DEV Community: Jason St-Cyr

Security Compliance Management 3.9.0 now supports Ubuntu 24.04, RHEL 10, Puppet Core 9 and new benchmarks!

Jason St-Cyr — Thu, 27 Aug 2026 14:29:27 +0000

The latest Security Compliance Management (SCM) 3.9.0 has new supported platforms, improvements for air-gapped environments, benchmark updates, feature improvements, and security updates to address vulnerabilities.

Highlights

Expanded platform support: SCM 3.9.0 now supports Ubuntu 24.04, Red Hat Enterprise Linux (RHEL) 10, and Puppet 9
Private image registry support: complyadm can now pull SCM container images from a private image registry to better support air-gapped and private-registry environments.
IP-based access restrictions: Keycloak Administration Console and Admin REST APIs can now be access restricted to IP addresses defined in the frontdoor allowlist.
Expanded benchmarks: CIS-CAT Pro Assessor was updated to 4.65.0, expanded benchmark support for AlmaLinux and MacOS, and updated coverage on Microsoft Windows.
119 security vulnerabilities addressed via updates and fixes, along with several other security hardening fixes.

Below are some other summary details, but you may want to jump straight into the full release notes right away!

CIS-CAT Pro Assessor Updates

Along with updating to CIS-CAT Pro Assessor 4.65.0, the following benchmarks were added:

AlmaLinux OS 9 STIG v1.0.0
Apple macOS 15 (Sequoia) STIG v1.1.0
Apple macOS 26 Tahoe STIG v1.0.0

These supported benchmarks were also updated:

Microsoft Windows 11 Enterprise Benchmark v5.1.0
Microsoft Windows Server 2022 Benchmark v5.1.0
Microsoft Windows Server 2025 Benchmark v2.1.0

Operational Improvements and Security updates

There were several changes made to improve behavior and address vulnerabilities in this release, including addressing 119 security reports.

A few notable changes:

SCM handles interrupted scheduled scans after reboots more reliably.
Default benchmark selection is now more reliable when multiple non-STIG benchmarks are available.
Hasura GraphQL field suggestions are now disabled to prevent schema enumeration.

See the full list in the release notes!

Why Upgrade?

For customers running Ubuntu 24.04, RHEL 10, Puppet 9, private registries, or security-sensitive environments, SCM 3.9.0 delivers meaningful operational, platform, and security improvements. Combined with expanded benchmark coverage and enhanced upgrade behavior, this release helps organizations maintain compliance with greater confidence and less administrative overhead.

View the full SCM 3.9.0 release notes!

🤖 AI Disclosure

This summary was initially drafted by AI and deterministic automation to pull together release notes information from the latest Security Compliance Management 3.9.0 release notes. The draft was then human edited, rewritten, and reviewed before publishing.

Puppet Core 9.0 and 8.21 Released: Ruby 4.0, OpenSSL 3.5, Platform Changes, and Security Hardening

Jason St-Cyr — Thu, 20 Aug 2026 15:26:21 +0000

Did you know there's a new major version in town for Puppet Core? You might have heard about it through the grapevine or in the Are You Ready for Puppet 9? webinar that @gpatton and I recently hosted. The wait is over and Puppet Core 9.0.0 is now available alongside Puppet Core 8.21.0.

Puppet Core 9 introduces significant runtime and platform changes, moving to Ruby 4.0, OpenSSL 3.5, and other changes, but the essential Puppet under the hood is largely unchanged from Puppet 8. The majority of upgrade effort will center on Ruby 4 compatibility and runtime dependency changes rather than Puppet language changes.

If you are staying on the Puppet Core 8.x release track, the latest Puppet Core 8.21 delivers the basic support fixes and security improvements you might need without the major dependency changes found in Puppet Core 9.

