Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.2/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.2/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• f1f109c: fix(appset): restore ignoreApplicationDifferences after normalization (cherry-pick #29070 for 3.5) (#29195) (@argo-cd-cherry-pick-bot[bot])
• a45dd38: fix(repository): resolve untyped helm source type in UpdateRevisionForPaths (cherry-pick #28904 for 3.5) (#29399) (@argo-cd-cherry-pick-bot[bot])
• 417c675: fix(revert): auto-sync skipped when newer commit arrives during sync (cherry-pick #28692 for 3.5) (#29224) (@rumstead)
• 961ee40: fix(ui): remove kind filter from appset page (#29310) (#29311) (cherry-pick 3.5) (#29314) (@crenshaw-dev)
• cc1f3ee: fix(ui): show operation state on applications list page (cherry-pick release-3.5) (#29344) (@antonu17)
• 5accee3: fix: don't degrade Cluster API Cluster health while Ready is False during provisioning (cherry-pick #29237 for 3.5) (#29273) (@argo-cd-cherry-pick-bot[bot])
• 4d99c52: fix: recover from kubectl panic in AuthReconcile when SA is forbidden (cherry-pick #28669 for 3.5) (#29294) (@alexymantha)

Dependency updates

• 8b9e270: chore(deps): update dependency dexidp/dex to v2.45.1 (#29334) (@nitishfy)

Other work

• e258ee2: chore: bump version to 3.5.2 on release-3.5 branch (#29404) (@github-actions[bot])
• a9d94d6: fix(notification-controller): deep-copy before mutating object from a shared cache (cherry-pick #29350 for 3.5) (#29354) (@argo-cd-cherry-pick-bot[bot])
• cc1d7a2: fix(notification-controller): read appprojects from informer cache (#28815) (cherry-pick release-3.5) (#29345) (@antonu17)

Full Changelog: v3.5.1...v3.5.2

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.8/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.8/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• 90f81d5: fix(revert): auto-sync skipped when newer commit arrives during sync (cherry-pick #28692 for 3.4) (#29225) (@rumstead)
• 924ab35: fix: don't degrade Cluster API Cluster health while Ready is False during provisioning (cherry-pick #29237 for 3.4) (#29274) (@argo-cd-cherry-pick-bot[bot])

Dependency updates

• e4de80d: chore(deps): bump DOMPurify to 3.4.7 for CVE-2026-49978 (#29222) (@aali309)
• 2475426: chore(deps): bump brace-expansion to 2.1.4, 1.1.18 in /ui for fixing CVE-2026-14257 and CVE-2026-69152 (release-3.4) (#29379) (@nmirasch)
• e5bee2c: chore(deps): bump js-yaml to fix CVE-2026-59869 (#28946) (@aali309)

Other work

• 609fa82: chore: bump version to 3.4.8 on release-3.4 branch (#29405) (@github-actions[bot])
• 9c771f6: fix(notification-controller): deep-copy before mutating object from a shared cache (cherry-pick #29350 for 3.4) (#29353) (@argo-cd-cherry-pick-bot[bot])
• bad3c48: fix(notification-controller): read appprojects from informer cache (#28815) (cherry-pick release-3.4) (#29346) (@antonu17)

Full Changelog: v3.4.7...v3.4.8

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.1/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.1/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• 33f3bc5: fix(appset): stop progressive sync reconciling in a tight loop (#27577) (#29139) (@himeshp)
• d358e75: fix(appset): verify terminating Applications against the API server (#29042) (#29138) (@himeshp)
• ecf3737: fix(controller): cherry-pick treat timeout.reconciliation=0 as disabled soft expiry (#27683) (#29007) (@aali309)
• 978fa65: fix(controller): reuse server-side diff result when masking Secret data (#27858) (#29074) (@1ovsss)
• f399c84: fix(controller): use diff cache when timeout.reconciliation is disabled (cherry-pick #29073 for 3.5) (#29158) (@argo-cd-cherry-pick-bot[bot])
• 960bed7: fix(server): prevent SSD CLI secret mask spoofing (cherry-pick #29089 for 3.5) (#29130) (@argo-cd-cherry-pick-bot[bot])
• 9f360f4: fix(ssd): hide secret in last-applied-configuration annotation (#28989) (#29052) (@pjiang-dev)

