chore(deps): update minor and patch updates

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
argocd		minor	v3.2.5 → v3.3.3
ghcr.io/astral-sh/uv	stage	minor	0.9.25 → 0.10.9
helm		minor	v3.19.5 → v3.20.1
helm		minor	3.19.5 → 3.20.1
kubectl		patch	1.35.0 → 1.35.2
kyverno		minor	1.16.2 → 1.17.1
sops		minor	v3.11.0 → v3.12.1
sops		minor	3.11.0 → 3.12.1
uv		minor	0.9.25 → 0.10.9

---

Release Notes

argoproj/argo-cd (argocd)

v3.3.3

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.3/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.3/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• 6224d67: fix(actions): Use correct annotation for CNPG suspend/resume (cherry-pick #​26711 for 3.3) (#​26727) (@​argo-cd-cherry-pick-bot[bot])
• 968c633: fix(controller): handle comma-separated hook annotations for PreDelete/PostDelete hooks (cherry-pick #​26420 for 3.3) (#​26586) (@​argo-cd-cherry-pick-bot[bot])
• 4411801: fix(health): use note.drySha when available (cherry-pick #​26698 for 3.3) (#​26750) (@​argo-cd-cherry-pick-bot[bot])
• 3d3760f: fix(ui): standard resource icons are not displayed properly.#​26216 (cherry-pick #​26228 for 3.3) (#​26380) (@​argo-cd-cherry-pick-bot[bot])
• c6df35d: fix: consistency of kubeversion with helm version 3 3 (#​26744) (@​ppapapetrou76)
• 5e19021: fix: multi-level cross-namespace hierarchy traversal for cluster-scop… (#​26640) (@​agaudreault)

Other work

• c61c593: chore: use base ref for cherry-pick prs (cherry-pick #​26551 for 3.3) (#​26553) (@​argo-cd-cherry-pick-bot[bot])

Full Changelog: argoproj/argo-cd@v3.3.2...v3.3.3

v3.3.2

Compare Source

[!IMPORTANT]
Before upgrading all types of Argo CD installations to this release, please read the upgrade guide first:
https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/3.2-3.3/#breaking-changes

Upgrading Argo CD which is managing itself

Users who have an Argo CD Application that manages their Argo CD installation, must enable ServerSideApply=true sync option on this Application in order for the upgrade to succeed.

The issue with failed to perform client-side apply migration that existed on version 3.3.0 and 3.3.1 has been solved in this release: #​26279

For users who have previously upgraded to Argo CD 3.3.0or 3.3.1 and applied the temporary remediation of ClientSideApplyMigration=false sync option on the Application that manages their Argo CD, are required to remove this setting to restore the default behavior of performing the migration.
The reason for removing the ClientSideApplyMigration=false sync option is that it may cause conflicts between Argo CD K8s field manager and other field managers at a later point in time.

More details here:
https://argo-cd.readthedocs.io/en/stable/user-guide/sync-options/#client-side-apply-migration

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.2/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.2/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• 67c2319: fix: use csapgrade to patch managedFields for client-side apply migration (cherry-pick #​26289 for 3.3) (#​26516) (@​argo-cd-cherry-pick-bot[bot])

Documentation

• 1bf62ae: docs: instruct to enable ClientSideApplyMigration in 3.3.2 (cherry-pick #​26547 for 3.3) (#​26549) (@​argo-cd-cherry-pick-bot[bot])

Full Changelog: argoproj/argo-cd@v3.3.1...v3.3.2

v3.3.1

Compare Source

[!IMPORTANT]
Before upgrading all types of Argo CD installations to this release, please read the upgrade guide first:
https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/3.2-3.3/#breaking-changes

Upgrading Argo CD which is managing itself

Users who have an Argo CD Application that manages their Argo CD installation, must enable ServerSideApply=true sync option on this Application in order for the upgrade to succeed.

In some cases, there may be a sync error like Failed to perform client-side apply migration: failed to perform client-side apply migration on manager kubectl-client-side-apply.

We are currently working on a long-term fix to this issue, the progress can be tracked here: #​26279

A temporary remediation is to additionally set the ClientSideApplyMigration=false sync option on this Application. This solution is temporary and not recommended for the long run because it may result in conflicts between Argo CD K8s field manager and other field managers at a later point in time, and if you use it, you will need to remove it after the above issue is fixed.