What matters most for the admins

Before upgrading to Puppet Core 9:

Test custom facts, functions, types, and providers against Ruby 4.0.
Validate any Forge modules you use for Ruby 4 compatibility.
Review integrations that depend on OpenSSL behavior.
Verify any workflows that still rely on SHA-1.
Confirm managed nodes are running supported operating systems.
Review any custom code that depends on PSON or multi_json.
Check deferred function behavior if you have custom types or providers.

Perforce will be rolling out updates to Puppetlabs modules on the Forge based on their priority tier and dependencies. The first batch of these should be rolling out soon.

Puppet Core 9.0 highlights

These are a few highlights I pulled from the release notes. Make sure to reference the full 9.0 release notes to get all the details about what has changed!

Ruby updated to 4.0.5: With a new Ruby baseline some deprecated syntax from older Ruby versions will no longer be compatible. This is the primary focus area for upgrades as you will want to validate your custom code and modules. The latest PDK 3.8.0 introduced some Ruby 4 validators to help you update your syntax while you are still on Puppet Core 8, before upgrading to Puppet Core 9.
OpenSSL updated to 3.5.7: This lays the groundwork for supporting post-quantum cryptography (PQC) and moves to TLS 1.3 as the default protocol version. This upgrade will resolve several OpenSSL-related CVEs.
Puppet Server has updated baseline components: As part of the move to JRuby 10.1, Puppet Server is now updated to require minimum JDK 21. The embedded web server is now using Jetty 12.
PSON support removed: You will need to migrate to a supported data format if your code has relied on PSON.
Deferred functions return to Puppet 7 behavior: While Puppet Core 9 largely keeps the same underlying behavior as Puppet Core 8.x, there is one change worth noting about deferred functions. In older versions (like Puppet 7), preprocess_deferred was enabled by default, but this was disabled by default in Puppet 8. In Puppet Core 9, preprocess_deferred is now enabled by default again.
UTF-8 encoding now used on Windows: Puppet Core now uses UTF-8 as the default external encoding on Windows. You will want to look for any configuration files encoded in non-UTF-8 before upgrading.

These are just some highlights I pulled from the full list, I really recommend taking a look at the release notes to get a full picture.

Security hardening

Both the 9.0 and 8.21 releases contain security-related fixes.

Stricter SSH key validation: Puppet now rejects malformed SSH keys that previously passed validation. This includes invalid inputs such as embedded newline characters. The goal is to prevent unsafe content from being written to managed files.
Improved autoloader validation: The puppet resource command now performs stricter validation of autoloader inputs. This change helps prevent unintended code loading through user-controlled values.
curl updated to 8.21.0: Both Puppet Core 9.0 and Puppet Core 8.21 update curl from 8.20.0 to 8.21.0. The update addresses numerous curl CVEs.

Admins who track dependency risk should review the release notes for the complete CVE list:

Platform updates

New agent platforms

The following agent platforms are now supported in both Puppet Core 9.0 and 8.21:

Rocky Linux 10 (x86_64)
Alma Linux 10 (x86_64)

Operating systems removed from support

Several end-of-life operating systems have been removed: Debian 10, macOS 13, RHEL 7, Ubuntu 18.04 and 20.04, and others.

The official full list is in the docs. The list in this article is not complete, so make sure to reference those notes to check your systems!

If you need to keep using a platform that has been removed you should know there is an extended support option. Migrating to a more modern OS is likely the best path, but if you can't migrate just yet, make sure to reach out to the team to get help with extended platform support

Upgrade resources

Before moving to Puppet Core 9, review the official upgrade documentation and release notes:

Make sure to start your Puppet Core 9 compatibility testing early and send over any questions as you encounter issues so that the team can help!

PDK 3.8.0 now has Ruby validation to prepare for Puppet 9!

Jason St-Cyr — Tue, 11 Aug 2026 12:53:45 +0000

A new release is out for the Puppet Development Kit and it has some new additions like Debian 13 support, some security-related updates, and some new validation for Ruby syntax to help you get yourself ready for Puppet Core 9!