Other work

• 109ca7c: chore: bump version to 3.5.1 on release-3.5 branch (#29165) (@github-actions[bot])
• b44fbbc: fix(manifest-generate-paths): Consistent gen manifest cache key (#28074 and #29037) (#29049) (@agaudreault)

Full Changelog: v3.5.0...v3.5.1

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.7/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.7/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• cbd7687: fix(appset): progressive sync fixes (3.4 backports of #29042 and #27577) (#29141) (@himeshp)
• 0781a1a: fix(controller): reuse server-side diff result when masking Secret data (#27858) (#29075) (@1ovsss)
• a09c39c: fix(server): prevent SSD CLI secret mask spoofing (cherry-pick #29089 for 3.4) (#29131) (@argo-cd-cherry-pick-bot[bot])
• 8afda0d: fix(ssd): hide secret in last-applied-configuration annotation (#28989) (#29053) (@pjiang-dev)

Dependency updates

• e0aea00: chore(deps): bump fast-xml-parser from 4.5.3 to 4.5.6 in /ui - 3.4 (#27342) (@keithchong)

Other work

• 7b6113c: chore: bump version to 3.4.7 on release-3.4 branch (#29161) (@github-actions[bot])

Full Changelog: v3.4.6...v3.4.7

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.14/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.14/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• 7242ed2: fix(controller): reuse server-side diff result when masking Secret data (#27858) (#29076) (@1ovsss)
• d93267f: fix(server): prevent SSD CLI secret mask spoofing (#29089) (#29137) (@pjiang-dev)
• 4e181b9: fix(ssd): hide secret in last-applied-configuration annotation (#28989) (#29054) (@pjiang-dev)
• 80f08f9: fix: register pprof endpoints in repo-server using the params config map (cherry-pick #26237 for 3.3) (#29032) (@gdsoumya)

Dependency updates

• cf38a82: chore(deps): bump DOMPurify to 3.4.7 for CVE-2026-49978 (#28969) (@aali309)
• d3f7e8c: chore(deps): bump brace-expansion to 2.1.4, 1.1.18 in /ui for fixing CVE-2026-69152 (release-3.3) (#29149) (@dkarpele)

Other work

• a0a99e1: chore: bump version to 3.3.14 on release-3.3 branch (#29159) (@github-actions[bot])

Full Changelog: v3.3.13...v3.3.14

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.0/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.0/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Features

