argocd: update quay.io/argoproj/argocd Docker tag to v3.4.0 by renovate[bot] · Pull Request #409 · hashbang/gitops

renovate · 2026-05-01T13:02:43Z

This PR contains the following updates:

Package	Type	Update	Change
quay.io/argoproj/argocd	Kustomization	minor	`v3.3.8` → `v3.4.0`

Release Notes

argoproj/argo-cd (quay.io/argoproj/argocd)

`v3.4.0`

Compare Source

`v3.3.9`

Compare Source

[!IMPORTANT]
This release contains a security fix to a critical vulnerability: GHSA-3v3m-wc6v-x4x3

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.9/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.9/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

8178655: fix(server): Avoid error when attempting a second delete operation (cherry-pick #27495 for 3.3) (#27501) (@argo-cd-cherry-pick-bot[bot])
c89b3a9: fix(ui): prevent pod logs viewer crash on stale container index (cherry-pick #27553 for 3.3) (#27565) (@argo-cd-cherry-pick-bot[bot])
96107fe: fix: ApplicationSet DuckType Generator panics on non-string values in Clus… (cherry-pick #27265 for 3.3) (#27525) (@argo-cd-cherry-pick-bot[bot])
741a6f5: fix: put/get ocimetadata to/from redis cache (#27521) (cherry-pick #27589 for 3.3) (#27593) (@argo-cd-cherry-pick-bot[bot])

Documentation

5a3a892: docs: fix progressive sync since version to reflect beta promotion in v3.3.0 (cherry-pick #27608 for 3.3) (#27612) (@argo-cd-cherry-pick-bot[bot])

Dependency updates

0a2ba7c: chore(deps): bump SonarSource/sonarqube-scan-action from 7.0.0 to 8.0.0 (cherry pick #27602 to release-3.3) (#27610) (@dudinea)
184b8a9: chore(deps): bump go version to resolve CVEs (#27509) (@crenshaw-dev)

Other work

fd7ecb3: Merge commit from fork (@alexmt)

Full Changelog: argoproj/argo-cd@v3.3.8...v3.3.9

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-05-01T13:04:23Z

Infro diff for `4e378d5`

argocd.hashbang.sh > argocd (0 files changed)

Details

time="2026-05-05T10:01:07Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."
time="2026-05-05T10:01:22Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."

===== apps/Deployment argocd/argocd-applicationset-controller ======
--- /tmp/argocd-diff382919968/argocd-applicationset-controller-live.yaml
+++ /tmp/argocd-diff382919968/argocd-applicationset-controller
@@ -579,7 +579,7 @@
               key: applicationsetcontroller.status.max.resources.count
               name: argocd-cmd-params-cm
               optional: true
-        image: quay.io/argoproj/argocd:v3.3.4@sha256:9f68a9a360ff65aaca66dfccf675219be73f0ac8c5c96797b6cb7760ee1b9056
+        image: quay.io/argoproj/argocd:v3.4.0@sha256:5be87aa21b327b2acb388a22a73cafd26622632cab2f6c8f21d1eec1bdff2bbb
         imagePullPolicy: Always
         name: argocd-applicationset-controller
         ports:

===== apps/Deployment argocd/argocd-dex-server ======
--- /tmp/argocd-diff539370785/argocd-dex-server-live.yaml
+++ /tmp/argocd-diff539370785/argocd-dex-server
@@ -358,7 +358,7 @@
         - -n
         - /usr/local/bin/argocd
         - /shared/argocd-dex
-        image: quay.io/argoproj/argocd:v3.3.4@sha256:9f68a9a360ff65aaca66dfccf675219be73f0ac8c5c96797b6cb7760ee1b9056
+        image: quay.io/argoproj/argocd:v3.4.0@sha256:5be87aa21b327b2acb388a22a73cafd26622632cab2f6c8f21d1eec1bdff2bbb
         imagePullPolicy: Always
         name: copyutil
         resources: {}

