Backport candidate: CVE-2025-13888 fix not present on v1.13 branch

Hi maintainers,

While auditing supported branches for CVE backports, I noticed that the fix for CVE-2025-13888 (PR #897, commit bc6ac3e0, "fix CVE namespace-isolation break") does not appear to be present on the v1.13 branch.

What I checked

• The v1.13 branch HEAD does not contain the new symbols introduced by the fix:
  • userDefinedMonitoringLabel constant — not present in controllers/argocd_metrics_controller.go on v1.13
  • openshift.io/user-monitoring label literal — not present
  • strings.HasPrefix(namespace.Name, "openshift-") guard — not present
• The pre-fix code path (namespace.Labels[clusterMonitoringLabel] = "true" unconditional) is still present.
• git compare v1.13...bc6ac3e0 reports the branch is 16 commits behind the fix commit and the fix is not in the merged set.

Why this matters

Without the openshift- prefix guard, the operator may add the cluster-monitoring label to namespaces it shouldn't, which is the namespace-isolation issue described in the advisory. If v1.13 is still a supported maintenance branch, a cherry-pick of bc6ac3e0 (or an equivalent fix) would close that gap.

If v1.13 is no longer supported / EOL, please feel free to close — happy to know either way.

Thanks for your work on this project.

— @vulgraph

First verify whether the v1.13 branch is still supported. If it is, inspect controllers/argocd_metrics_controller.go on v1.13 and compare it with commit bc6ac3e0 from PR #897; done means the namespace-isolation fix is present on v1.13, or an equivalent backport is provided. If the branch is EOL, document that status instead.