More details here:
https://argo-cd.readthedocs.io/en/stable/user-guide/sync-options/#client-side-apply-migration

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.1/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.1/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• 8449d9a: fix(server): OIDC config via secrets fails (#​18269) (cherry-pick #​26214 for 3.3) (#​26423) (@​argo-cd-cherry-pick-bot[bot])
• d0b2a6c: fix: Fix excessive ls-remote requests on monorepos with Auto Sync enabled apps (26277) (cherry-pick #​26278 for 3.3) (#​26372) (@​argo-cd-cherry-pick-bot[bot])
• e464f6a: fix: AppProject finalizer should consider apps in all allowed namespaces (#​24347) (cherry-pick #​26416 for 3.3) (#​26480) (@​argo-cd-cherry-pick-bot[bot])
• 445916f: fix: compressedLayerExtracterStore+isCompressedLayer - allow tar.gzip suffixes (cherry-pick #​26355 for 3.3) (#​26376) (@​argo-cd-cherry-pick-bot[bot])

Dependency updates

• 6126798: chore(deps): Upgrade Kustomize to 5.8.1 (cherry-pick #​26367 for 3.3) (#​26369) (@​argo-cd-cherry-pick-bot[bot])

Other work

• 92df21c: chore(appset): cherry-pick basic progressive sync e2e tests (#​26092) (#​26191) (@​ranakan19)
• 4b0a2c0: chore: bumps ubuntu base docker image to 25.10 (cherry-pick #​25758 for 3.3) (#​26436) (@​argo-cd-cherry-pick-bot[bot])
• 273683b: chore: placate Sonar by ignoring testdata files (cherry-pick #​26371 for 3.3) (#​26377) (@​argo-cd-cherry-pick-bot[bot])
• 8df5e96: test(e2e): CMP test fails locally on Mac (cherry-pick #​25901 for 3.3) (#​26340) (@​argo-cd-cherry-pick-bot[bot])
• 2449314: test(e2e): add isolation by ensuring unique name (cherry-pick #​25724 for 3.3) (#​26287) (@​ranakan19)
• c4f0cd3: test(e2e): configurable tmp dir locally (#​25780) (#​26339) (@​ranakan19)
• 55d0d09: test(e2e): fix TestDeletionConfirmation flakiness (cherry-pick #​25902 for 3.3) (#​26284) (@​argo-cd-cherry-pick-bot[bot])
• 6f270cc: test(e2e): oras binary not found locally if not installed in path (cherry-pick #​25751 for 3.3) (#​26337) (@​argo-cd-cherry-pick-bot[bot])
• 54f2916: test(e2e): unstable CMP e2e test when running locally (cherry-pick #​25752 for 3.3) (#​26288) (@​argo-cd-cherry-pick-bot[bot])
• 0038fce: test(e2e): update local certs so they are valid on MacOS (cherry-pick #​25864 for 3.3) (#​26338) (@​argo-cd-cherry-pick-bot[bot])

Full Changelog: argoproj/argo-cd@v3.3.0...v3.3.1

v3.3.0

Compare Source

[!IMPORTANT]
Before upgrading all types of Argo CD installations to this release, please read the upgrade guide first:
https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/3.2-3.3/#breaking-changes

Upgrading Argo CD which is managing itself

Users who have an Argo CD Application that manages their Argo CD installation, must enable ServerSideApply=true sync option on this Application in order for the upgrade to succeed.

In some cases, there may be a sync error like Failed to perform client-side apply migration: failed to perform client-side apply migration on manager kubectl-client-side-apply.

We are currently working on a long-term fix to this issue, the progress can be tracked here: #​26279

A temporary remediation is to additionally set the ClientSideApplyMigration=false sync option on this Application. This solution is temporary and not recommended for the long run because it may result in conflicts between Argo CD K8s field manager and other field managers at a later point in time, and if you use it, you will need to remove it after the above issue is fixed.

More details here:
https://argo-cd.readthedocs.io/en/stable/user-guide/sync-options/#client-side-apply-migration

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.0/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.0/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post.