===== apps/Deployment argocd/argocd-notifications-controller ======
--- /tmp/argocd-diff232632544/argocd-notifications-controller-live.yaml
+++ /tmp/argocd-diff232632544/argocd-notifications-controller
@@ -276,7 +276,7 @@
               key: notificationscontroller.repo.server.plaintext
               name: argocd-cmd-params-cm
               optional: true
-        image: quay.io/argoproj/argocd:v3.3.4@sha256:9f68a9a360ff65aaca66dfccf675219be73f0ac8c5c96797b6cb7760ee1b9056
+        image: quay.io/argoproj/argocd:v3.4.0@sha256:5be87aa21b327b2acb388a22a73cafd26622632cab2f6c8f21d1eec1bdff2bbb
         imagePullPolicy: Always
         livenessProbe:
           failureThreshold: 3

===== apps/Deployment argocd/argocd-redis ======
--- /tmp/argocd-diff1116064587/argocd-redis-live.yaml
+++ /tmp/argocd-diff1116064587/argocd-redis
@@ -260,7 +260,7 @@
         - argocd
         - admin
         - redis-initial-password
-        image: quay.io/argoproj/argocd:v3.3.4@sha256:9f68a9a360ff65aaca66dfccf675219be73f0ac8c5c96797b6cb7760ee1b9056
+        image: quay.io/argoproj/argocd:v3.4.0@sha256:5be87aa21b327b2acb388a22a73cafd26622632cab2f6c8f21d1eec1bdff2bbb
         imagePullPolicy: IfNotPresent
         name: secret-init
         resources: {}

===== apps/Deployment argocd/argocd-repo-server ======
--- /tmp/argocd-diff2100487782/argocd-repo-server-live.yaml
+++ /tmp/argocd-diff2100487782/argocd-repo-server
@@ -919,7 +919,7 @@
           value: /helm-working-dir
         - name: HELM_DATA_HOME
           value: /helm-working-dir
-        image: quay.io/argoproj/argocd:v3.3.4@sha256:9f68a9a360ff65aaca66dfccf675219be73f0ac8c5c96797b6cb7760ee1b9056
+        image: quay.io/argoproj/argocd:v3.4.0@sha256:5be87aa21b327b2acb388a22a73cafd26622632cab2f6c8f21d1eec1bdff2bbb
         imagePullPolicy: Always
         livenessProbe:
           failureThreshold: 3
@@ -992,7 +992,7 @@
         env:
         - name: GNUPGHOME
           value: /gnupg-home/.gnupg
-        image: quay.io/argoproj/argocd:v3.3.4@sha256:9f68a9a360ff65aaca66dfccf675219be73f0ac8c5c96797b6cb7760ee1b9056
+        image: quay.io/argoproj/argocd:v3.4.0@sha256:5be87aa21b327b2acb388a22a73cafd26622632cab2f6c8f21d1eec1bdff2bbb
         imagePullPolicy: IfNotPresent
         name: import-gpg-key
         resources: {}
@@ -1019,12 +1019,12 @@
         - mountPath: /custom-tools
           name: custom-tools
       - args:
-        - /bin/cp --update=none /usr/local/bin/argocd /var/run/argocd/argocd && /bin/ln
-          -s /var/run/argocd/argocd /var/run/argocd/argocd-cmp-server
+        - /bin/cp /usr/local/bin/argocd /var/run/argocd/argocd && /bin/ln -sf /var/run/argocd/argocd
+          /var/run/argocd/argocd-cmp-server
         command:
         - sh
         - -c
-        image: quay.io/argoproj/argocd:v3.3.4@sha256:9f68a9a360ff65aaca66dfccf675219be73f0ac8c5c96797b6cb7760ee1b9056
+        image: quay.io/argoproj/argocd:v3.4.0@sha256:5be87aa21b327b2acb388a22a73cafd26622632cab2f6c8f21d1eec1bdff2bbb
         imagePullPolicy: IfNotPresent
         name: copyutil
         resources: {}

