: feat(ui): add repo url as filter in home page (#​26670) (#​27418) (@​adityaraj178)
• 91e7664: feat(ui): per-application notice banner and info icon (#​14405) (#​27719) (@​gdsoumya)
• 1b405ce: feat(ui): search filter by target revision (#​24038) (@​choejwoo)
• 706a037: feat(ui): support creating multi-source applications in New App panel [CONTINUED..] (#​27095) (@​aali309)
• 2fcf104: feat(ui): support spec.sourceHydrator.drySource.repoURL (@​crenshaw-dev)
• 74d1fe0: feat(ui): use toggle-auto-sync resource action in app details page (#​21564) (#​27226) (@​shiiyan)
• db7d672: feat(webhooks): add webhook support for GHCR (#​26462) (@​nitishfy)
• 6d92e17: feat: Add ProvideClusterInfo and Config fields to ExecProviderConfig (#​24282) (#​27976) (@​mikeshng)
• 022f935: feat: Add basic support for git tag path prefixes (#​27290) (@​k4r1)
• aad3422: feat: Add suspend/resume actions for MariaDB (#​27675) (#​27674) (@​mgross2)
• 586430c: feat: Migrate from Helm 3 to Helm 4 (#​28076) (@​reggie-k)
• c61c1dc: feat: Render Helm ValuesObject as YAML in log output instead of binary (#​18342) (#​27649) (@​subhramit)
• 9a19735: feat: Support Azure Service Principal authentication for Azure DevOps repositories (#​25324) (@​allanyung)
• 97082e8: feat: add Gateway API support to network view (#​26188) (@​tete17)
• 603c900: feat: add action to delete recyclable Numaflow pipelines ([#​25900](https://redirect.github.com/argoproj/argo-cd/iss

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.