v0.8.0

New Features

  • Added argocd-agent support: principal and agent run from the module’s own images, argocd-agentctl binaries for linux and darwin are available for download from the Argo CD UI
  • Enabled running multiple argocd-operator replicas on clusters with high availability mode enabled: three replicas with anti-affinity and a PodDisruptionBudget
  • Aligned CRDs with the component versions Argo CD v3.4.4, argocd-operator v0.18.0 and argocd-image-updater v1.2.2; added the name field to AppProject clusterResourceWhitelist and clusterResourceBlacklist
  • Added the ability to use the redis image from the user-authn module

Bug Fixes

  • Updated the Argo Rollouts UI extension to v0.4.0 and installed it from the module’s own image without access to external resources
  • Moved the ArgoCDExport job to rclone in the module’s own argocd-operator-util image instead of cloud-specific CLIs, the storage secret format is unchanged
  • Enabled NamespaceManagement resource reconciliation for namespace-scoped Argo CD instances
  • Added a system gitconfig with the git-lfs filter to the argocd image
  • Applied default annotations to the Argo CD server Ingress: force-ssl-redirect, backend-protocol depending on spec.server.insecure and rate limits limit-rpm 3000 and limit-connections 300; user annotations are merged over the defaults instead of replacing them
  • Enabled TLS and ssh host key verification for argocd-image-updater git write-back by default, disabling it requires an explicit insecure: “true” in the credentials secret
  • Fixed file descriptor leaks and nil dereferences in Argo CD, helm, kustomize and git-lfs found by static analysis and fuzz tests
  • Fixed a kustomize hang on manifests with repeated null keys and the loss of previous resource IDs when the previous namespace is empty
  • Dropped whitespace-only documents from the helm manifest list
  • Fixed the operator VerticalPodAutoscaler condition: check that the vertical-pod-autoscaler module is enabled

Security Fixes

  • Fixed vulnerabilities:
    • Argo CD
      • CVE-2026-53493
      • CVE-2026-53495
      • CVE-2026-55797
      • CVE-2026-56851
      • CVE-2026-56857
      • CVE-2026-56866
      • CVE-2026-77459
      • CVE-2026-78659
      • CVE-2026-78660
      • CVE-2026-78663
      • CVE-2026-78667
      • CVE-2026-78669
      • CVE-2026-81870
      • CVE-2026-84445
      • CVE-2026-85731
      • CVE-2026-85732
      • CVE-2026-94439
      • CVE-2026-94440
      • CVE-2026-94448
      • CVE-2026-95838
      • CVE-2026-97030
      • CVE-2026-97031
      • CVE-2026-97032
    • Argo CD Image Updater
      • CVE-2026-56857
      • CVE-2026-56866
      • CVE-2026-78659
      • CVE-2026-78660
      • CVE-2026-78663
      • CVE-2026-78667
      • CVE-2026-78669
      • CVE-2026-81870
      • CVE-2026-84445
      • CVE-2026-85731
      • CVE-2026-85732
      • CVE-2026-85747
      • CVE-2026-94439
      • CVE-2026-94440
      • CVE-2026-94448
      • CVE-2026-97030
      • CVE-2026-97031
      • CVE-2026-97032
    • Argo CD Operator
      • CVE-2026-56857
      • CVE-2026-56866
      • CVE-2026-78659
      • CVE-2026-78660
      • CVE-2026-78663
      • CVE-2026-78667
      • CVE-2026-78669
      • CVE-2026-84445
      • CVE-2026-85731
      • CVE-2026-85732
      • CVE-2026-94439
      • CVE-2026-94440
      • CVE-2026-94448
      • CVE-2026-97030
      • CVE-2026-97031
      • CVE-2026-97032
    • Argo CD Agent
      • GO-2026-5932 (VEX)
    • Argo CD Operator Util
      • GO-2026-5932 (VEX)
    • go-hooks
      • CVE-2026-85747 (VEX)
  • Minimized the argocd-operator ClusterRole to least privilege: removed OpenShift, daemonsets, impersonate and wildcard rules
  • Bound argocd-operator metrics to localhost only
  • Restricted the argocd-agent principal redis proxy and resource proxy by NetworkPolicy to the instance components, the redis proxy requires AUTH before serving commands
  • Served argocd-agent healthz on a dedicated mux instead of http.DefaultServeMux and pinned the agent health check port to the declared healthz port

Chore

  • Improved the Russian translation of the Application, ApplicationSet, AppProject and ArgoCDExport CRDs
  • Removed unused component image and version fields from CRDs
  • Added argocd-operator conversion webhook fuzz tests, moved helm and kustomize fuzz tests to the new build scheme
  • Migrated the build to werf v3, moved the Argo CD UI build image from node-alpine to distroless

v0.7.0

New Features

  • Serve argocd bianries for darwin and windows platforms

Security Fixes

  • Resolved CVE-2026-56855, CVE-2026-78662, CVE-2026-84304 by updating vulnerable dependencies

v0.6.0

New Features

  • Argo CD instance cluster domain auto-detect support

Bug Fixes

  • Updated argocd .spec.rbac.defaultPolicy description

Security Fixes

  • Resolved CVE-2026-56854 in argocd, helm, git-lfs, argocd-operator, argocd-image-updater and go-hooks by updating golang.org/x/crypto to v0.55.0

