Release v3.5 patch releases discussion

[terrytangyuan]

This issue tracks commits for 3.5 patch releases.

[terrytangyuan]

#12025 needs to be fixed for this

[terrytangyuan]

I am thinking about releasing v3.5.1 next week. The most important fix would be #12068 since it blocks people from upgrading to v3.5.

[terrytangyuan]

Security fix: #12111

[terrytangyuan]

#12130

[terrytangyuan]

Released: https://github.com/argoproj/argo-workflows/releases/tag/v3.5.1

[agilgur5]

Would be good to get my UI code-splitting / bundle reductions changes into the next patch release once they're all merged in (#12061, #12097, #12150). They are primarily refactors in content, but their overall intent is to fix long wait times for the UI on slow networks or slow devices as described in #11970

[terrytangyuan]

#12133

[terrytangyuan]

#12203

[terrytangyuan]

TODO: @terrytangyuan to post a list of commits to cherry-pick here

[terrytangyuan]

The plan is to cherry-pick the following commits (unless there's conflict) for v3.5.2 release

Fixes:

• 9eadf2d fix: leak stream (fix: leak stream #12193)
• 206c901 fix: Fix for missing steps in the UI (fix: Fix for missing steps in the UI #12203)
• 939ce40 fix(server): allow passing loglevels as env vars to Server (fix(server): allow passing loglevels as env vars to Server #12145)
• 222d53c fix: Resource version incorrectly overridden for wfInformer list requests. Fixes Controller: High RAM Usage and Frequent Crashes on Large Scale Workflows #11948 (fix: Resource version incorrectly overridden for wfInformer list requests. Fixes #11948 #12133)
• f95a5fc fix: retry S3 on RequestError. Fixes saving log artifact to s3 missing retries #9914 (fix: retry S3 on RequestError. Fixes #9914 #12191)
• 6805c91 fix: ArtifactGC Fails for Stopped Workflows. Fixes Artifacts not set in Status.Nodes | ArtifactGC prevents Workflow deletion #11879 (fix: ArtifactGC Fails for Stopped Workflows. Fixes #11879 #11947)
• 873bacb fix(ui): Cost Opt should only apply to live Workflows (fix(ui): Cost Opt should only apply to live Workflows #12170)

Tests:

• test: add functional tests for memoization without outputs #12215
• test: add test for missing child node #12214

Chore(deps):

