chore(deps): update minor and patch updates

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
argocd		patch	v3.2.5 → v3.2.6
ghcr.io/astral-sh/uv	stage	patch	0.9.25 → 0.9.28
helm		minor	v3.19.5 → v3.20.0
helm		minor	3.19.5 → 3.20.0
kyverno		patch	1.16.2 → 1.16.3
uv		patch	0.9.25 → 0.9.28

---

Release Notes

argoproj/argo-cd (argocd)

v3.2.6

Compare Source

Quick Start

Non-HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.6/manifests/install.yaml

HA:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.6/manifests/ha/install.yaml

Release Signatures and Provenance

All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the documentation on how to verify.

Release Notes Blog Post

For a detailed breakdown of the key changes and improvements in this release, check out the official blog post

Upgrading

If upgrading from a different minor version, be sure to read the upgrading documentation.

Changelog

Bug fixes

• 20866f4: fix(hydrator): .gitattributes include deeply nested files (#​25870) (cherry-pick #​26011 for 3.2) (#​26012) (@​argo-cd-cherry-pick-bot[bot])
• 508da9c: fix(hydrator): empty links for failed operation (#​25025) (cherry-pick #​26014 for 3.2) (#​26016) (@​argo-cd-cherry-pick-bot[bot])
• 2ff406a: fix: cherry pick #​25516 to release-3.2 (#​26115) (@​FourFifthsCode)
• e3b108b: fix: close response body on error paths to prevent connection leak (cherry-pick #​25824 for 3.2) (#​26006) (@​argo-cd-cherry-pick-bot[bot])
• ad117b8: fix: invalid error message on health check failure (#​26040) (cherry pick #​26039 for 3.2) (#​26070) (@​dudinea)

Dependency updates

• 76fc92f: chore(deps): update notifications-engine to fix GitHub PR comments nil panic (cherry-pick #​26065 for 3.2) (#​26074) (@​soutar)

Full Changelog: argoproj/argo-cd@v3.2.5...v3.2.6

astral-sh/uv (ghcr.io/astral-sh/uv)

v0.9.28

Compare Source

Released on 2026-01-29.

Python

• Update CPython to use OpenSSL 3.5.5 which includes fixes for high severity CVEs (python-build-standalone#960)

Enhancements

• Add support for Pyodide interpreter on Windows (#​17658)
• Warn if multiple indexes include default = true (#​17713)
• Skip uploads when validation reports 'Already uploaded' (#​17412)

Configuration

• Add a reflink alias for the "clone" link mode (#​17724)

Bug fixes

• Ensure uv.exe exits when uvw.exe or uvx.exe is killed (#​17500)

v0.9.27

Compare Source

Released on 2026-01-26.

Python

• Upgrade Pyodide to 0.29.2 (#​17652)
• Upgrade to GraalPy 25.0.2 (#​17634)

Enhancements

• Add -t shortform for --target to uv pip subcommands (#​17501)
• Add support for ROCm 7.0 and 7.1 accelerator backends (#​17681)
• Further improve free-threading ABI incompatibility errors (#​17491)
• Implement uv pip freeze --exclude flag (#​17045)
• Improve warnings for --system and --no-system in uv venv (#​17647)
• Make uv pip compile attempt to download a specified --python-version if it can. (#​17249)
• Support Trusted Publishing with pyx (#​17438)
• Fix JSON schema for exclude-newer-package (#​17665)

Preview features

• Better detection for conflicting packages (#​17623)
• Upgrade based on outdated build versions in uv python upgrade (#​17653)

Bug fixes

• Change chocolatey system test to ensure uv uses the right python (#​17533)
• Fix infinite loop when SSL_CERT_FILE is a directory (#​17503)

Documentation

• Add cargo-xwin to the CONTRIBUTING guide (#​17507)
• Fix typo in the documentation of UV_PUBLISH_INDEX (#​17672)
• Move MSRV to platform support section (#​17534)
• Update the testing instructions in the CONTRIBUTING guide (#​17528)
• Use --locked to install cargo-xwin in guide (#​17530)
• Warn about PyPy being unmaintained (#​17643)
• docs: Correct gitlab-ci.yml to .gitlab-ci.yml (#​17682)

Other changes

• Update MSRV to 1.91 (#​17677)

v0.9.26

Compare Source

Released on 2026-01-15.