The next releases of Puppet Core 9 and Puppet Enterprise 2026, due out soon, will be moving to Ruby 4. To help you get ready, you can start using this new version of PDK on your Puppet 8 installation to look for areas that might need updates.

When you run pdk validate, it can now identify changes you can make that will be safe to run on Puppet 8, but also will prepare your codebase for Puppet Core 9:

Code that uses legacy Ruby Hash#inspect formatting, for example {:x=>1, "baz"=>3} . Legacy formatting can cause module code to fail after you upgrade to Puppet Core 9.
Ruby 4 syntax compatibility checks.
The Security/Open Rubocop flags Ruby patterns associated with Kernel#open and IO.open invocation that are no longer valid in Ruby 4.

Once Puppet Core 9 is out, you'll be able to do additional validation, but this should help you get started finding those places where the syntax might need some updates.

Full release notes: https://help.puppet.com/pdk/current/topics/release_notes_pdk.htm#PDK380

Download PDK: https://forge.puppet.com/resources/pdk

Puppetlabs Modules Roundup - July 2026

Jason St-Cyr — Thu, 06 Aug 2026 12:19:41 +0000

July 2026 brought 17 Puppetlabs module releases, headlined by a fairly large Continuous Delivery release. cd4peadm 5.16.0 added external PostgreSQL database support and a configurable image pull policy, and closes 11 CVEs, alongside a breaking change to commit status contexts. More modules dropped Puppet 7 support, some others picked up stdlib 10, and Windows Server 2025 support started rolling out into the modules. This roundup pulls the most important changes into one place.

Highlighted Updates

Continuous Delivery Adds External Databases, Configurable Image Pull Policies, and Closes 11 CVEs

cd4peadm 5.16.0 is the biggest release of the month. It adds support for pointing Continuous Delivery at an externally managed PostgreSQL database. That could be a self-managed instance, Amazon RDS for PostgreSQL, or Amazon Aurora. This externally managed db can be used instead of the database CD manages internally, giving operators control over durability, backups, and high availability. It also adds a configurable image_pull_policy option for job templates (Always/IfNotPresent/Never) and removes the docker.io fallback when using Podman; the matching cd4pe_jobs 1.7.4 release adds the same task parameter and fallback removal, so upgrade both together.

BREAKING: Commit status contexts now include the pipeline name (cd-pe/<pipelineName>/stage-<N> instead of cd-pe/stage-<N>). Review any branch protection rules or required status checks that reference the old format.
This release also closed 11 CVEs across opentelemetry, NGINX, jetty, jackson, log4j, postgresql, golang.org/x/sys, and react-router.

Puppet 7 Support Dropped

Five modules dropped Puppet 7 support in major version bumps:

haproxy, iis, mount_iso, scheduled_task, sslcertificate.

There were all released as major version bumps to ensure that users still working on upgrading from Puppet 7 can stay pinned on the previous major version releases.

In related news, postgresql 10.6.3 restored the Puppet 7 support that 10.6.2 broke in a previous release; see its entry below.

stdlib 10.x Rollout Continues

Following June's stdlib 10.x rollout, four more modules now allow the puppetlabs-stdlib dependency to move to 10.x: haproxy, mount_iso, puppet_authorization, and sslcertificate. haproxy also widens its concat constraint to 10.x.

Affected modules: haproxy, mount_iso, puppet_authorization, sslcertificate.

Windows Server 2025 Support Added

Three Windows-focused modules added support for Windows Server 2025 this month: scheduled_task, windows_env, and windows_eventlog. These now all run acceptance testing against the 2025 version of the OS, in addition to other supported Windows versions.

What Updates Happened to Puppetlabs Modules in July 2026?

The following is an alphabetical listing of modules which received updates in July 2026. If a module had multiple versions released, the updates are collected together, numbered with the "latest" version available.

apache 13.3.0

📅 Latest release: 2026-07-23 (🌐 View on the Forge)

Added OWASP CRS v4 support on modern Enterprise Linux (EL10) while preserving existing EL7/8/9 behaviour.