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Features

• ce2fb70: Revert "feat: Ability to create custom labels for namespaces created … (#​455) (@​pasha-codefresh)
• e50dd00: feat(actions): Add cloudnativepg reload, restart, promote, suspend and resume actions (#​24192) (@​rouke-broersma)
• 3ee16c0: feat(actions): PullRequest merge action (#​24823) (@​crenshaw-dev)
• 0c77f3c: feat(actions): add icons to apps actions (#​25343) (#​25344) (@​rickbrouwer)
• a64933f: feat(actions): add pause action for KEDA ScaledObject and ScaledJob (#​25301) (#​25302) (@​rickbrouwer)
• 97d50a1: feat(appset): add pprof endpoints (#​25044) (@​rumstead)
• 482440b: feat(appset): use clone instead of replace on sprig templates to reduce function copies (#​25576) (@​rumstead)
• 64421a7: feat(ci): add run failure link to cherry pick comment (#​24838) (@​crenshaw-dev)
• 4678361: feat(cli): Add additional examples to proj list command (#​25169) (@​onasser1)
• ac12ab9: feat(cli): Updated CLI to show Plugins during tab completion (#​24758) (@​christianh814)
• 53c3542: feat(cli): add powershell completion (#​25595) (@​onasser1)
• f866959: feat(cli): added support for filtering by group in app get-resource CLI command (#​25495) (@​sabre1041)
• ac1a2f8: feat(health): add grafana-org-operator Health (#​25662) (@​sathieu)
• 0c6fa28: feat(hydrator): add inline parameter support to Source Hydrator (#​24228) (#​24277) (@​sangyeong01)
• dea7ead: feat(hydrator): avoid unnecessary repo-server calls (#​25150) (@​pbhatnagar-oss)
• 6cd30d3: feat(hydrator): don't push commits if manifests don't change (#​25056) (@​pbhatnagar-oss)
• fe02a8f: feat(redis): Secrets credentials via volume mount (#​24597) (@​Mangaal)
• bbc3e99: feat(repo): add support for github app authentication without installationid (#​25339) (#​25374) (@​pbhatnagar-oss)
• 1ae13b2: feat(ui): conditionally render app view extensions (#​25132) (@​jwinters01)
• afaf16b: feat(ui): hide sync option 'replace' if sync with replace is disabled in the server (issue no. #​22625) (#​22647) (@​jan-mrm)
• 528482c: feat(ui): implement abstraction layer for appset ui support (#​24916) (@​pjiang-dev)
• b74c7aa: feat(ui): improve sync warnings (#​25524) (@​jwinters01)
• 90b3e85: feat(ui): support custom icons (#​20864) (@​crenshaw-dev)
• a56a803: feat: Ability to create custom labels for namespaces created with syncOptions CreateNamespace (#​443) (@​pasha-codefresh)
• 9ab0b2e: feat: Add ability to hide certain annotations on secret resources (#​577) (@​svghadi)
• 9ee5cca: feat: Add health check for Ceph CRD (#​24111) (@​afarbos)
• 51c9add: feat: Add health checks for ServiceBinding and ServiceInstance (#​25007) (@​dzahariev)
• 8c890d4: feat: Add impersonation support for App finalizer deletion (#​24524) (@​ccjette-logmein)
• ed537d5: feat: Add path flag to ArgoCD CLI app list (#​24834) (@​onasser1)
• 1c4ef33: feat: Add server-side apply manager config (#​418) (@​leoluz)
• 7493226: feat: Add support for HPA v2 (autoscaling/v2) (#​411) (@​EppO)
• 1a6973a: feat: Add the ability to not autogenerate external URLs from ingress object (#​13705) (#​25383) (@​rkevin-arch)
• ed7c77a: feat: Apply out of sync option only (#​533) (@​pasha-codefresh)
• d65e9d9: feat: Enable SkipDryRunOnMissingResource sync option on Application level (#​712) (@​pasha-codefresh)
• aba3819: feat: Implement Server-Side Diffs (#​522) (@​leoluz)
• 6b2984e: feat: More optimal IterateHierarchyV2 and iterateChildrenV2 [#​600] (#​601) (@​andrii-korotkov-verkada)
• 4eb3ca3: feat: Namespace/CRD creation should happen before PreSync phase (#​159) ( <>)
• 3bf3d8a: feat: PreDelete hooks support (Issue #​13975) (#​22288) (@​pedro-cs-ribeiro)
• 5fd9f44: feat: Prune resources in reverse of sync wave order (#​538) (@​svghadi)
• e360551: feat: Support for retries when building up cluster cache (#​374) (@​jannfis)
• e56739c: feat: add CreateResource to kubectl (#​12174 and #​4116) (#​516) (@​reggie-k)
