Repository navigation
chore(deps): argo-cd v2->v3 + k8s 1.34 migration and Dependabot patches - #7051
Merged
Merged
Conversation
Major dependency migration (Path A: stable landing zone). Builds green via `make build`; only the pre-existing broken mock packages remain (unchanged from before, not part of the binary). Dependency changes: - github.com/argoproj/argo-cd/v2 v2.14.20 -> argo-cd/v3 v3.3.12 (module-path change; v2 line ends at 2.14.x and cannot compile against k8s 0.34+ after the gogo-protobuf removal) - k8s.io/* 0.33.x -> 0.34.9, k8s.io/kubernetes -> 1.34.9 - helm.sh/helm/v3 3.18.6 -> 3.19.5 (k8s 0.34 compatible) - github.com/argoproj/gitops-engine -> v0.7.1-0.20250908182407-97ad5b59a627 (smd/v6 + k8s 0.34; kept standalone, matching argo-cd v3.3.12's own pin) Code changes: - Rewrite all `argoproj/argo-cd/v2/...` imports to `.../v3/...` (43 files) - Modernize 3 gRPC dial sites to the current otelgrpc API (NewClientHandler via WithStatsHandler) since otelgrpc v0.63.0 removed UnaryClientInterceptor/StreamClientInterceptor; drop the now-dead otelgrpc v0.61.0 => v0.46.1 replace - Regenerate wire_gen.go Deliberately NOT included (require argo-cd v3.5-rc / k8s 0.35, deferred): - helm 3.20.2 CVE fix (needs k8s >= 0.35.1, which needs argo-cd v3.5 RC) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> (cherry picked from commit 5d23623)
Bumps (all verified with a clean vendor-mode build):
argo-cd/v3 3.3.12 -> 3.4.7 (matches cluster Argo CD 3.4.6)
grpc 1.79.3 -> 1.82.1
kin-openapi 0.132.0 -> 0.144.0 (CRITICAL)
cel-go 0.26.0 -> 0.29.0
go-git/v5 5.19.1 -> 5.19.2
oras-go/v2 2.6.1 -> 2.6.2
oapi-codegen/v2 2.4.2 -> 2.7.1
argo-cd v3.4 moved gitops-engine in-repo to
github.com/argoproj/argo-cd/gitops-engine. Its own go.mod resolves that
via a local `replace ./gitops-engine`, which does not apply to consumers,
and the version it requires (v0.7.1-0.2025...) does not exist at the new
path. Pinned it here with a replace to the revision of the v3.4.7 tag,
and repointed our 7 importing files at the new module path. The old
standalone github.com/argoproj/gitops-engine is now dropped entirely.
argo-cd v3.4 also changed SyncPolicyAutomated.{Prune,SelfHeal,AllowEmpty}
from bool to *bool and added Enabled *bool. Enabled == nil still means
automated sync is on, so leaving it nil preserves existing behaviour.
helm 3.20.2 is deliberately NOT taken: it requires k8s 0.35.1, and no
Argo CD release builds against k8s 0.35 (3.4.x pins 0.34, 3.5.x pins
0.36). Deferred to a stacked branch. k8s stays at 0.34.9.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 3348dcf)
argo-cd v3.4.7 pulls in gitops-engine, which requires go 1.26.0, so the module's go directive moved 1.25.5 -> 1.26.0 and the image build failed against golang:1.25.6. Both golang:1.25.6 and golang:1.26.6 resolve to the same Debian trixie base (verified by comparing per-arch digests), so this is a Go patch bump only — no glibc change for the ubuntu:24.04 runtime stage, which matters because the build runs with CGO enabled. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> (cherry picked from commit b8e1b6c)
github.com/argoproj/argo-cd/gitops-engine sorts before github.com/argoproj/argo-cd/v3, so repointing the import left these blocks out of order. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> (cherry picked from commit a5bc5ee)
…ndabot-safe-patches-2026-08 Updates the OSS replace directives (common-lib, authenticator) to the 2026-08 dependabot branch tip via 'make dep-update-oss'.
|
Bito Automatic Review Skipped - PR Too Large |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
SATYAsasini
approved these changes
Sep 23, 2026
vivek-devtron
approved these changes
Sep 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #6839
Recreates the OSS Dependabot round (the original #7011 branch content was lost when
developwas force-pushed over it). Mirrors devtron-labs/devtron-enterprise#3386.Stacked on current
develop; targets the cluster running k8s 1.35.6 / Argo CD 3.4.6.Dependency bumps
argo-cd/v2kin-openapigoogle.golang.org/grpccel-gogo-git/v5oras-go/v2oapi-codegen/v2k8s.io/*helm.sh/helm/v3common-lib/authenticatorupdated to devtron-servicesdependabot-safe-patches-2026-08tip (
v0.0.0-20260922081328-d6604ff59a0a) viamake dep-update-oss.argo-cd v3.4 required non-obvious changes
1. gitops-engine moved in-repo to
github.com/argoproj/argo-cd/gitops-engine.Argo CD resolves it with a local
replace ./gitops-engine, which does not apply toconsumers, and the version it requires does not exist at the new path — so
go mod tidyfails outright. Pinned viareplaceto the v3.4.7 tag revision andrepointed our 7 importing files. The old standalone
github.com/argoproj/gitops-engineis dropped entirely.
2.
SyncPolicyAutomated.{Prune,SelfHeal,AllowEmpty}became*bool, andEnabled *boolwas added. One real code change, inclient/argocdServer/helper.go.Enabled == nilstill means automated sync is on, so behaviour is preserved.3. Dropped the
filepath-securejoinreplace.mainpins it to v0.3.6 becauseargo-cd v2 needs the old
MkdirAllsignature; argo-cd v3 requires v0.6.1, sothat pin is wrong on this branch — removed.
4. otelgrpc. The migration modernized the gRPC dial sites to
grpc.WithStatsHandler(otelgrpc.NewClientHandler())(otelgrpc removedUnary/StreamClientInterceptor) and dropped the now-deadotelgrpc => v0.46.1replace.Build fixes
Dockerfile/DockerfileEA:golang:1.25.x→1.26.6. gitops-engine requiresgo 1.26.0, so the go directive moved. Both tags resolve to the same Debian trixie
base (verified by comparing per-arch digests), so no glibc shift for the CGO-enabled
runtime stages.
Deliberately not taken
(3.4.x pins 0.34, 3.5.x pins 0.36). k8s stays at 0.34.9, one minor behind the 1.35.6
cluster — a supported skew.
go-pg/pgv8 — no patched version.Verification
make build(wire + darwin) green — thedevtronbinary links;wire_gen.goregenerates with no diff.
GOOS=linux CGO_ENABLED=0main build — clean.are unchanged — verified to fail identically on the pristine
developbaseline, sono test regressions are introduced by this round.
🤖 Generated with Claude Code
Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com