Skip to content

chore(deps): bump github.com/argoproj/argo-cd/v3 from 3.5.2 to 3.5.4 in /argocd-operator - #1392

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/argocd-operator/github.com/argoproj/argo-cd/v3-3.5.4
Closed

chore(deps): bump github.com/argoproj/argo-cd/v3 from 3.5.2 to 3.5.4 in /argocd-operator#1392
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/argocd-operator/github.com/argoproj/argo-cd/v3-3.5.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 13, 2026

Copy link
Copy Markdown
Contributor

Bumps github.com/argoproj/argo-cd/v3 from 3.5.2 to 3.5.4.

Release notes

Sourced from github.com/argoproj/argo-cd/v3's releases.

v3.5.4

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.4/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.4/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Security fixes

Potentially-breaking changes

  • Kustomize builds that render Helm charts no longer honor helmGlobals.configHome. Ordinary http, https, and oci chart repositories still work. Builds that depended on a Helm plugin registered from that directory will not (GHSA-fw5c-w8rc-j7fx).
  • An OCI manifest larger than 4 MiB is now rejected (GHSA-w996-f2wq-x9c6).

Features

Bug fixes

... (truncated)

Changelog

Sourced from github.com/argoproj/argo-cd/v3's changelog.

Changelog

v2.4.8 (2022-07-29)

Bug fixes

  • feat: support application level extensions (#9923)
  • feat: support multiple extensions per resource group/kind (#9834)
  • fix: extensions is not loading for ConfigMap/Pods (#10010)
  • fix: upgrade moment from 2.29.2 to 2.29.3 (#9330)
  • fix: skip redirect url validation when it's the base href (#10058) (#10116)
  • fix: avoid CVE-2022-28948 (#10093)
  • fix: Set HOST_ARCH for yarn build from platform (#10018)

Other changes

  • chore(deps): bump moment from 2.29.3 to 2.29.4 in /ui (#9897)
  • docs: add OpenSSH breaking change notes (#10104)
  • chore: update parse-url (#10101)
  • docs: add api field example in the appset security doc (#10087)
  • chore: update redis to 7.0.4 avoid CVE-2022-30065 (#10059)
  • docs: add argocd-server grpc metric usage (#10007)
  • chore: upgrade Dex to 2.32.0 (#10036) (#10042)
  • chore: update redis to avoid CVE-2022-2097 (#10031)
  • chore: update haproxy to 2.0.29 for redis-ha (#10045)

v2.4.7 (2022-07-18)

Bug fixes

fix: Support files in argocd.argoproj.io/manifest-generate-paths annotation (#9908) fix: terminal websocket write lock to avoid races (#10011) fix: updated all a tags to Link tags in app summary (#9777) fix: e2e test to use func from clusterauth instead creating one with old logic (#9989) fix: add missing download CLI tool URL response for ppc64le, s390x (#9983)

Other

chore: upgrade parse-url to avoid SNYK-JS-PARSEURL-2936249 (#9826) docs: use quotes to emphasize that ConfigMap value is a string (#9995) docs: document directory app include/exclude fields (#9997) docs: simplify Docker toolchain docs (#9966) (#10006) docs: supported versions (#9876)

v2.4.6 (2022-07-12)

Features

  • feat: Treat connection reset as a retryable error (#9739)

... (truncated)

Commits
  • d6d5b24 Bump version to 3.5.4 on release-3.5 branch (#30043)
  • 7f0a058 fix(security): coordinated security fixes (release-3.5) (#30038)
  • fc2d94d fix(repo-server): cherry-pick health check timeout resulting in CrashLoopBack...
  • 9886fc1 fix: use ObjectMeta in session login test (release-3.5) (#29919)
  • f37dc0c feat(server): log username on login attempts (cherry-pick #29841 for 3.5) (#2...
  • a9d0b96 fix(manifest-generate-paths): do not report changes on cache miss without pat...
  • f0de0be test(flaky): accept connection reset by peer as valid mTLS rejection (cherry-...
  • 1f8100a fix: cherry-pick #29737 (release-3.5) (#29749)
  • 5c8aa46 fix(cmp): clean up tgz stream temporary directories (#29148) (cherry-pick #29...
  • 482c71a fix(ui): manifest viewer jumpiness (#29691) (cherry pick 3.5) (#29725)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump github.com/argoproj/argo-cd/v3 in /argocd-operator
432ef08 
Bumps [github.com/argoproj/argo-cd/v3](https://github.com/argoproj/argo-cd) from 3.5.2 to 3.5.4.
- [Release notes](https://github.com/argoproj/argo-cd/releases)
- [Changelog](https://github.com/argoproj/argo-cd/blob/master/CHANGELOG.md)
- [Commits](argoproj/argo-cd@v3.5.2...v3.5.4)

---
updated-dependencies:
- dependency-name: github.com/argoproj/argo-cd/v3
  dependency-version: 3.5.4
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Oct 13, 2026
@openshift-ci
openshift-ci Bot requested review from Rizwana777 and jparsai October 13, 2026 09:37
@openshift-ci

openshift-ci Bot commented Oct 13, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign wtam2018 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci

openshift-ci Bot commented Oct 13, 2026

Copy link
Copy Markdown

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a redhat-developer member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@coderabbitai

coderabbitai Bot commented Oct 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Repository YAML (base), Organization UI (inherited)
  • Review profile: CHILL
  • Plan: Enterprise
  • Run ID: 55dc2635-16da-46a8-8133-da189bb51578
📥 Commits

Reviewing files that changed from the base of the PR and between 00d3b01 and 432ef08.

⛔ Files ignored due to path filters (1)
  • argocd-operator/go.sum is excluded by !**/*.sum
📒 Files selected for processing (1)
  • argocd-operator/go.mod
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

📝 Summary

Summary by CodeRabbit

  • Updates
    • Updated the Argo CD version to 3.5.4.
    • Refreshed supporting dependencies. No user-facing feature changes are included in this update.

The module file upgrades Argo CD from v3.5.2 to v3.5.4. It also reclassifies go.uber.org/zap and updates the indirect dependency requirements.

Changes: Dependency update

Layer / File(s) Summary
Module requirements
argocd-operator/go.mod		 The Argo CD requirement changes to v3.5.4. The file reclassifies go.uber.org/zap as indirect, removes several indirect requirements, and adds go.opentelemetry.io/otel/sdk/metric.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Suggested reviewers: olivergondza

Merge Risk: ⚪ Minimal · up to 432ef

No concrete issue remains that would prevent merging this dependency update after normal checks.

Pre-merge checks · Passed 5
Passed Passed checks (5 passed)
Check name Status Explanation
Title check Passed The title clearly identifies the dependency and the version upgrade from 3.5.2 to 3.5.4.
Description check Passed The description directly explains the Argo CD dependency upgrade and includes relevant release and security information.
Docstring Coverage Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.

Comment @coderabbitai help to get the list of available commands.

✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Commit to this branch
  • Create a new PR

@chengfang

chengfang commented Oct 13, 2026

Copy link
Copy Markdown
Contributor

superseded by #1349

@chengfang chengfang closed this Oct 13, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 13, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jparsai jparsai Awaiting requested review from jparsai
@Rizwana777 Rizwana777 Awaiting requested review from Rizwana777

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code needs-ok-to-test

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@chengfang