v3.4.10

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.10/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.10/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Security fixes

• CRITICAL: A Kustomize remote ref can run commands in the repo-server (GHSA-9v9p-x54c-58gc)
• CRITICAL: A Kustomize Helm config home can run commands in the repo-server (GHSA-fw5c-w8rc-j7fx)
• CRITICAL: A Jsonnet import can read files from the repo-server (GHSA-m3vr-7329-44ww)
• CRITICAL: AppProject restrictions bypassed by PreDelete/PostDelete resource hooks (GHSA-fmxq-cgp8-87wp, CVE-2026-77459)
• HIGH: Login failure rate limit can be bypassed via concurrent requests (GHSA-4439-h7jw-5cjj, CVE-2025-61560)
• HIGH: Command injection via a repository proxy URL on SSH Git repositories (GHSA-j6cw-g6p4-7hch, CVE-2026-55797)
• MODERATE: Extension proxy RBAC ignores application namespace when applications-in-any-namespace is enabled (GHSA-g3ff-q88g-chrj)
• MODERATE: An oversized OCI manifest can exhaust repo-server memory (GHSA-w996-f2wq-x9c6)

Potentially-breaking changes

• Kustomize builds that render Helm charts no longer honor helmGlobals.configHome. Ordinary http, https, and oci chart repositories still work. Builds that depended on a Helm plugin registered from that directory will not (GHSA-fw5c-w8rc-j7fx).
• An OCI manifest larger than 4 MiB is now rejected (GHSA-w996-f2wq-x9c6).

Features

• 4469a33: feat(server): log username on login attempts (cherry-pick #29841 for 3.4) (#29860) (@argo-cd-cherry-pick-bot[bot])

Bug fixes

• e7225da: fix(cmp): clean up tgz stream temporary directories (#29148) (cherry-pick #29156 for 3.4) (#29775) (@argo-cd-cherry-pick-bot[bot])
• 4bc8085: fix(security): coordinated security fixes (release-3.4) (#30039) (@crenshaw-dev)
• f161802: fix(ui): manifest viewer jumpiness (#29691) (cherry pick 3.4) (#29726) (@crenshaw-dev)
• 54bb5b4: fix: cherry-pick #29737 (release-3.4) (#29765) (@blakepettersson)
• 9de021a: fix: use ObjectMeta in session login test (release-3.4) (#29918) (@crenshaw-dev)

Dependency updates

• 2e4811c: chore(deps): bump github.com/go-git/go-billy/v5 from 5.6.2 to 5.9.0 (cherry-pick #27847 for 3.4) (#29759) (@nmirasch)
• 9c3211c: chore(deps): bump go.opentelemetry.io/otel from 1.43 to 1.44 (release-3.4) (#29764) (@nmirasch)
• 08da64b: chore(deps): bump golang.org/x/crypto to 0.57.0 (release-3.4) (#29825) (@akhilnittala)
• 999b68c: chore(deps): bump up js-yaml from 4.3.1 to 4.3.2 (#30021) (@keithchong)

Full Changelog: v3.4.9...v3.4.10