• 75d7eb1 chore(deps): bump github.com/aliyun/credentials-go from 1.3.1 to 1.3.2 (chore(deps): bump github.com/aliyun/credentials-go from 1.3.1 to 1.3.2 #12227)
• 63f53ea chore(deps): bump github.com/gorilla/websocket from 1.5.0 to 1.5.1 (chore(deps): bump github.com/gorilla/websocket from 1.5.0 to 1.5.1 #12226)
• b659002 chore(deps): bump golang.org/x/term from 0.13.0 to 0.14.0 (chore(deps): bump golang.org/x/term from 0.13.0 to 0.14.0 #12225)
• bce96ab chore(deps): bump cronstrue from 2.41.0 to 2.44.0 in /ui (chore(deps): bump cronstrue from 2.41.0 to 2.44.0 in /ui #12224)
• c95d9a1 chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 (chore(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0 #12185)
• 877a2e7 chore(deps): bump github.com/go-jose/go-jose/v3 from 3.0.0 to 3.0.1 (chore(deps): bump github.com/go-jose/go-jose/v3 from 3.0.0 to 3.0.1 #12184)
• 460b30a chore(deps): bump golang.org/x/time from 0.3.0 to 0.4.0 (chore(deps): bump golang.org/x/time from 0.3.0 to 0.4.0 #12186)
• a47e462 chore(deps): bump github.com/aliyun/aliyun-oss-go-sdk from 2.2.9+incompatible to 3.0.1+incompatible (chore(deps): bump github.com/aliyun/aliyun-oss-go-sdk from 2.2.9+incompatible to 3.0.1+incompatible #12140)
• 69b47b9 chore(deps): bump monaco-editor from 0.43.0 to 0.44.0 in /ui (chore(deps): bump monaco-editor from 0.43.0 to 0.44.0 in /ui #12142)
• 664569b chore(deps): bump cronstrue from 2.32.0 to 2.41.0 in /ui (chore(deps): bump cronstrue from 2.32.0 to 2.41.0 in /ui #12144)
• 77173a5 chore(deps): bump github.com/creack/pty from 1.1.18 to 1.1.20 (chore(deps): bump github.com/creack/pty from 1.1.18 to 1.1.20 #12139)
• 789c608 chore(deps): bump cloud.google.com/go/storage from 1.33.0 to 1.34.1 (chore(deps): bump cloud.google.com/go/storage from 1.33.0 to 1.34.1 #12138)
• 2f0094c chore(deps): bump react-datepicker and @types/react-datepicker in /ui (chore(deps): bump react-datepicker and @types/react-datepicker in /ui #12096)
• 8f09108 chore(deps): upgrade swagger-ui-react to latest 4.x.x (fix(deps): upgrade swagger-ui-react to latest 4.x.x #12058)
• 5cc8484 chore(deps): bump google.golang.org/api from 0.147.0 to 0.148.0 (chore(deps): bump google.golang.org/api from 0.147.0 to 0.148.0 #12051)
• 7a25c05 chore(deps): bump github.com/coreos/go-oidc/v3 from 3.5.0 to 3.7.0 (chore(deps): bump github.com/coreos/go-oidc/v3 from 3.5.0 to 3.7.0 #12050)
• 35f7208 chore(deps): automatically audit fix UI deps (chore(deps): automatically audit fix UI deps #12036)
• 32d31ab chore(deps): bump google.golang.org/api from 0.143.0 to 0.147.0 (chore(deps): bump google.golang.org/api from 0.143.0 to 0.147.0 #12001)

Others:

• UI code-splitting PRs mentioned in Release v3.5 patch releases discussion #11997 (comment)
• ci: Fix lint check #12245

[Joibel]

Could you add #12215 and #12214 to 3.5.2 please @terrytangyuan, just to ensure those tests are happening.

[agilgur5]

Could we add the UI code-splitting PRs as I mentioned above? I don't think they have a big impact to that many users, so I'm fine with it going in 3.5.3 instead if you'd prefer to keep 3.5.2 smaller/more stable.

Otherwise commit list LGTM ✅

[terrytangyuan]

@Joibel Good idea.

@agilgur5 I'd like to focus on fixes and chore(deps) in patch releases.

[agilgur5]

As I wrote above:

They are primarily refactors in content, but their overall intent is to fix long wait times for the UI on slow networks or slow devices as described in #11970

I would definitely not call them features at least

[agilgur5]

We probably want #12245 as well since #12225 and #12227 are in the list and may break lint again on the 3.5.x branch

[terrytangyuan]

I would definitely not call them features at least

Sounds good. In the future, let's make sure the PR titles can tell us that.

[agilgur5]

Yea each PR individually is more of a refactor, but as a whole they are a fix -- in other words, a bunch of refactors that enable a fix.
Naming things is a hard problem 😅 ; as always feel free to change the titles if that makes things easier for you to release

[terrytangyuan]

Working on branch https://github.com/argoproj/argo-workflows/tree/release-3.5.2

Note that I also included some merged dependabot PRs from master branch and some of the dependabot PRs cannot be cherry-picked.

[terrytangyuan]

v3.5.2 tag created https://github.com/argoproj/argo-workflows/releases/tag/v3.5.2

[juliev0]

Request to include #12353

[terrytangyuan]

This needs to be included #12470

[agilgur5]

#12421 is also a fix for a 3.5.0 feature

[sarabala1979]

Hi
I am working on release v3.5.3 which includes below PRs
#12421
#12470
#12353

[agilgur5]

Updating here that 3.5.3 was released

[agilgur5]

#12397 for the next release

[terrytangyuan]

You should be able to create a tag now.

[terrytangyuan]

https://github.com/argoproj/argo-workflows/releases/tag/v3.5.5

Thanks @agilgur5 and @isubasinghe!

