⚠️ Breaking Change
Impact Score: 7/10
Argo CD v2.3.7 — Release Notes & Engineering Impact
Source available — automated, not human-reviewed
Component: argocd · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
Breaking-change evidence from the source
- docs: add OpenSSH breaking change notes (#10104)
⚡ Executive Summary (TL;DR)
Argo CD v2.3.7. Source highlight: kubectl create namespace argocd
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
⚠️ Breaking Changes & Deprecations (1)
- - docs: add OpenSSH breaking change notes (#10104)
✨ New Features & Capabilities (1)
- docs: add OpenSSH breaking change notes (#10104)
🔧 Bug Fixes & Patches (6)
- fix: skip redirect url validation when it's the base href (#10058) (#10116)
- fix: upgrade moment from 2.29.2 to 2.29.3 (#9330)
- fix: avoid CVE-2022-28948 (#10093)
- fix: use serviceaccount name instead of struct (#9614)
- fix: create serviceaccount token for v1.24 clusters (#9546)
- chore: upgrade moment to latest version to fix CVE (#9005)
📄 View Raw Release Notes (Original Developer Log)
## Quick Start
### Non-HA:
```bash
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.3.7/manifests/install.yaml
```
### HA:
```bash
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.3.7/manifests/ha/install.yaml
```
### Notes
This is mainly a security related release and updates compatibility with Kubernetes 1.24.
**Attention:** The base image for 2.3.x reached end-of-life on July 14, 2022. This release upgraded the base image to Ubuntu 22.04 LTS. The change should have no effect on the majority of users. But if any of your git providers only supports now-deprecated key hash algorithms, then Application syncing might break. See the [2.2-to-2.3 upgrade notes](https://argo-cd.readthedocs.io/en/latest/operator-manual/upgrading/2.2-2.3/#support-for-private-repo-ssh-keys-using-the-sha-1-signature-hash-algorithm-is-removed-in-237) for details and workaround instructions.
### Bug fixes
- fix: skip redirect url validation when it's the base href (#10058) (#10116)
- fix: upgrade moment from 2.29.2 to 2.29.3 (#9330)
- fix: avoid CVE-2022-28948 (#10093)
- fix: use serviceaccount name instead of struct (#9614)
- fix: create serviceaccount token for v1.24 clusters (#9546)
### Other changes
- test: Remove cluster e2e tests not intended for release-2.3
- test: Remove circular symlinks from testdata (#9886)
- chore(deps): bump moment from 2.29.3 to 2.29.4 in /ui (#9897)
- chore: upgrade moment to latest version to fix CVE (#9005)
- chore: move dependencies to dev dependencies (#8541)
- docs: add OpenSSH breaking change notes (#10104)
- chore: update parse-url (#10101)
- chore: upgrade base image to 22.04 (#10103)
- docs: simplify Docker toolchain docs (#9966) (#10006)
- chore: update redis to 6.2.7 avoid CVE-2022-30065/CVE-2022-2097 (#10062)
- chore: upgrade Dex to 2.32.0 (#10036) (#10042)
- chore: update haproxy to 2.0.29 for redis-ha (#10045)
- test: check for error messages from CI env (#9953)