Release v3.4 patch releases discussion

[terrytangyuan]

This issue tracks commits for v3.4 patch releases.

[agilgur5]

Do we want to cherry-pick in my UI date filter fixes? i.e. #11742, #11792, #11840

If so, I think I'd want to make another PR to remove the date filter default from the upgrade notes modal (as #11840 removes the default)

[terrytangyuan]

Sure I think we'll include all fixes if there's no conflict.

[terrytangyuan]

We need to include #11971 to unblock the build.

[terrytangyuan]

@juliev0 and @sarabala1979 suggests including #11774

[terrytangyuan]

We are targeting end of next week for this. Please comment if you’d like to prioritize any other fixes.

[agilgur5]

Sure I think we'll include all fixes if there's no conflict.

Ok, I added #11982 on top of those since they'll be included in a 3.4.x release then (the upgrade note in the modal is only for 3.4)

@juliev0 and @sarabala1979 suggests including #11774

isn't that a feature though?

[terrytangyuan]

From @juliev0:

Without it, users in a cluster with too many sso groups can't log in to Argo Server.

So we could consider that a fix.

[terrytangyuan]

Security fix #11986

[terrytangyuan]

#11993

[terrytangyuan]

Working branch https://github.com/argoproj/argo-workflows/commits/release-3.4.12

[terrytangyuan]

Tag created: https://github.com/argoproj/argo-workflows/releases/tag/v3.4.12
Images will be published once CI succeeds: https://github.com/argoproj/argo-workflows/actions/runs/6587281270/job/17897237879

[terrytangyuan]

Released

[terrytangyuan]

Reusing this issue to track any potential bug fixes for future v3.4 patch releases.

[terrytangyuan]

From @juliev0, 75bd0b8

[terrytangyuan]

Security fix #12111

[terrytangyuan]

Released: https://github.com/argoproj/argo-workflows/releases/tag/v3.4.13

[terrytangyuan]

TODOs:

• Revert 46297ca

[agilgur5]

#12172 specifically for the 3.4.x patch series

[agilgur5]

#12622 is a workaround for a (very impactful) k8s 1.27 issue (#11657)

[agilgur5]

#12652 adds some missing docs that are still relevant to release-3.4

[agilgur5]

If it applies neatly, #12666 fixes a warning and performance issue

[agilgur5]

#12609 fixes a regression dating back to 3.3, so would be good to get into 3.5.x and 3.4.x
#12581 is a docs clarification that would be helpful to backport

[jackivanov]

#12622 impact is significant, please release as soon as possible

[agilgur5]

#12683 fixes a regression from 3.4.7+

[isubasinghe]

Sorry for the delay, this took a bit more time than I thought, I was a bit sick last week so couldn't finish it. I've only just finished merging everything in.

Please help me check for correctness: https://github.com/isubasinghe/argo-workflows/tree/release-3.4.17

I will go through the commits again and confirm conflicts have been resolved correctly, will release tomorrow night AEDT if everything is okay.

[terrytangyuan]

Why not using release-3.4 branch? See the first paragraph in https://github.com/argoproj/argo-workflows/blob/main/docs/releasing.md

[isubasinghe]

I didn't want any of these changes to be considered official until correctness had been verified.

[ishivanshgoel]

@isubasinghe could you kindly confirm if version 3.4.17 has been released?

[terrytangyuan]

@ishivanshgoel You can find all the releases here: https://github.com/argoproj/argo-workflows/tags

[ishivanshgoel]

@tachylatus sure, thanks for the reply. But I couldn't find any recent 3.4 updates after 3.4.16 in January.
Is there any plan to release an update with the vulnerability patches?

[Joibel]

Can we get #11585 in to this as well? Would you like me to make a PR for a fixed up version of it?

[terrytangyuan]

Can we get #11585 in to this as well? Would you like me to make a PR for a fixed up version of it?

Yes please.

[terrytangyuan]

Is there any plan to release an update with the vulnerability patches?

Yes, we are planning to release one soon.

[tooptoop4]

can #12233 be included?

[terrytangyuan]

https://github.com/argoproj/argo-workflows/releases/tag/v3.4.17

[terrytangyuan]

UI security fix: #13069

[agilgur5]

https://github.com/argoproj/argo-workflows/releases/tag/v3.4.17

@terrytangyuan @isubasinghe It looks like some fixes to 3.5 features landed in 3.4.17, which aren't applicable to 3.4. Please see my detailed comments in #13043 (review)

[agilgur5]

UI security fix: #13069

This would require a very significant amount of effort to backport as I detailed in #13069 (review).
Argo v3.4 is on swagger-ui-react v4 as #12540 was never backported and then there are several React incompatibilities with that PR itself as well.

[terrytangyuan]

#12383 is requested to be cherry-picked by community contributor

[isubasinghe]

#13553 should also go in 3.4 I think, it fixes an old issue to do with deadlocks

[terrytangyuan]

Need to patch this high vuln security fix #13626

[agilgur5]

Need to patch this high vuln security fix #13626

@terrytangyuan my above comment applies to that as well

[agilgur5]

#13820 fixes a regression in 3.4.8+ per #12848 (comment)

[klayhamn]

Hello, what are the chances of applying this fix:

6abe8a9#diff-24284b831e81f770335038e710187e2feb0c7c3f46148c31fea108516ce1ae59R25

which seems to fix:
#8958
#8783

in 3.4?
my company currently uses 3.4.x and the RC the fix is on (3.6.x) is still a way off