[z63d]

Would you consider cherry-picking #12312 into the v3.5 release branch? You can find more details in #12829.

[agilgur5]

Would you consider cherry-picking #12312 into the v3.5 release branch?

Completed in #12312 (comment)

[yulin-li]

could we make a patch release for recent CVE fixes?

[terrytangyuan]

Yes, we should release a patch for security fixes.

[terrytangyuan]

#12900 and #12901

[SlaterByte]

@isubasinghe, I see that #12413 was originally included as a feature addition for v3.5.5, but the was removed from your final comment. Is this feature being bumped to v3.5.6 or to a v3.6.x release? I see a few followup PRs ( #12596, #12632, #12862) as well, so maybe there was a stability concern? Looking forward to getting this feature released. Thanks!

[agilgur5]

I see that #12413 was originally included as a feature addition for v3.5.5, but the was removed from your final comment. Is this feature being bumped to v3.5.6 or to a v3.6.x release?

It's a feature, so it will be released in the next minor, v3.6.

[agilgur5]

#12900 and #12901

Backported both to release-3.5

[agilgur5]

Released v3.5.6

[terrytangyuan]

Any objections to cherry-pick #12736 to the next 3.5 patch release?

[agilgur5]

Nope, had been planning to do so since it's a feature that fixes substantial 3.5 regressions (so long as it didn't break anything). Had also added the 3.5.x milestone to the respective issues

[terrytangyuan]

I am planning to only cherry-pick important fixes to 3.5.7. Please comment on this issue if you'd like to include any specific commits. Here's the current list:

• feat: add sqlite-based memory store for live workflows. Fixes #12025 #13021
• fix: ignore retry node when check succeeded descendant nodes. Fixes: #13003 #13004
• fix: nodeAntiAffinity is not working as expected when boundaryID is empty. Fixes: #9193 #12701
• fix: delete skipped node when resubmit with memoized.Fixes: #12936 #12940
• fix(deps): upgrade swagger-ui-react v5.17.3, react-dom v18.3.1, and react v18.3.1. Fixes CVEs #13069

[Joibel]

I'd like to get #13004 in to 3.5.7 please. It needs an approver review.

[shuangkun]

could #12701 be reviewed, it fixes a very old p1 issue #9193

[shuangkun]

could #12936 be added， some user needs it #12936 (comment)

[terrytangyuan]

All added to the list.

[agilgur5]

I am planning to only cherry-pick important fixes to 3.5.7

@terrytangyuan maybe I should've clarified before, I might've misunderstood the intent your question during this week's Contributor Meeting.
I've already been cherry-picking all fixes and deps security upgrades on an ongoing basis (roughly weekly, sometimes quicker), per the "release manager" approach I suggested in #12592 (comment).
So fixes that landed before your comment are likely already cherry-picked in.

I've also been using the v3.5.x patches milestone I created to track everything

• feat: add sqlite-based memory store for live workflows. Fixes #12025 #13021

Regarding this one, we should cherry-pick the original PR (#12736), the revert with CI fix (#13018), and the fixed PR (#13021). As that would reduce merge conflicts and have a cleaner and more matching git history (which also helps with our scripts etc). I'll probably do that today

[terrytangyuan]

UI security fix: #13069

[terrytangyuan]

@agilgur5 Can you help make sure all PRs in the list #11997 (comment) are cherry-picked into release branch and then we can push the tag?

[agilgur5]

UI security fix: #13069

This would require a several other backports to make work as I detailed in #13069 (review).
Argo v3.5 is on swagger-ui-react v4 as #12540 was never backported and then there are several React incompatibilities with that PR itself as well.

@agilgur5 Can you help make sure all PRs in the list #11997 (comment) are cherry-picked into release branch and then we can push the tag?

Other than the above, yes, that was my plan.

[agilgur5]

Released v3.5.7.

Includes all merged fixes and security patches except for two due to #13069 (review) and #13012 (comment).

Also lots of docs backports and a few CI security backports

See the changelog for more details: #13096