Python

• Add CPython 3.15.0a5

Enhancements

• Add a hint to update uv when a managed Python download is not found (#​17461)
• Improve cache initialization failure error message (#​17469)
• Improve error message for abi3 wheels on free-threaded Python (#​17442)
• Add support for --no-sources-package (#​14910)

Preview features

• Add METADATA.json and WHEEL.json in uv build backend (#​15510)
• Add support for GCS request signing (#​17474)
• Adjust the process ulimit to the maximum allowed on startup (#​17464)

Bug fixes

• Lock to avoid concurrent refresh of pyx tokens (#​17479)

Documentation

• Add linting and formatting instructions to the CONTRIBUTING guide (#​17470)
• Avoid rendering pyproject.toml examples for more system-level settings (#​17462)

helm/helm (helm)

v3.20.0: Helm v3.20.0

Compare Source

Helm v3.20.0 is a feature release. Users are encouraged to upgrade for the best experience.

The community keeps growing, and we'd love to see you there!

• Join the discussion in Kubernetes Slack:
  • for questions and just to hang out
  • for discussing PRs, code, and bugs
• Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom
• Test, debug, and contribute charts: ArtifactHub/packages

Notable Changes

• SDK: bump k8s API versions to v0.35.0
• v3 backport: Fixed a bug where helm uninstall with --keep-history did not suspend previous deployed releases #​12564
• v3 backport: Bump Go version to v1.25

Installation and Upgrading

Download Helm v3.20.0. The common platform binaries are here:

• MacOS amd64 (checksum / 724aef60f737ca73cfcc77924219dbfb229dde8492b2722cb372da617fd77367)
• MacOS arm64 (checksum / 1cb8022ef9c88026adf236cbdf02a80bf7678632d1c39d3d8045e815959ab20e)
• Linux amd64 (checksum / dbb4c8fc8e19d159d1a63dda8db655f9ffa4aac1b9a6b188b34a40957119b286)
• Linux arm (checksum / e66b9bcb51130f372b4750b2da83679e59d04633bfa825a1936c0b1039035bf0)
• Linux arm64 (checksum / bfb14953295d5324d47ab55f3dfba6da28d46c848978c8fbf412d4271bdc29f1)
• Linux i386 (checksum / e8e39f6df8b1c6d9d0f98f658d619c22c5a249a72975510d367def5e19adc7eb)
• Linux ppc64le (checksum / 3a44cf2df45274f907743997b9cef069e94589238324cf5116f9a3c092c743bf)
• Linux s390x (checksum / f38b6bb56db05fb7da82668d0cc82470a07fe17a5f881378d536cee68384c974)
• Linux riscv64 (checksum / b4336a2bf9b9a914897cb36b4343d4fd583cb4703dc2478d696a667391f30f2c)
• Windows amd64 (checksum / f9c7f686788d7b78775d3a3592fd98596aa825010cb9d157c9fbe3baabee1084)
• Windows arm64 (checksum / 4095cb1c46e29e9a7487fdbbee384d14656d3fa43dd8ef789061db6e29f0457b)

This release was signed with 208D D36E D5BB 3745 A167 43A4 C7C6 FBB5 B91C 1155 and can be found at @​scottrigby keybase account. Please use the attached signatures for verifying this release using gpg.

The Quickstart Guide will get you going from there. For upgrade instructions or detailed installation notes, check the install guide. You can also use a script to install on any system with bash.

What's Next

• 4.1.1 and 3.20.1 are the next patch releases, scheduled for March 11, 2026
• 4.2.0 and 3.21.0 are the next minor releases, scheduled for May 13, 2026

