- All Argo CD container images are now signed with Cosign and SLSA‑Level 3 provenance is generated for images and CLI binaries.
- Multiple bug fixes: controller cache deadlock on cluster delete/add, PATCH handling in HTTP server, SSO redirect URI for Gitea/Google/Dex, ApplicationSet controller crash on unclosed tags, OCI dependency URL handling.
- Documentation updates: added missing values, clarified security policy coverage for the last three versions, and added a startup warning for disabled cluster server address.