• be19446: feat(Jitter): Add Configurable Jitter for Webhook-Triggered application Refreshes (#25433) (@adityaraj178)
• 5b30739: feat(appset): add concurrency when managing applications (#26642) (@rumstead)
• 29fd8db: feat(appset): filtering repos by archived status #20736 (#21505) (@prune998)
• 57942ce: feat(cli): Add support for Source Integrity configuration (#26997) (@olivergondza)
• 3cc6ba7: feat(cli): add --app-namespace flag to missing argocd app subcommands (#27942) (@Mangaal)
• 0e729cc: feat(cli): add appset-namespace for appset command (#27022) (@Mangaal)
• 744983b: feat(health): Add healthcheck for gardener "Shoot" resources (#25750) (@Sven1410)
• 6cc786d: feat(health): add GatewayClass health check (#26591) (@dnfwlq8054)
• eabd4d6: feat(health): add pause and unpause actions to psmdb resource (#27616) (@KyriosGN0)
• daadf86: feat(health): additional promoter.argoproj.io health checks (#27170) (@crenshaw-dev)
• 4b69a7f: feat(health): finalizer messages for Promoter checks (#27478) (@crenshaw-dev)
• 289a4c0: feat(health): support BackendTLSPolicy.gateway.networking.k8s.io (#27385) (@snorwin)
• 4cdc650: feat(helm): support wildcard glob patterns for valueFiles (#26768) (@nitishfy)
• f7a7deb: feat(hydrator): dynamically manage README template from argocd-cm ConfigMap [updated] (#19067) (#24309) (@gyu-young-park)
• 86936e2: feat(hydrator): make manifest hydration queue concurrency configurable (#27926) (#27948) (@GuruduGanesh)
• 2308e17: feat(hydrator): opt-in source integrity verification for dry sources (Alpha) (#19302) (#28084) (@mladjan-gadzic)
• bf1591d: feat(hydrator): support syncSource repoURL for separate destination repo (#27011) (@boostrack)
• 41b6fee: feat(impersonation): allow to disable strict enforcement (#27084) (cherry-pick #27573 for 3.5) (#28595) (@argo-cd-cherry-pick-bot[bot])
• 0c0140c: feat(metrics): add parallelism limit repo server (#27911) (@pjiang-dev)
• 7d2eb77: feat(renovate): clean up config and remove github app (#27738) (@rumstead)
• 153ec67: feat(resource_customizations): add health checks for VictoriaMetrics (#27451) (@megative)
• 6b84ea9: feat(server): drop objects from non-allowed namespaces before they enter the cache. (#28018) (@christianh814)
• 224b75a: feat(server): use typed Argo CD EventList for event-listing APIs (#25767) (#26322) (@chansuke)
• 64a0417: feat(ui): Add AppSet to Application Resource Tree (#26601) (@pjiang-dev)
• b035a77: feat(ui): ApplicationSet Preview Apps tab in UI (#27799) (@pjiang-dev)
• 566c172: feat(ui): add GitOps Promoter resource icon (#26894) (@crenshaw-dev)
• 0dd8874: feat(ui): add nauth.io resource icon (#28226) (@choufraise)
• f16d08a: feat(ui): add repo url as filter in home page (#26670) (#27418) (@adityaraj178)
• 91e7664: feat(ui): per-application notice banner and info icon (#14405) (#27719) (@gdsoumya)
• 1b405ce: feat(ui): search filter by target revision (#24038) (@choejwoo)
• 706a037: feat(ui): support creating multi-source applications in New App panel [CONTINUED..] (#27095) (@aali309)
• 2fcf104: feat(ui): support spec.sourceHydrator.drySource.repoURL (@crenshaw-dev)
• 74d1fe0: feat(ui): use toggle-auto-sync resource action in app details page (#21564) (#27226) (@shiiyan)
• db7d672: feat(webhooks): add webhook support for GHCR (#26462) (@nitishfy)
• 6d92e17: feat: Add ProvideClusterInfo and Config fields to ExecProviderConfig (#24282) (#27976) (@mikeshng)
• 022f935: feat: Add basic support for git tag path prefixes (#27290) (@k4r1)
• aad3422: feat: Add suspend/resume actions for MariaDB (#27675) (#27674) (@mgross2)
• 586430c: feat: Migrate from Helm 3 to Helm 4 (#28076) (@reggie-k)
• c61c1dc: feat: Render Helm ValuesObject as YAML in log output instead of binary (#18342) (#27649) (@subhramit)
• 9a19735: feat: Support Azure Service Principal authentication for Azure DevOps repositories (#25324) (@allanyung)
• 97082e8: feat: add Gateway API support to network view (#26188) (@tete17)
• 603c900: feat: add action to delete recyclable Numaflow pipelines (#25900) (@dpadhiar)
• de94161: feat: add action to restart StrimziPodSet (#27266) (@KyriosGN0)
• a2b91ce: feat: add depth option to ui (#26618) (@blakepettersson)
• 1dc2ad0: feat: add health check for karpenter.sh/NodeClaim (#26876) (@Navneet072300)
• 611fcb0: feat: add sync overrun option to sync windows (#25361) (#25510) (@puskunalis)
• 48f18e2: feat: add toggle-auto-sync resource action for Application (#21564) (#26477) (@vikasrao23)
• 2df5f75: feat: adds mTLS support in repo-server (#26715) (@ppapapetrou76)
• 4d02fc2: feat: expose Appset UI and fix pie chart summary (#26666) (@pjiang-dev)
• a889f46: feat: make appset proxy-url param a native flag (#27788) (@ppapapetrou76)
• ad310c2: feat: replace error message in webhook handler with metrics (#27215) (@alexmt)
• 01187d1: feat: support Azure AD groups claims overflow via Microsoft Graph API (#27397) (@gravufo)
• f71239c: feat: support destinationServiceAccounts in global projects (#23059) (@enneitex)
• f460a3c: feat: surface root cause in sync failure message and cache discovery errors (#27750) (@ppapapetrou76)
• 3eebbcb: feat: use impersonation for server operations (logs, delete, etc) #22996 (#26898) (@alexymantha)