Chore

  • Improved CRDs Russian translation

v0.5.2

Security Fixes

  • Fixed high severity vulnerabilities: CVE-2026-39821, CVE-2026-46600
  • Fixed unrated vulnerabilities: CVE-2026-33818, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862, CVE-2026-56864, CVE-2026-56865

v0.5.1

Security Fixes

  • Fixed high severity vulnerabilities: CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-50151, CVE-2026-50163, CVE-2026-53488, CVE-2026-56852
  • Fixed medium severity vulnerabilities: CVE-2026-25680, CVE-2026-39827, CVE-2026-39833, CVE-2026-39834, CVE-2026-42502, CVE-2026-42506, CVE-2026-46598, CVE-2026-47262, CVE-2026-50162, GHSA-vh4v-2xq2-g5cg
  • Fixed low severity vulnerability: CVE-2026-48978
  • Fixed unrated vulnerabilities: CVE-2026-39824, CVE-2026-46600, GO-2026-5932

v0.5.0

New Features

  • Enforced restricted pss policy with action deny

Security Fixes

  • Fixed GHSA-hrxh-6v49-42gf GHSA-gcjh-h69q-9w9g

Chore

  • Migrate module documentation to DKP guides section

v0.4.17

Security Fixes

  • Fixed all cves
  • Marked golang.org/x/crypto/openpgp as vulnerable_code_not_in_execute_path

v0.4.16

Chore

  • Added subsystems to module.yaml

v0.4.15

Security Fixes

  • Fixed all cves
  • Updated vex files
  • Fixed all critical svace detects

Chore

  • Added template for vex attestation

v0.4.14

Bug Fixes

  • Fixed missing binaries

v0.4.13

Bug Fixes

  • Resolved issue with dex authentification

v0.4.12

Security Fixes

  • Fixed vex files

Chore

  • Updated templates for cse edition

v0.4.11

New Features

  • Upgraded argocd-operator to v0.18.0

Bug Fixes

  • Updated imageupdater crd to actual version

Security Fixes

  • Fixed critical CVE-2026-42880
  • Updated vex files

Chore

  • Moved CRD files to root crds directory and update threat model
  • Updated base images
  • Fixed git error while building argocd image
  • Added namespace template for d8-operator-argo
  • Updated go hooks

v0.4.10

New Features

  • Extend default resource exclusion list to minimize kubeapi load in the case of SDS module usage

v0.4.9

New Features

  • Updated argo-cd version to v3.3.9

Security Fixes

  • Fixed CVE-2026-42880

v0.4.8

Bug Fixes

  • Added missing clusterDomain

Security Fixes

  • Fixed critical CVE-2026-33186
  • Added vex for CVE-2025-15558
  • Fixed CVE-2026-39883 CVE-2026-24051 CVE-2026-34986

v0.4.7

Bug Fixes

  • Migrate argocd instances’ service monitors to d8-operator-argo namespace
  • Added heritage deckhouse labels to d8-operator-argo namespace

Security Fixes

  • Fixed critical CVE-2026-33186

v0.4.6

New Features

  • Expose metrics to the platform Prometheus instance automatically

Bug Fixes

  • Correct CRD CA certificate injection
  • Correct Go hooks certificate injection logic
  • Removed stale ensure-CRD hook

Chore

  • Updated CRDs
  • Added examples for creating local Argo CD users
  • Added examples for Argo CD RBAC policies
  • Added ingressClassName to Argo CD examples
  • Added examples of using a self-signed certificate for Dex
  • Moved imagePullSecret from Deployment to ServiceAccount

v0.4.5

Security Fixes

  • Fixed critical CVE-2025-68121
  • Fixed CVE-2025-68121 CVE-2025-61728 CVE-2025-61729 CVE-2025-61730 CVE-2025-68121 CVE-2025-68156 CVE-2025-61726
  • Added vex for CVE-2026-25934

Chore

  • Updated base images
  • Rewrite python hooks on go
  • Fixed dmt lint issues

v0.4.4

Bug Fixes

  • Fixed missing ssh

v0.4.3

Bug Fixes

  • Fixed missing entrypoint.sh

v0.4.2

Bug Fixes

  • Fixed ArgoCD repo-server runtime issues in distroless image (cp, uid_entrypoint.sh, ssh known_hosts)

v0.4.1

Security Fixes

  • Resolved multiple license vulnerabilities

Chore

  • Updated base images to distroless
  • Refactor ArgoCD authentication documentation

v0.4.0

New Features

  • Added HA

Chore

  • Updated examples in docs

v0.3.14

Chore

  • Fixed changelog
  • Added SE+ edition

v0.3.13

Security Fixes

  • Fixed vulnerabilites CVE-2025-47933, CVE-2025-55190, CVE-2024-25621, CVE-2025-64329, CVE-2025-5187, CVE-2025-47912, CVE-2025-58183, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-61724, CVE-2025-58185, CVE-2025-58189, CVE-2025-61723, CVE-2025-61725, CVE-2025-47914, CVE-2025-58181

Chore

  • Updated base images