===== apps/Deployment argocd/argocd-server ======
--- /tmp/argocd-diff1851747841/argocd-server-live.yaml
+++ /tmp/argocd-diff1851747841/argocd-server
@@ -903,7 +903,7 @@
               key: server.sync.replace.allowed
               name: argocd-cmd-params-cm
               optional: true
-        image: quay.io/argoproj/argocd:v3.3.4@sha256:9f68a9a360ff65aaca66dfccf675219be73f0ac8c5c96797b6cb7760ee1b9056
+        image: quay.io/argoproj/argocd:v3.4.0@sha256:5be87aa21b327b2acb388a22a73cafd26622632cab2f6c8f21d1eec1bdff2bbb
         imagePullPolicy: Always
         livenessProbe:
           failureThreshold: 3

===== apps/StatefulSet argocd/argocd-application-controller ======
--- /tmp/argocd-diff212902070/argocd-application-controller-live.yaml
+++ /tmp/argocd-diff212902070/argocd-application-controller
@@ -768,7 +768,7 @@
               optional: true
         - name: KUBECACHEDIR
           value: /tmp/kubecache
-        image: quay.io/argoproj/argocd:v3.3.4@sha256:9f68a9a360ff65aaca66dfccf675219be73f0ac8c5c96797b6cb7760ee1b9056
+        image: quay.io/argoproj/argocd:v3.4.0@sha256:5be87aa21b327b2acb388a22a73cafd26622632cab2f6c8f21d1eec1bdff2bbb
         imagePullPolicy: Always
         name: argocd-application-controller
         ports:

argocd.hashbang.sh > cloudnative-pg (0 files changed)

Details

time="2026-05-05T10:01:43Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."
time="2026-05-05T10:01:54Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."

===== coordination.k8s.io/Lease /db9c8771.cnpg.io ======
--- /tmp/argocd-diff993384486/db9c8771.cnpg.io-live.yaml
+++ /tmp/argocd-diff993384486/db9c8771.cnpg.io
@@ -0,0 +1,11 @@
+apiVersion: coordination.k8s.io/v1
+kind: Lease
+metadata:
+  annotations:
+    argocd.argoproj.io/tracking-id: cloudnative-pg:coordination.k8s.io/Lease:cloudnative-pg/db9c8771.cnpg.io
+  labels:
+    app.kubernetes.io/component: manager
+    app.kubernetes.io/instance: cloudnative-pg
+    app.kubernetes.io/name: cloudnative-pg
+  name: db9c8771.cnpg.io
+spec: {}

argocd.hashbang.sh > external-dns (0 files changed)

Details

time="2026-05-05T10:01:56Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."
time="2026-05-05T10:02:01Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."

===== apps/Deployment external-dns/external-dns ======
--- /tmp/argocd-diff1783897512/external-dns-live.yaml
+++ /tmp/argocd-diff1783897512/external-dns
@@ -172,11 +172,6 @@
         - --provider=aws
         - --txt-owner-id=digitalocean-hashbang
         - --txt-prefix=_owner.
-        - --source=crd
-        - --domain-filter=hashbang.sh
-        - --managed-record-types=A
-        - --managed-record-types=CNAME
-        - --managed-record-types=TXT
         env:
         - name: AWS_REGION
           value: us-west-2

argocd.hashbang.sh > keycloak (0 files changed)

Details

time="2026-05-05T10:02:20Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."
time="2026-05-05T10:02:24Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."

===== apps/Deployment keycloak/keycloak ======
--- /tmp/argocd-diff1189880012/keycloak-live.yaml
+++ /tmp/argocd-diff1189880012/keycloak
@@ -259,7 +259,7 @@
             name: keycloak-config-5k62mm682d
         - secretRef:
             name: keycloak-config-hmkt6446bt
-        image: quay.io/keycloak/keycloak:26.5.6@sha256:8d44614c74798322c4e07fbe0ecb15cfbb5879d69b484628555f58ade06f0d8c
+        image: quay.io/keycloak/keycloak:26.5.7@sha256:45ae20191531eb608ddb0b775d012b40d3e4f942697f3214694887dd7c108d13
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3

argocd.hashbang.sh > matterbridge (1 files changed)

Details

time="2026-05-05T10:02:26Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."
time="2026-05-05T10:02:30Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."