Bug fixes

• b982144: Revert "fix: prevent automatic refreshes from informer resync and status updates" (#27562) (@agaudreault)
• c5d1c91: fix(UI): show RollingSync step clearly when labels match no step (#26877) (@aali309)
• c52bf66: fix(appcontroller): application controller in core mode fails to sync when server.secretkey is missing (#26793) (@anandf)
• e81969f: fix(applicationset): include repo URL in git file generator errors (#28075) (@morning-verlu)
• e4fe7f6: fix(appset): don't release finalizer while children still terminate (cherry-pick #28999 for 3.5) (#29006) (@argo-cd-cherry-pick-bot[bot])
• 06fae9d: fix(appset): fall back to create when patch returns NotFound (#17312) (cherry-pick #28645 for 3.5) (#28716) (@argo-cd-cherry-pick-bot[bot])
• 45a84df: fix(ci): add .gitkeep to images dir (#26892) (@blakepettersson)
• 4c42071: fix(ci): openssf scorecard doesn't allow global vars (#27203) (@crenshaw-dev)
• 36f4ff7: fix(ci): pin goreman version used in ci-build.yaml (#27062) (#27061) (@dudinea)
• 25b3037: fix(ci): pnpm sbom generation (#27337) (#27339) (@crenshaw-dev)
• 99c51df: fix(ci): renovatebot action uses floating image tag (#27023) (#27024) (@dudinea)
• fb82b16: fix(ci): run yarn install with --frozen-lockfile (#27098) (#27099) (@dudinea)
• b403f5c: fix(cli): hi...

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.6/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.6/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• aa9970b: fix(appset): fall back to create when patch returns NotFound (#17312) (cherry-pick #28645 for 3.4) (#28718) (@rickbrouwer)
• 9a91802: fix(diff): don't drop manager-owned descendant fields when filtering webhook mutations (cherry-pick #28819 for 3.4) (#28894) (@argo-cd-cherry-pick-bot[bot])
• 4907a99: fix(helm): pass registry passwords through stdin (#17821) (#28835) (@nitishfy)
• b6d7c82: fix: mount argocd-cmd-params-cm in repo-server so pprof can be enabled (cherry-pick #28863 for 3.4) (#28864) (@argo-cd-cherry-pick-bot[bot])
• cf7c4a7: fix: only do annotation backfill if live unset (cherry-pick #28770 for 3.4) (#28776) (@argo-cd-cherry-pick-bot[bot])
• a3d8e28: fix: progressive sync fixes (3.4 cherry-picks) (#29000) (@blakepettersson)
• 2aa646b: fix: use Entra ID uti claim as token id when jti is absent (#28625) (cherry-pick #28656 for 3.4) (#28676) (@argo-cd-cherry-pick-bot[bot])
• 275d11e: fix: use OIDC refresh tokens to renew expired sessions (#27041, #12189) (cherry-pick #27777 for 3.4) (#28688) (@argo-cd-cherry-pick-bot[bot])

Other work

• e1becb7: chore: bump version to 3.4.6 on release-3.4 branch (#28959) (@github-actions[bot])

Full Changelog: v3.4.5...v3.4.6

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.13/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.13/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• 1853165: fix(health): configconnectorcontext and configconnector (#26308) (#26309) (3.3) (#28611) (@crenshaw-dev)
• 2536ce3: fix(helm): pass registry passwords through stdin (#17821) (cherry-pic… (#28836) (@nitishfy)
• 853e2c0: fix(reposerver): honor depth of referenced source instead of primary source (cherry-pick #28339 for 3.3) (#28342) (@alexandresavicki)
• fac2752: fix(ssa): do not run auth reconcile with SSA (cherry pick of #28027 and #27601 to 3.3) (#28266) (@akhilnittala)
• d73c512: fix: Revert "fix: avoid calling UpdateRevisionForPaths unnecessary (#25151)" (cherry-pick #27241 for 3.3) (#28949) (@ranakan19)
• 91a603b: fix: deleted resource are incorrectly shown in UI (cherry-pick #28322 for 3.3) (#28336) (@argo-cd-cherry-pick-bot[bot])
• f6faa38: fix: don't clobber non-ignored fields on "replace" (cherry-pick #27136 for 3.3) (#28506) (@argo-cd-cherry-pick-bot[bot])
• ea08dfa: fix: fixes a regression of dex config env vars substituion - Cherry pick of #28369 in 3.3 (#28410) (@ppapapetrou76)
• 28d47f4: fix: mount argocd-cmd-params-cm in repo-server so pprof can be enabled (cherry-pick #28863 for 3.3) (#28865) (@argo-cd-cherry-pick-bot[bot])

