Argo CD v3.4.5 - Repo Server And SSA Fixes

Argo CD v3.4.5 was published on 2026 07 09 as a patch release for the GitOps control plane. The main operator visible fix is in repo server behavior: referenced sources now honor their own depth instead of inheriting depth from the primary source.

The full release notes and downloads are on the GitHub release page.

The repo server change is the most relevant fix for teams that generate manifests from more than one Git source. Commit e77e4b645cc1ad28b1af74931d8810c514fa75e7 fixes reposerver so a referenced source uses its own requested depth, not the depth from the primary source.

That distinction matters when application generation depends on a mix of shallow and deeper source history. A platform team might keep the main application checkout shallow, while a referenced source needs more history for tag lookup, chart metadata, or generator logic. Before this fix, the primary source could silently shape the fetch depth for a referenced source.

This is not a new feature surface. It is a correction to source handling inside the path that feeds manifest generation. For data platform teams that use Argo CD to deploy Airflow, Flink, Spark, dbt, or ingestion services, the value is predictable generation from multi source applications. The release notes point to this as a cherry picked fix for the 3.4 line, which suggests a regression or defect worth taking if multi source applications are in use.

Argo CD v3.4.5 also fixes an auto sync edge case around manifest-generate-paths. Commit 240390732e7b593a53a237c4f149426e7268f295 addresses a case where auto sync could be skipped when a newer commit arrived during an active sync. That is exactly the kind of bug that creates drift without a clean error signal. The desired commit exists, the controller saw sync activity, but the newest commit can miss the automatic path.

The second sync related fix is in replace handling. Commit a82e158db8a56037d8e8b5085d188abd9fba12f0 says Argo CD should not clobber fields that are not ignored on replace. This matters for clusters where field ownership and ignored differences are already part of the operating model. A replace path that overwrites fields outside the intended ignore set can produce noisy drift, unexpected object mutation, or difficult rollback analysis.

For pipeline operators, both fixes reduce ambiguity. Auto sync should react to the newest eligible commit. Replace should not broaden its write behavior beyond the fields it is meant to manage. Neither item changes the deployment model, but both make existing automation less surprising under load or during repeated commit churn.

Commit 63e67d5e7f502f85b69cd52d6d56e1123b087992 fixes SSA handling so auth reconcile does not run with SSA. The release notes do not expand the failure mode, so the safest read is narrow: this patch constrains reconcile behavior where Server Side Apply is involved. That is still operator relevant because SSA changes field ownership semantics, and auth resources tend to be sensitive to ownership mismatch.

Dex also gets a regression fix. Commit d4c8f1c3c724d4d71c1f4ddb6b255ab36d3bef4a restores config environment variable substitution for Dex config. If your Argo CD install feeds Dex settings through environment values, this is not cosmetic. Broken substitution can affect identity provider configuration and therefore access to the control plane.

There is one UI listed bug fix as well: deleted resources were incorrectly shown in the UI. That is less important for data flow itself, but it can still affect incident triage during a failed rollout or prune operation.

The dependency section is short. Argo CD bumps golang.org/x/crypto to 0.53.0 and updates the Ubuntu base image to 26.04 LTS. The release notes do not cite a specific vulnerability for either item, so treat them as maintenance updates unless your own scanner maps them to policy findings.

The release also repeats the project provenance position: container images are signed with cosign, and provenance is generated for container images and CLI binaries that meet SLSA Level 3 requirements. That matters in locked down delivery paths where Argo CD itself sits inside the deploy path for other workloads. Verification is not automatic just because assets are signed, but the release provides the artifacts needed for teams that enforce signature or provenance checks.

This is not marked as a prerelease. The release metadata says prerelease is false, and the GitHub release page presents it as v3.4.5.

The release notes include a general warning for upgrades from a different minor version. If the current install is not already on the 3.4 line, read the upstream upgrade documentation before applying this patch. The quick start commands also use kubectl apply with --server-side and --force-conflicts, so do not copy those commands into a managed production install without checking how your cluster handles field ownership.

For existing 3.4 deployments, this looks like a focused patch rather than a migration release. The main checks before rollout are simple: confirm whether multi source applications rely on source depth, confirm whether manifest-generate-paths is used for auto sync, check any replace based workflows, and validate Dex substitution if environment backed config is present.