(MODULES-11857) Scaffold OWASP CRS v4 support on EL10 via crs_source enum #2637 (SugatD)

cd4pe_jobs 1.7.4

📅 Latest release: 2026-07-28 (🌐 View on the Forge)

Adds the same configurable image_pull_policy task parameter and Podman fallback removal shipping in cd4peadm 5.16.0 — upgrade both together to get matching behavior.

A new optional image_pull_policy task parameter controls whether the container image is pulled before a job runs: Always (the default, and the previous behavior) pulls on every run; IfNotPresent pulls only when the image is absent from the local runtime; Never skips the pull entirely and relies on the locally present image. Presence is checked with docker image inspect / podman image exists. Omitting the parameter keeps the existing pull-every-run behavior.
The module no longer retries a failed image pull against docker.io. Image names are now pulled exactly as given. If you rely on unqualified image names (e.g. nginx, myuser/myimage) on a Podman host, add docker.io to unqualified-search-registries in registries.conf, or use a fully-qualified name.

cd4peadm 5.16.0

📅 Latest release: 2026-07-29 (🌐 View on the Forge)

The changes this month added external PostgreSQL database support, a configurable image pull policy, source control token management improvements, and closed 11 CVEs. There is also a breaking change to commit status contexts — see below (and the linked release notes).

Added support for external databases. You can now point Continuous Delivery at a PostgreSQL instance you operate yourself, Amazon RDS for PostgreSQL, Amazon Aurora (PostgreSQL-compatible), or a self-managed PostgreSQL server, instead of the database CD manages for you. This gives you control over durability, backups, and high availability. You can configure external mode on a fresh install or migrate an existing managed install.
Added a feature to Continuous Delivery job templates so you can set an image pull policy per job (Always, IfNotPresent, or Never). In an air-gapped environment, for example, setting the policy to Never stops Continuous Delivery's attempts to reach out to the internet for the image.
Updated the Source Control settings page to show when a configured Personal Access Token (PAT) expires on each connected GitHub, GitHub Enterprise, and GitLab integration card. Tokens that have already expired or will expire within 30 days are clearly flagged so you can renew them before they cause failures.
BREAKING: Commit status contexts now include the pipeline name (cd-pe/<pipelineName>/stage-<N> instead of cd-pe/stage-<N>), which prevents collisions when multiple pipelines report status for the same commit. Review any branch protection rules or required status checks that reference the old format.
11 CVEs addressed, including opentelemetry, NGINX, jetty, jackson, log4j, postgresql, golang.org/x/sys, and react-router.

Check the official release notes for cd4peadm 5.16.0 for the full details.

comply 3.8.1

📅 Latest release: 2026-07-03 (🌐 View on the Forge)

A Security Compliance Management maintenance release that did not have any new CVE fixes this time and was mostly operational and licensing improvements.

Increased the CIS-CAT Pro Assessor license expiry time; licenses are now good for a full year.
Added a license_path parameter to update the CIS-CAT Pro Assessor license without upgrading SCM.
Added an assessor_scan_timeout option to control the task timeout for Windows 2022 domain controllers.
Added a background scan sweeper that detects and cancels scans stuck in a "running" state.
Increased the default Max graphql requests limit to 300 requests per window; use the complyadm::configure Bolt plan to customize.

Check the official release notes for comply 3.8.1 for the full details.

haproxy 9.1.0

📅 Latest release: 2026-07-28 (🌐 View on the Forge)

Two releases this month: 9.0.0 dropped Puppet 7 support (BREAKING) and added cache resource support, while 9.1.0 removed a sensitive-data workaround and allows both stdlib and concat to move to their 10.x releases.

Includes monthly releases: 9.1.0 (2026-07-28), 9.0.0 (2026-07-20).