• 0b4199b: feat: add FindResources method that allows to find any resource in cache (#​204) ( <>)
• f9456de: feat: add GvkParser in cluster cache (#​404) (@​leoluz)
• 1b08fd1: feat: add ability to use shallow clone for repositories (#​24931) (@​alexmt)
• d8b1a12: feat: add basic support for server-side apply (#​363) (@​sathieu)
• bfac3f5: feat: add creation timestamp (#​87) (@​taisho6339)
• 9664cf8: feat: add profile feature for agent, and fix logr's panic (#​444) (@​alswl)
• f6f1a42: feat: add status.resourcesCount field to appset and change limit default (#​24698) (@​alexmt)
• c7bab2e: feat: add support split yaml that return actual yamls (#​346) (@​pasha-codefresh)
• ed70eac: feat: add sync delete option (#​507) (@​gdsoumya)
• aae8ded: feat: added cascade option to DeleteResource - argo-cd #​5368 (#​220) (@​ishitasequeira)
• 0000f05: feat: adds various OCI metrics (#​25493) (@​ppapapetrou76)
• e77acec: feat: allow limiting clusterResourceWhitelist by resource name (#​12208) (#​24674) (@​crenshaw-dev)
• 09e5225: feat: application resource deletion protection (#​630) (@​alexmt)
• 69dfa70: feat: auto migrate kubectl-client-side-apply fields for SSA (#​727) (@​pjiang-dev)
• 187312f: feat: auto respect rbac for discovery/sync (#​532) (@​gdsoumya)
• bc9ce57: feat: better error message for sync operations (#​336) (@​pasha-codefresh)
• 9163758: feat: cluster cache should expose synchronization error (#​32) ( <>)
• ae94ad9: feat: configurable watch resync timeout. ability to disable cluster resync (#​353) (@​jessesuen)
• 3c54508: feat: create namespace (#​94) (@​mayzhang2000)
• ddce93c: feat: cross namespace hierarchy traversal from cluster-scoped parents to namespaced children (fixes #​24379) (#​24847) (@​jcogilvie)
• 92a3433: feat: detect PVC StatefulSet ownership (#​112) ( <>)
• 4ea93db: feat: enable forks to release and publish to custom quay registries (#​25365) (@​reggie-k)
• ddc92c9: feat: expose APIGroups in GetClusterInfo (#​283) ( <>)
• 762cb1b: feat: expose all kubernetes resources in cluster info (#​337) ( <>)
• 8aefb18: feat: expose cluster sync retry timeout (#​373) (@​yeya24)
• e58bdf2: feat: implement KEDA scaledJob health-checks (#​25106) (@​rickbrouwer)
• cd2e16d: feat: implement gitops-agent (#​37) ( <>)
• 605958d: feat: improve memory consumption limiting (#​100) (@​ash2k)
• 344b1bc: feat: improve sync operation messages (#​84) ( <>)
• cfdefa4: feat: introduce SyncWaveHook callbacks invoked after applying each sync wave (#​177) (@​jessesuen)
• 5c6aa59: feat: oidc background token refresh (#​23727) (@​devopsjedi)
• 82f0935: feat: prune last (#​203) (@​mayzhang2000)
• c0c2dd1: feat: retry with client side dry run if server one was failed (#​548) (@​pasha-codefresh)
• c617562: feat: return images from resources when sync occurs (#​642) (@​Aaron-9900)
• 7669da6: feat: split refresh button with dropdown for hard refresh (#​25445) (@​choejwoo)
• 89ddd0d: feat: support 'Replace=true' sync option (#​246) ( <>)
• 11d47a6: feat: support configuring cluster cache re-sync timeout (#​107) ( <>)
• 723667d: feat: support exiting early from IterateHierarchy method (#​388) (@​alexmt)
• e8cfb83: feat: support limiting number of concurrent k8s list queries (#​55) ( <>)
• a4c77d5: feat: support managing cluster resources in a namespaced mode (#​297) ( <>)
• 1ce2acc: feat: support replace strategy for CRD (#​252) ( <>)
• 89cb483: feat: support resource prune propagation policy (#​235) ( <>)
• ff6e9f8: feat: support resource pruning in gitops-agent (#​45) ( <>)
• fbecbb8: feat: sync-options annotation with Force=true (#​414) (#​560) (@​kkk777-7)
• 026d10e: feat: syncing to a different revision requires override privilege (#​22858) (@​schraax)
• 552ad1c: feat: update unpause fast/gradual actions for Numaplane rollouts (#​24545) (@​dpadhiar)
• 90979fe: feat: use Kubernetes v1.18.6 libraries (#​102) (@​ash2k)
• 1301eaa: feat: use different env variable to control server side K8s API call timeout (#​25271) (@​ppapapetrou76)

