[Wolfi Package Update]: `argo-cd-3.3-repo-server`
## Package name
argo-cd-3.3-repo-server
## Current version in Wolfi
Depends on `helm~3`, which resolves to **helm-3 3.19.2-r2** (EOL)
## Requested version
Use **rancher-helm-3 (Helm 3.20.x)** or a rebuilt `helm-3` based on Helm 3.20.x
## Upstream project URL
https://github.com/argoproj/argo-cd
## Problem
`argo-cd-3.3-repo-server` depends on `helm~3`, which resolves to the removed and frozen `helm-3` package (3.19.2-r2).
This version carries unfixed Go runtime CVEs:
- **CVE-2025-68121 (CRITICAL)** – crypto/tls session resumption
- **CVE-2025-61732 (HIGH)** – cmd/cgo code smuggling
Helm **3.20.0+** (available via `rancher-helm-3`) contains the fixes.
## Steps to reproduce
NA
## Root cause (if known)
- `helm-3.yaml` was removed in PR **#75622** (December 2025)
- `argo-cd-3.3.yaml` still declares `helm~3` at line ~83
## Proposed solution
- Update dependency to **rancher-helm-3**, **OR**
- Reintroduce `helm-3` based on upstream Helm **3.20.x**
## Testing performed
NA
## Acceptance criteria
- The dependency resolves to a Helm version that includes CVE fixes
- The update aligns with Wolfi’s packaging and security model
- The updated package is maintainable over time
- No known outstanding security or supply-chain concerns
5 条评论