Dependency updates

• 676d6f5: chore(deps): bump form-data to 4.0.6 in /ui for fixing CVE-2026-12143 (#28831) (@alkakumari016)
• 5aa0bef: chore(deps): bump golang.org/x/crypto to 0.53.0 (release-3.3) (#28338) (@nmirasch)

Other work

• 58a3ab2: chore: bump version to 3.3.13 on release-3.3 branch (#28960) (@github-actions[bot])

Full Changelog: v3.3.12...v3.3.13

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.0-rc3/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.0-rc3/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Features

• 41b6fee: feat(impersonation): allow to disable strict enforcement (#27084) (cherry-pick #27573 for 3.5) (#28595) (@argo-cd-cherry-pick-bot[bot])

Bug fixes

• 06fae9d: fix(appset): fall back to create when patch returns NotFound (#17312) (cherry-pick #28645 for 3.5) (#28716) (@argo-cd-cherry-pick-bot[bot])
• a62624a: fix(diff): don't drop manager-owned descendant fields when filtering webhook mutations (cherry-pick #28819 for 3.5) (#28895) (@argo-cd-cherry-pick-bot[bot])
• 0b42a6d: fix(helm): pass registry passwords through stdin (Cherry-Pick) (#28834) (@nitishfy)
• 5c1b930: fix(progressivesync): check if error == notfound (cherry-pick #28663 for 3.5) (#28670) (@argo-cd-cherry-pick-bot[bot])
• bc5d359: fix(ui): update cluster count logic in ApplicationsSummary (cherry-pick #28768 for 3.5) (#28777) (@argo-cd-cherry-pick-bot[bot])
• b6bff3b: fix: mount argocd-cmd-params-cm in repo-server so pprof can be enabled (cherry-pick #28863 for 3.5) (#28866) (@argo-cd-cherry-pick-bot[bot])
• 061bd2b: fix: only do annotation backfill if live unset (cherry-pick #28770 for 3.5) (#28775) (@argo-cd-cherry-pick-bot[bot])
• f1b39c8: fix: use Entra ID uti claim as token id when jti is absent (#28625) (cherry-pick #28656 for 3.5) (#28675) (@argo-cd-cherry-pick-bot[bot])
• 7cde9f4: fix: use OIDC refresh tokens to renew expired sessions (#27041, #12189) (cherry-pick #27777 for 3.5) (#28689) (@argo-cd-cherry-pick-bot[bot])

Other work

• 7660efb: chore: bump version to 3.5.0-rc3 on release-3.5 branch (#28938) (@github-actions[bot])
• faaa0b6: fix(repo-server): honor ARGOCD_REPO_SERVER_OTLP_HEADERS in repo-server (Cherry-pick - 3.5) (#28715) (@nitishfy)
• 8ffead8: test(e2e): fix github's failure to show complete results of e2e test (#28727) (cherry-pick #28726 for 3.5) (#28728) (@argo-cd-cherry-pick-bot[bot])

Full Changelog: v3.5.0-rc2...v3.5.0-rc3

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.5/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.5/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• e77e4b6: fix(reposerver): honor depth of referenced source instead of primary source (cherry-pick #28339 for 3.4) (#28341) (@alexandresavicki)
• 63e67d5: fix(ssa): do not run auth reconcile with SSA (cherry pick of #27624 and #27601 to 3.4) (#28265) (@Mangaal)
• 2403907: fix: auto-sync skipped when newer commit arrives during sync with manifest-generate-paths (#27875) (cherry-pick #28227 for 3.4) (#28331) (@argo-cd-cherry-pick-bot[bot])
• 2d18587: fix: deleted resource are incorrectly shown in UI (cherry-pick #28322 for 3.4) (#28337) (@argo-cd-cherry-pick-bot[bot])
• a82e158: fix: don't clobber non-ignored fields on "replace" (cherry-pick #27136 for 3.4) (#28507) (@argo-cd-cherry-pick-bot[bot])
• d4c8f1c: fix: fixes a regression of dex config env vars substituion - Cherry pick of #28369 in 3.4 (#28411) (@ppapapetrou76)

Dependency updates

• 8c7ece5: chore(deps): bump golang.org/x/crypto to 0.53.0 (release-3.4) (#28375) (@nmirasch)
• a8f245b: chore(deps): update Ubuntu base image to 26.04 LTS (3.4) (#28430) (@suii2210)

Full Changelog: v3.4.4...v3.4.5