# v3.6 to 3.7 {#v36-to-37}



## Breaking Changes {#breaking-changes}


<!-- Any breaking behavior change:
Any removal or change of default behavior that requires user action -->


## Behavioral Improvements / Fixes {#behavioral-improvements--fixes}



### ApplicationSet webhook responses now match the API server webhook {#applicationset-webhook-responses-now-match-the-api-server-webhook}


The ApplicationSet controller's webhook endpoint now handles requests the same way as the API
server's `/api/webhook` endpoint:

- Payloads larger than the `webhook.maxPayloadSizeMB` value in the `argocd-cm` ConfigMap (default
  50MB) are rejected with `400 Bad Request`. Previously, the ApplicationSet webhook had no payload
  size limit.
- A GHCR event that fails signature verification is rejected with `401 Unauthorized` instead of
  `400 Bad Request`.
- When a payload cannot be parsed, the response body is a generic `Webhook processing failed`
  message. The parser error is logged by the ApplicationSet controller instead of being returned to
  the caller.

If you monitor the ApplicationSet webhook's response codes or bodies, update any checks that relied
on the previous behavior.


## Other Changes {#other-changes}



### Revoked token resync interval {#revoked-token-resync-interval}


`argocd-server` now reloads revoked tokens from Redis every 5 minutes instead of every 15 seconds. The interval is configurable with `ARGOCD_SESSION_REVOKED_TOKEN_RESYNC_DURATION`. See [Revoked token resync](https://sourcey-argocd.pages.dev/operator-manual/user-management/index.md#revoked-token-resync).