Bug fixes

• f3ae26b: fix(actions): enable pause action so deployment can be paused (#​25394) (#​25395) (@​rickbrouwer)
• 15568cb: fix(appset): do not trigger reconciliation on appsets not part of allowed namespaces when updating a cluster secret (cherry-pick #​25622 for 3.3) (#​25909) (@​argo-cd-cherry-pick-bot[bot])
• e582975: fix(appset): ensure finalizer is added when deletionOrder is set as reverse (#​25125) (@​ranakan19)
• 40e9a06: fix(appset): handle pre/post delete hook finalizers conflicts (#​25539) (@​agaudreault)
• c377101: fix(appset): progressive sync loop when application has sync errors (#​24507) (@​agaudreault)
• d78929e: fix(cluster): reduce lock contention on cluster initialization (#​660) (@​crenshaw-dev)
• adb68bc: fix(clusterCache): don't miss finding live obj if obj is cluster-scoped and namespacedResources is in transition (#​597) (@​ncdc)
• e181fbb: fix(cmp): fix plugins not having access to argocd cli for git ASKPASS (#​24665) (@​zachaller)
• ef5b778: fix(health): incorrect reason in PullRequest script (#​24826) (@​crenshaw-dev)
• 2849f53: fix(health): typo in PromotionStrategy health.lua (@​crenshaw-dev)
• 7c0f032: fix(health): update crossplane healthchecks (#​25386) (@​jonasz-lasut)
• 28ec26a: fix(health): use promotion resource Ready condition regardless of reason (#​24971) (@​crenshaw-dev)
• dab4cc0: fix(hooks): always remove finalizers on create if hook exists (#​770) (@​agaudreault)
• b52a075: fix(hydrator): .gitattributes include deeply nested files (#​25870) (cherry-pick #​26011 for 3.3) (#​26013) (@​argo-cd-cherry-pick-bot[bot])
• a2659e9: fix(hydrator): appset should preserve annotation when hydration is requested (#​25644) (@​agaudreault)
• 48a9dcc: fix(hydrator): empty links for failed operation (#​25025) (cherry-pick #​26014 for 3.3) (#​26018) (@​argo-cd-cherry-pick-bot[bot])
• fe0466d: fix(hydrator): git fetch needs creds (#​25727) (cherry-pick #​25738 for 3.3) (#​25742) (@​argo-cd-cherry-pick-bot[bot])
• 393cb97: fix(hydrator): hydrated sha missing on no-ops (#​25694) (cherry-pick #​25695 for 3.3) (#​25697) (@​argo-cd-cherry-pick-bot[bot])
• 0fa47b1: fix(hydrator): pass destination.namespace to manifest rendering (#​25478) (cherry-pick #​25699 for 3.3) (#​26019) (@​argo-cd-cherry-pick-bot[bot])
• 708c636: fix(hydrator): race when pushing notes (cherry-pick #​25700 for 3.3) (#​25709) (@​argo-cd-cherry-pick-bot[bot])
• 05b4169: fix(metrics): more consistent oci metrics (cherry-pick #​25549 for 3.3) (#​25728) (@​argo-cd-cherry-pick-bot[bot])
• ed983d8: fix(oci): loosen up layer restrictions (#​24640) (@​blakepettersson)
• 5efb184: fix(oidc): check userinfo endpoint in AuthMiddleware (#​23586) (@​the-technat)
• 7921242: fix(server): Dry run always in client mode just for yaml manifest validation even with server side apply (#​564) (@​anandf)
• 7430650: fix(server): ensure resource health status is inferred on application retrieval (#​24832) (#​24851) (@​vr009)
• 20604f1: fix(server): update resourceVersion on Terminate retry (cherry-pick [#​25650](https://redirect.github.com/argoproj/argo-cd/issu