Release v3.4 patch releases discussion

[terrytangyuan]

This issue tracks commits for v3.4 patch releases.

[agilgur5]

Do we want to cherry-pick in my UI date filter fixes? i.e. #11742, #11792, #11840

If so, I think I'd want to make another PR to remove the date filter default from the upgrade notes modal (as #11840 removes the default)

[terrytangyuan]

Sure I think we'll include all fixes if there's no conflict.

[terrytangyuan]

We need to include #11971 to unblock the build.

[terrytangyuan]

@juliev0 and @sarabala1979 suggests including #11774

[terrytangyuan]

We are targeting end of next week for this. Please comment if you’d like to prioritize any other fixes.

[agilgur5]

Sure I think we'll include all fixes if there's no conflict.

Ok, I added #11982 on top of those since they'll be included in a 3.4.x release then (the upgrade note in the modal is only for 3.4)

@juliev0 and @sarabala1979 suggests including #11774

isn't that a feature though?

[terrytangyuan]

From @juliev0:

Without it, users in a cluster with too many sso groups can't log in to Argo Server.

So we could consider that a fix.

[terrytangyuan]

Security fix #11986

[terrytangyuan]

#11993

[terrytangyuan]

Working branch https://github.com/argoproj/argo-workflows/commits/release-3.4.12

[terrytangyuan]

Tag created: https://github.com/argoproj/argo-workflows/releases/tag/v3.4.12
Images will be published once CI succeeds: https://github.com/argoproj/argo-workflows/actions/runs/6587281270/job/17897237879

[terrytangyuan]

Released

[terrytangyuan]

Reusing this issue to track any potential bug fixes for future v3.4 patch releases.

[terrytangyuan]

From @juliev0, 75bd0b8

[terrytangyuan]

Security fix #12111

[terrytangyuan]

Released: https://github.com/argoproj/argo-workflows/releases/tag/v3.4.13

[terrytangyuan]

TODOs:

• Revert 46297ca

[agilgur5]

#12172 specifically for the 3.4.x patch series

[sarabala1979]

@calvinwiebe #12281 has depended on another PR which has spec change. I would recommend upgrading v3.5 which is more stable now.

[agilgur5]

#12397 would be good to have for any patch

EDIT: that appears specific to the merging of archived + live workflows in 3.5, so nvm

[sarabala1979]

Released https://github.com/argoproj/argo-workflows/releases/tag/v3.4.15 contains below commits
b3aaaa45d chore(build): Replaced master to main in changelogs
fbf933563 fix: Resolve vulnerabilities in axios (#12470)
feb992505 fix: liveness check (healthz) type asserts to wrong type (#12353)
edb0a98c3 fix(docs): release-3.4 readthedocs backport (#12474)

[sarabala1979]

#12397 would be good to have for any patch

this commit requires other UI PR need to be cherry-picked which has UI file conflicts.
Can you ask user to pick v3.5?

[terrytangyuan]

We might need another patch ASAP #12515

[terrytangyuan]

Released https://github.com/argoproj/argo-workflows/releases/tag/v3.4.16

[agilgur5]

Another vuln #12556 (which is actually from a new go-git dep after #12515)

[agilgur5]

#12397 would be good to have for any patch

this commit requires other UI PR need to be cherry-picked which has UI file conflicts. Can you ask user to pick v3.5?

Yea this was my bad, it appears to only apply to 3.5 actually (I didn't realize that as it wasn't the Workflow List but the Workflow Details page, apparently that too was merged in 3.5). I edited my comment. Sorry about that!

[drawlerr]

Could #12233 be included the next v3.4 patch release?

[agilgur5]

#12492 would be good for any patch release

[tachylatus]

Could you please include #11847 in the next patch release?
Our workflow-controller is susceptible to crashing with "was unable to obtain node for ...".

[agilgur5]

#12622 is a workaround for a (very impactful) k8s 1.27 issue (#11657)

[agilgur5]

#12652 adds some missing docs that are still relevant to release-3.4

[agilgur5]

If it applies neatly, #12666 fixes a warning and performance issue

[agilgur5]

#12609 fixes a regression dating back to 3.3, so would be good to get into 3.5.x and 3.4.x
#12581 is a docs clarification that would be helpful to backport

[jackivanov]

#12622 impact is significant, please release as soon as possible

[agilgur5]

#12683 fixes a regression from 3.4.7+

[isubasinghe]

Sorry for the delay, this took a bit more time than I thought, I was a bit sick last week so couldn't finish it. I've only just finished merging everything in.

Please help me check for correctness: https://github.com/isubasinghe/argo-workflows/tree/release-3.4.17

I will go through the commits again and confirm conflicts have been resolved correctly, will release tomorrow night AEDT if everything is okay.

[terrytangyuan]

Why not using release-3.4 branch? See the first paragraph in https://github.com/argoproj/argo-workflows/blob/main/docs/releasing.md

[isubasinghe]

I didn't want any of these changes to be considered official until correctness had been verified.

[ishivanshgoel]

@isubasinghe could you kindly confirm if version 3.4.17 has been released?

[terrytangyuan]

@ishivanshgoel You can find all the releases here: https://github.com/argoproj/argo-workflows/tags

[ishivanshgoel]

@tachylatus sure, thanks for the reply. But I couldn't find any recent 3.4 updates after 3.4.16 in January.
Is there any plan to release an update with the vulnerability patches?

[Joibel]

Can we get #11585 in to this as well? Would you like me to make a PR for a fixed up version of it?

[terrytangyuan]

Can we get #11585 in to this as well? Would you like me to make a PR for a fixed up version of it?

Yes please.

[terrytangyuan]

Is there any plan to release an update with the vulnerability patches?

Yes, we are planning to release one soon.

[tooptoop4]

can #12233 be included?

[terrytangyuan]

https://github.com/argoproj/argo-workflows/releases/tag/v3.4.17