===== /ConfigMap matterbridge/matterbridge-config-d9mbk6kcbb ======
--- /tmp/argocd-diff4013116059/matterbridge-config-d9mbk6kcbb-live.yaml
+++ /tmp/argocd-diff4013116059/matterbridge-config-d9mbk6kcbb
@@ -1,94 +0,0 @@
-apiVersion: v1
-data:
-  matterbridge.toml: |
-    [irc.hashbang]
-    Server = "irc-internal.ircd.svc:6697"
-    Nick = "HashBot"
-    UseTLS = true
-    # because it uses internal traffic
-    SkipTLSVerify = true
-    Label = "h"
-    RemoteNickFormat = "{NICK}/{LABEL}"
-    NickServNick = "HashBot"
-    UseSASL = true
-    UseRelayMsg = true
-    # RELAYMSG barfs on non-ascii, but we can limit to just alphanumeric
-    StripNick = true
-
-    [irc.libera]
-    Server = "irc.libera.chat:6697"
-    Nick = "HashBot"
-    UseTLS = true
-    Label = "l"
-    RemoteNickFormat = "<{NICK}[{LABEL}]> "
-    NickServNick = "HashBot"
-    UseSASL = true
-
-    [matrix.main]
-    Server = "https://matrix.org"
-    Login = "HashBot"
-    Label = "m"
-    RemoteNickFormat = "<{NICK}[{LABEL}]> "
-    # Matterbridge no longer uses usernames, instead uses display names
-    # To re-enable:
-    # UseUsername = true
-    # NoHomeServerSuffix = false
-    HTMLDisable = true
-
-    [[gateway]]
-    name = "default"
-    enable = true
-
-    [[gateway.inout]]
-    account = "irc.hashbang"
-    channel = "#!"
-
-    [[gateway.inout]]
-    account = "irc.libera"
-    channel = "#!"
-
-    [[gateway.inout]]
-    account = "matrix.main"
-    channel = "#!:matrix.org"
-
-    [[gateway]]
-    name = "social"
-    enable = true
-
-    [[gateway.inout]]
-    account = "irc.hashbang"
-    channel = "#!social"
-
-    [[gateway.inout]]
-    account = "matrix.main"
-    channel = "#!social:matrix.org"
-kind: ConfigMap
-metadata:
-  annotations:
-    argocd.argoproj.io/tracking-id: matterbridge:/ConfigMap:matterbridge/matterbridge-config-d9mbk6kcbb
-    kubectl.kubernetes.io/last-applied-configuration: |
-      {"apiVersion":"v1","data":{"matterbridge.toml":"[irc.hashbang]\nServer = \"irc-internal.ircd.svc:6697\"\nNick = \"HashBot\"\nUseTLS = true\n# because it uses internal traffic\nSkipTLSVerify = true\nLabel = \"h\"\nRemoteNickFormat = \"{NICK}/{LABEL}\"\nNickServNick = \"HashBot\"\nUseSASL = true\nUseRelayMsg = true\n# RELAYMSG barfs on non-ascii, but we can limit to just alphanumeric\nStripNick = true\n\n[irc.libera]\nServer = \"irc.libera.chat:6697\"\nNick = \"HashBot\"\nUseTLS = true\nLabel = \"l\"\nRemoteNickFormat = \"\u003c{NICK}[{LABEL}]\u003e \"\nNickServNick = \"HashBot\"\nUseSASL = true\n\n[matrix.main]\nServer = \"https://matrix.org\"\nLogin = \"HashBot\"\nLabel = \"m\"\nRemoteNickFormat = \"\u003c{NICK}[{LABEL}]\u003e \"\n# Matterbridge no longer uses usernames, instead uses display names\n# To re-enable:\n# UseUsername = true\n# NoHomeServerSuffix = false\nHTMLDisable = true\n\n[[gateway]]\nname = \"default\"\nenable = true\n\n[[gateway.inout]]\naccount = \"irc.hashbang\"\nchannel = \"#!\"\n\n[[gateway.inout]]\naccount = \"irc.libera\"\nchannel = \"#!\"\n\n[[gateway.inout]]\naccount = \"matrix.main\"\nchannel = \"#!:matrix.org\"\n\n[[gateway]]\nname = \"social\"\nenable = true\n\n[[gateway.inout]]\naccount = \"irc.hashbang\"\nchannel = \"#!social\"\n\n[[gateway.inout]]\naccount = \"matrix.main\"\nchannel = \"#!social:matrix.org\"\n"},"kind":"ConfigMap","metadata":{"annotations":{"argocd.argoproj.io/tracking-id":"matterbridge:/ConfigMap:matterbridge/matterbridge-config-d9mbk6kcbb"},"labels":{"app.kubernetes.io/instance":"matterbridge"},"name":"matterbridge-config-d9mbk6kcbb","namespace":"matterbridge"}}
-  labels:
-    app.kubernetes.io/instance: matterbridge
-  managedFields:
-  - apiVersion: v1
-    fieldsType: FieldsV1
-    fieldsV1:
-      f:data:
-        .: {}
-        f:matterbridge.toml: {}
-      f:metadata:
-        f:annotations:
-          .: {}
-          f:argocd.argoproj.io/tracking-id: {}
-          f:kubectl.kubernetes.io/last-applied-configuration: {}
-        f:labels:
-          .: {}
-          f:app.kubernetes.io/instance: {}
-    manager: argocd-controller
-    operation: Update
-    time: "2023-12-18T05:41:46Z"
-  name: matterbridge-config-d9mbk6kcbb
-  namespace: matterbridge
-  resourceVersion: "358812223"
-  uid: c52f1764-70e9-4bce-9214-dce7a17ab970

