- Breaking: Self‑managed Argo CD installations must enable ServerSideApply=true (with a temporary ClientSideApplyMigration=false workaround) for upgrades to succeed.
- Bugfixes: Resolved OIDC config via secrets, excessive LS remote requests on monorepos, AppProject finalizer namespace handling, and compressed layer extraction issues.
- All container images are now cosign‑signed and include SLSA‑Level‑3 provenance for secure verification.