Changelog

• bump version to v3.20 f6e17f6 (Scott Rigby)
• chore(deps): bump golang.org/x/text from 0.32.0 to 0.33.0 4f5a655 (dependabot[bot])
• chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0 65c504a (dependabot[bot])
• chore(deps): bump github.com/foxcpp/go-mockdns from 1.1.0 to 1.2.0 f3b8af4 (dependabot[bot])
• chore(deps): bump the k8s-io group with 7 updates 89c2c61 (dependabot[bot])
• [dev-v3] Replace deprecated NewSimpleClientset 526076e (George Jenkins)
• [dev-v3] Bump Go v1.25, golangci-lint v2 0ae8e4f (George Jenkins)
• chore(deps): bump github.com/BurntSushi/toml from 1.5.0 to 1.6.0 e0d2595 (dependabot[bot])
• chore(deps): bump github.com/containerd/containerd from 1.7.29 to 1.7.30 858acb1 (dependabot[bot])
• fix(rollback): errors.Is instead of string comp 0cd9a60 (Hidde Beydals)
• fix(uninstall): supersede deployed releases 8bb0b37 (Hidde Beydals)
• Use latest patch release of Go in releases 930ba6f (Matt Farina)
• chore(deps): bump the k8s-io group with 7 updates 582211c (dependabot[bot])
• chore(deps): bump golang.org/x/crypto from 0.45.0 to 0.46.0 585c25c (dependabot[bot])
• chore(deps): bump golang.org/x/text from 0.31.0 to 0.32.0 6f17d46 (dependabot[bot])
• chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0 46ff427 (dependabot[bot])
• chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2 28b813a (dependabot[bot])
• chore(deps): bump github.com/rubenv/sql-migrate from 1.8.0 to 1.8.1 5dde5d6 (dependabot[bot])
• chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 362900b (dependabot[bot])
• chore(deps): bump github.com/cyphar/filepath-securejoin ec61de5 (dependabot[bot])
• chore(deps): bump the k8s-io group with 7 updates a490607 (dependabot[bot])
• chore(deps): bump golang.org/x/text from 0.30.0 to 0.31.0 8509bcc (dependabot[bot])
• chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.44.0 d495a94 (dependabot[bot])
• Remove dev-v3 helm-latest-version publish 01dc6cc (George Jenkins)
• chore(deps): bump golang.org/x/term from 0.36.0 to 0.37.0 6647f84 (dependabot[bot])
• chore(deps): bump github.com/containerd/containerd from 1.7.28 to 1.7.29 b548118 (dependabot[bot])
• Revert "pkg/registry: Login option for passing TLS config in memory" 6a67b55 (Scott Rigby)
• chore(deps): bump github.com/cyphar/filepath-securejoin 6d4f8c0 (dependabot[bot])
• jsonschema: warn and ignore unresolved URN $ref to match v3.18.4 3f0da15 (Benoit Tigeot)
• Fix helm pull untar dir check with repo urls e5e101c (Luna Stadler)
• chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 6aae923 (dependabot[bot])
• chore(deps): bump github.com/gofrs/flock from 0.12.1 to 0.13.0 1900c6a (dependabot[bot])
• chore(deps): bump golang.org/x/text from 0.29.0 to 0.30.0 43e9297 (dependabot[bot])
• chore(deps): bump github.com/cyphar/filepath-securejoin d347e2b (dependabot[bot])
• [backport] fix: get-helm-3 script use helm3-latest-version bd337b4 (George Jenkins)
• pkg/registry: Login option for passing TLS config in memory b80959f (Matheus Pimenta)
• chore(deps): bump the k8s-io group with 7 updates 1ac9d34 (dependabot[bot])
• Fix deprecation warning 9a366b4 (Benoit Tigeot)
• chore(deps): bump golang.org/x/crypto from 0.41.0 to 0.42.0 0c5a17e (dependabot[bot])
• chore(deps): bump golang.org/x/term from 0.34.0 to 0.35.0 b999021 (dependabot[bot])
• Avoid "panic: interface conversion: interface {} is nil" 2fe49f9 (Benoit Tigeot)
• bump version to v3.19.0 c3610ab (Scott Rigby)
• chore(deps): bump github.com/spf13/pflag from 1.0.7 to 1.0.10 73b449f (dependabot[bot])
• fix: set repo authorizer in registry.Client.Resolve() ffbc537 (Eric Stroczynski)
• fix null merge f0b699e (Ben Foster)
• Add timeout flag to repo add and update flags 79a9cc5 (Reinhard Nägele)

kyverno/kyverno (kyverno)

v1.16.3

Compare Source

What's Changed

• feat: Implement failureActionOverrides namespaceSelector (Cherry-pick #​13750) by @​kyverno-bot in #​14671
• fix: prevent cross-namespace access in apiCall by @​realshuting in #​14843
• feat(engine): add context size limit by @​realshuting in #​14844
• Release v1.16.3-rc.1 by @​realshuting in #​14872
• Release v1.16.3 by @​realshuting in #​14881

Full Changelog: kyverno/kyverno@v1.16.2...v1.16.3

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.