Release v3.6 patch releases discussion

[Joibel]

Summary

Track commits for 3.6 releases

[Joibel]

For 3.6.5:

• https://github.com/argoproj/argo-workflows/actions/runs/13695760244/job/38297661611 - two snyk vulns should be patched
  main chore(deps): fix snyk #14264
• chore(deps): bump minio-go to newer version #14185 cherry picked as chore(deps): bump minio-go to newer version (#14185) (release-3.6) #14261
• fix: split pod controller from workflow controller #14129 cherry picked as fix: split pod controller from workflow controller (#14129) (release-3.6) #14263
• fix: wait for workflow informer to sync before pod informer #14248 (dependent on and fixes fix: split pod controller from workflow controller #14129)
  cherry picked as fix: wait for workflow informer to sync before pod informer (cherry-pick #14248) #14266
• docs: autogenerate tested k8s versions and centralize config #14176 cherry picked as docs: autogenerate tested k8s versions and centralize config (#14176) (release-3.6) #14262
• fix: bump deps for k8schain to fix ecr-login (#14008) (release-3.6 cherry-pick) #14174
• chore(deps): bump github.com/go-jose/go-jose/v3 from 3.0.3 to 3.0.4 in the go_modules group #14231 cherry-picked as chore(deps): bump github.com/go-jose/go-jose/v3 from 3.0.3 to 3.0.4 in the go_modules group (cherry-pick #14231) #14269
• fix(cli): remove red from log colour selection. Fixes #6740 #14215 cherry-picked as fix(cli): remove red from log colour selection. Fixes #6740 (cherry-pick #14215) #14278
• fix: correct semaphore configmap keys for multiple semaphores #14184 cherry-picked as fix: correct semaphore configmap keys for multiple semaphores (#14184) (release-3.6) #14281
• fix: don't print help for non-validation errors. Fixes argoproj#14234 #14249 cherry-picked as fix: don't print help for non-validation errors. Fixes argoproj#14234 (cherry-pick #14249) #14283

Skipping

• fix: correct retry logic #13734 until HTTP and Plugin nodes cannot be manually retried #14124 is addressed

[yulin-li]

could we also include #14231 which is actually a security patch?

[dhpollack]

Would it be possible to add #14197 ? We have had several issues related to this.

[Joibel]

For v3.6.6:

• fix: gracefully handle invalid CronWorkflows and simplify logic. Fixes #14047 #14197 picked as fix: gracefully handle invalid CronWorkflows and simplify logic. (cherry-pick #14197) #14419
• fix(workflow/sync): use RWMutex to prevent concurrent map access #14321 picked as fix(workflow/sync): use RWMutex to prevent concurrent map access (cherry-pick #14321) #14322
• fix: check metric creation before use. Fixes #14367 #14383 is part of chore(lint): update golangci-lint to 2.1.1 (#14390) (cherry-pick release-3.6) #14417
• argo-events update for CVE
  • chore(lint): update golangci-lint to 2.1.1 #14390 as chore(lint): update golangci-lint to 2.1.1 (#14390) (cherry-pick release-3.6) #14417
  • chore: bump golang 1.23->1.24 #14385 as chore: bump golang 1.23->1.24 (#14385) (cherry-pick release-3.6) #14418
  • chore(deps): bump github.com/argoproj/argo-events from 1.9.1 to 1.9.6 in the go_modules group #14382 as chore(deps)!: update k8s and argo-events (release-3.6) #14424
• fix: prevent dfs sorter infinite recursion on cycle. Fixes #13395 #14391 as fix: prevent dfs sorter infinite recursion on cycle. Fixes #13395 (cherry-pick #14391) #14420
• chore(deps): bump github.com/expr-lang/expr from 1.16.9 to 1.17.0 in the go_modules group #14307 for CVE in snyk as chore(deps): bump github.com/expr-lang/expr from 1.16.9 to 1.17.0 (#14307) (release-3.6) #14421
• manual retry rework
  • fix: correct retry logic #13734 as fix: correct retry logic (#13734) (release-3.6) #14428
  • fix: manual retries exit handler cleanup. Fixes #14180 #14181 as fix: manual retries exit handler cleanup. Fixes #14180 (#14181) (release-3.6) #14429
  • fix: correct manual retry logic. Fixes #14124 #14328 as fix: correct manual retry logic. Fixes #14124 (#14328) (release-3.6) #14430

[guoxh16]

Is it possible to include "#13734" in v3.6.6? Node/step level retry is an important use case and this feature significantly improves the efficiency and agility of executing large, long-running Argo workflows. Currently it is still broken for some common DAG patterns though.

[Joibel]

Is it possible to include "#13734" in v3.6.6? Node/step level retry is an important use case and this feature significantly improves the efficiency and agility of executing large, long-running Argo workflows. Currently it is still broken for some common DAG patterns though.

It needs the mentioned regression fixing before we can think about including it in 3.6.6

[believeinblee]

Could we please include #14391 in v3.6.6? We've received some feedback about this issue.

[Joibel]

For v3.6.8:

• fix: update TLS config to support ALPN. Fixes #14422 #14435
• fix: ensure variable sub and processing is performed. Fixes #12941 #14444 as fix: ensure variable sub and processing is performed. Fixes #12941 (cherry-pick #14444) #14481
• fix: add content-md5 header for artifacts #14191 as fix: add content-md5 header for artifacts (#14191) #14483
• Listing of workflows/pods should paginate to support the case where there is a large number of objects. #14374 as fix: added pagination to the workflow and pod listings. Fixes #14374 (cherry-pick #14373) #14479
• feat: non-root argoexec #14477 pushed direct
• chore(deps): bump golang.org/x/net (release-3.6) #14508 Update deps (x/net) for security
• fix: ignore failing resolveArt when Art is optional. Fixes #14267 #14503 as fix: ignore failing resolveArt when Art is optional. Fixes #14267 (cherry-pick #14503) #14521

[akloss-cibo]

Could we consider including #11182 in 3.6.8?

[believeinblee]

Could we please include #14444?