argocd.hashbang.sh > wkd (0 files changed)

Details

time="2026-05-05T10:02:55Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."
time="2026-05-05T10:03:05Z" level=warning msg="Failed to invoke grpc call. Use flag --grpc-web in grpc calls. To avoid this warning message, use flag --grpc-web."

===== apps/Deployment wkd/wkd ======
--- /tmp/argocd-diff3367392115/wkd-live.yaml
+++ /tmp/argocd-diff3367392115/wkd
@@ -232,7 +232,7 @@
           value: enroll
         - name: FOLDER
           value: /tmp/keys
-        image: kiwigrid/k8s-sidecar:2.5.0@sha256:a6b3f707f883108376514489a94d6629109a327b2978e1d826cd104c4ca436df
+        image: kiwigrid/k8s-sidecar:2.6.0@sha256:a6c101156d42ef1050c536fcbcc03bf314544a63ee2daafe45280bc8dbab398f
         imagePullPolicy: IfNotPresent
         name: watcher
         resources: {}

argocd: update quay.io/argoproj/argocd Docker tag to v3.4.0

3292bc8

renovate Bot changed the title ~~argocd: update quay.io/argoproj/argocd Docker tag to v3.3.9~~ argocd: update quay.io/argoproj/argocd Docker tag to v3.4.0 May 5, 2026

renovate Bot force-pushed the renovate/quay.io-argoproj-argocd-3.x branch from e195a83 to 3292bc8 Compare May 5, 2026 10:00

daurnimator merged commit 91b43cb into master May 5, 2026
1 check passed

daurnimator deleted the renovate/quay.io-argoproj-argocd-3.x branch May 5, 2026 10:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

argocd: update quay.io/argoproj/argocd Docker tag to v3.4.0#409

argocd: update quay.io/argoproj/argocd Docker tag to v3.4.0#409
daurnimator merged 1 commit intomasterfrom
renovate/quay.io-argoproj-argocd-3.x

renovate Bot commented May 1, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 1, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v3.4.0

v3.3.9

Quick Start

Non-HA:

HA:

Release Signatures and Provenance

Release Notes Blog Post

Upgrading

Changelog

Bug fixes

Documentation

Dependency updates

Other work

Configuration

Uh oh!

github-actions Bot commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Infro diff for 4e378d5

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented May 1, 2026 •

edited

Loading

`v3.4.0`

`v3.3.9`

github-actions Bot commented May 1, 2026 •

edited

Loading

Infro diff for `4e378d5`