Update Helm release argo-cd to v9.4.11

[renovate]

This PR contains the following updates:

Package	Update	Change	Pending
argo-cd	patch	9.4.4 → 9.4.11	9.4.17 (+5)

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

argoproj/argo-helm (argo-cd)

v9.4.11

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• chore(deps): update actions/create-github-app-token action to v2.2.2 by @​argoproj-renovate[bot] in #​3774
• chore(deps): update actions/create-github-app-token action to v3 by @​argoproj-renovate[bot] in #​3775
• chore(deps): update renovatebot/github-action action to v46.1.5 by @​argoproj-renovate[bot] in #​3777
• chore(argo-cd): Update dependency argoproj/argo-cd to v3.3.4 by @​argoproj-renovate[bot] in #​3778

Full Changelog: argoproj/argo-helm@argocd-image-updater-1.1.3...argo-cd-9.4.11

v9.4.10

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• chore(argo-cd): Update dependency argoproj/argo-cd to v3.3.3 by @​argoproj-renovate[bot] in #​3768

Full Changelog: argoproj/argo-helm@argo-cd-9.4.9...argo-cd-9.4.10

v9.4.9

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• chore(argo-cd): Update ghcr.io/oliver006/redis_exporter Docker tag to v1.82.0 by @​argoproj-renovate[bot] in #​3766

Full Changelog: argoproj/argo-helm@argo-cd-9.4.8...argo-cd-9.4.9

v9.4.8

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• ci(github): add awaiting-upstream and keep to exempt labels by @​jmeridth in #​3763
• chore(deps): update renovatebot/github-action action to v46.1.3 by @​argoproj-renovate[bot] in #​3761
• chore(deps): bump the dependencies group with 2 updates by @​dependabot[bot] in #​3764
• chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 by @​dependabot[bot] in #​3765
• chore(argo-cd): Update ghcr.io/dexidp/dex Docker tag to v2.45.1 by @​argoproj-renovate[bot] in #​3749

Full Changelog: argoproj/argo-helm@argo-cd-9.4.7...argo-cd-9.4.8

v9.4.7

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• chore(deps): update ghcr.io/renovatebot/renovate docker tag to v43.49.0 by @​argoproj-renovate[bot] in #​3760
• feat(argo-cd): Add timeout.reconciliation.jitter config by @​sh-cho in #​3748

New Contributors

• @​sh-cho made their first contribution in #​3748

Full Changelog: argoproj/argo-helm@argo-cd-9.4.6...argo-cd-9.4.7

v9.4.6

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by @​dependabot[bot] in #​3759
• feat(argo-cd): add support for custom statefulset labels by @​inesmuka98 in #​3740

New Contributors

• @​inesmuka98 made their first contribution in #​3740

Full Changelog: argoproj/argo-helm@argo-cd-9.4.5...argo-cd-9.4.6

v9.4.5

Compare Source

A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.

What's Changed

• chore(deps): update renovatebot/github-action action to v46.1.2 by @​argoproj-renovate[bot] in #​3746
• feat(argo-cd): Allow configuring HTTPRoute timeouts by @​jonasz-lasut in #​3755

New Contributors

• @​jonasz-lasut made their first contribution in #​3755

Full Changelog: argoproj/argo-helm@argo-cd-9.4.4...argo-cd-9.4.5

---

Configuration

📅 Schedule: Branch creation - "after 2am and before 8am on monday" in timezone America/New_York, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

argo-cd 9.4.4 -> 9.4.11

Risk: 🟡 Caution | CI: Passing | Confidence: High

The Deep Dive

Update Scope

• Helm chart: argo-cd 9.4.4 → 9.4.11 (7 patch releases)
• Argo CD app: v3.3.2 → v3.3.4 (2 patch releases)
• Dex sidecar: v2.44.0 → v2.45.1 (bundled dependency bump)
• Redis exporter: updated to v1.82.0 (bundled dependency bump in chart 9.4.9)
• Redis: unchanged

No kustomize image override exists — the app version is changing with this PR.

Performance & Stability

• Reconciliation timing change: The chart now sets timeout.reconciliation: 120s with timeout.reconciliation.jitter: 60s instead of the previous timeout.reconciliation: 180s. This aligns with upstream defaults changed in Argo CD. Effective sync interval changes from exactly 3 minutes to 2–3 minutes (randomized). This reduces thundering-herd reconciliation load. Introduced in chart 9.4.7 (#3748).

• Stack overflow fix: Fixed stack overflow when processing circular ownerRefs in resource graph (#26783) — in v3.3.5, not included in this PR but available in newer charts.

Features & UX

• Custom statefulset labels (chart 9.4.6, #3740): Adds support for custom labels on the application controller StatefulSet. Not configured in values.yaml — no action needed to take advantage, opt-in via controller.statefulsetLabels.

• HTTPRoute timeouts (chart 9.4.5, #3755): Allows configuring HTTPRoute timeouts for Gateway API users. Not applicable — this deployment uses standard Ingress, not Gateway API.

• Reconciliation jitter config (chart 9.4.7, #3748): Adds timeout.reconciliation.jitter config key. Automatically applied by this chart update with the new default values.

Security

No CVEs found affecting the v3.3.2–v3.3.4 range in GitHub Security Advisories for either Argo CD or Dex.

The Dex bump to v2.45.1 includes a fix for MySQL 8.0+ storage migration (#4580) — not relevant since this deployment uses in-memory Dex storage (confirmed in values.yaml line 36: type: memory).

The Dex containers now include runAsUser: 1001 in their security context, tightening the security posture.

Key Fixes

Argo CD v3.3.3:

• Kubernetes version format change (v3.3.3 release notes): Aligns K8s cluster version interpretation with Helm 3.19.0. Affects ApplicationSets using Cluster Generators with version-based selection via argocd.argoproj.io/auto-label-cluster-info. Searched all files under kubernetes/argocd/ — no ApplicationSets use cluster generators with version-based selection, so not affected.
• Fix for comma-separated hook annotations for PreDelete/PostDelete hooks (#26420)
• Fix for multi-level cross-namespace hierarchy traversal (#26640)
• Fix for CNPG suspend/resume action annotations (#26711)
• UI fix for standard resource icons (#26228)

Argo CD v3.3.4:

• Fix for token refresh threshold parsing in unrelated components (#26806)
• OpenTelemetry SDK bump (#26808)

Newer Versions

The PR proposes chart 9.4.11 but 9.4.17 is the latest (6 newer versions). Argo CD has also released v3.3.5 and v3.3.6 since v3.3.4:

• v3.3.5: Fix for stack overflow on circular ownerRefs (#26783), fix for terminal container find logic (#26858), grpc security bump to 1.79.3
• v3.3.6: Fix for controller incorrectly detecting diff during app normalization (#27002), fix for wrong installation ID returned from cache (#26969)

These are bug fixes in v3.3.5/v3.3.6 for issues that existed before v3.3.4 (not regressions introduced by v3.3.4). The proposed version is stable; Renovate's minimumReleaseAge delay will bring the newer charts in due course.

Hazards & Risks

• Reconciliation interval behavioral change: Sync interval changes from fixed 180s to randomized 120–180s. This is a behavioral change that affects how frequently Argo CD reconciles applications. While this aligns with upstream defaults and improves cluster load distribution, it changes existing behavior. Applications will reconcile slightly more frequently on average. Low risk but worth noting.

• Dex image jump (v2.44.0 → v2.45.1): A minor version bump of the Dex sidecar. The v2.45.1 fixes are for MySQL storage and connector interface changes — neither affects this deployment's in-memory + OIDC configuration. The new runAsUser: 1001 security context addition should be compatible.

Sources

• Argo CD Helm chart releases
• Argo CD v3.3.3 release
• Argo CD v3.3.4 release
• Argo CD v3.3.5 release
• Argo CD v3.3.6 release
• Dex v2.45.1 release
• Reconciliation jitter chart change

---

🟡 Verdict: Caution

Straightforward patch update with bug fixes and dependency bumps. The reconciliation timing behavioral change (180s fixed → 120–180s jittered) is the only notable change — it aligns with upstream defaults and improves load distribution but is worth validating. No breaking changes affect this deployment's configuration.