Eliminate Workaround for Sensitive Data; raises minimum puppetlabs/concat requirement to 7.4.0 #607 (cocker-cc)
Add support for running programs #604 (deric)
Pass install_options to package installer #603 (deric)
examples: disable default stats listener #640 (bastelfreak)
make picking haproxy::globals::sort_options_alphabetic work #573 (trefzer)
Remove Puppet 7 support (BREAKING); the module now requires puppet >= 8.0.0 < 9.0.0 #631 (gavindidrichsen)
Add support for cache resource, extra backend options, and docs #626 (matejzero)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #642 (imaqsood)
Allow puppetlabs/concat 10.x #641 (bastelfreak)
dependency: create mapfile before configfile #572 (trefzer)

iis 11.0.0

📅 Latest release: 2026-07-01 (🌐 View on the Forge)

Dropped Puppet 7 support (BREAKING) as part of ongoing modernization efforts, and marked the iis_application_pool password parameter as sensitive so it no longer leaks into Puppet reports.

(CAT-2374) Puppet Core update (BREAKING) — drops Puppet 7 support #414 (LukasAud)
(MODULES-11595) Mark iis_application_pool password as sensitive to stop report leak #418 (imaqsood)

mount_iso 5.0.0

📅 Latest release: 2026-07-22 (🌐 View on the Forge)

Dropped Puppet 7 support (BREAKING) and allowed the stdlib dependency to move to 10.x.

(CAT-2380) Update for Puppet Core / Drop Support for Puppet 7 (BREAKING) #58 (david22swan)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #59 (imaqsood)

mysql 17.1.0

📅 Latest release: 2026-07-02 (🌐 View on the Forge)

This month was a small update but important as RHEL 10 support was added.

(MODULES-11802) Add support for RHEL 10 #1712 (skyamgarp)

node_encrypt 3.2.0

📅 Latest release: 2026-07-22 (🌐 View on the Forge)

Adds Ubuntu 24 and Debian 12 support, and upgrades rexml to address a CVE.

(CAT-2124) Add support for Ubuntu 24 #120 (skyamgarp)
(CAT-2100) Add Debian 12 support #119 (shubhamshinde360)
(CAT-2158) Upgrade rexml to address CVE-2024-49761 #121 (amitkarsale)

peadm 3.38.1

📅 Latest release: 2026-07-08 (🌐 View on the Forge)

Restores public-schema privileges on PostgreSQL 15+ in restore.pp, fixing a bug that could affect PE restores on newer PostgreSQL versions.

(PE-44867) Restore public-schema privileges on PostgreSQL 15+ in restore.pp #676 (CharithaDunuwille)

postgresql 10.6.3

📅 Latest release: 2026-07-07 (🌐 View on the Forge)

Restores Puppet 7 support that was unintentionally dropped in the 10.6.2 patch release last month.

NOTE: As flagged in June's roundup, the Puppet 7 removal in 10.6.2 shipped in a patch release rather than a major one. 10.6.3 restores Puppet 7 support; the removal will happen again, correctly, in a future major release.

(MODULES-11858) Restore Puppet 7 support broken by 10.6.2 #1686 (imaqsood)

puppet_authorization 1.0.1

📅 Latest release: 2026-07-21 (🌐 View on the Forge)

A maintenance release: allows both the stdlib and concat dependencies to move to 10.x, tweaks a CI workflow flag, and adds a LICENSE file.

Change flag option in CI workflow #56 (zaben903)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #57 (imaqsood)
puppetlabs/concat: Allow 10.x #55 (bastelfreak)
Create LICENSE #52 (binford2k)

sce_linux 2.8.0

📅 Latest release: 2026-07-28 (🌐 View on the Forge)

Updates CIS Benchmarks from v3.0.0 to v4.0.0 for RHEL 8, AlmaLinux 8, and Oracle Linux 8, with matching control updates for each, and fixes three bugs affecting benchmark enforcement.

Updated CIS Benchmarks. RHEL 8, AlmaLinux 8, and Oracle Linux 8 move from CIS Benchmark v3.0.0 to v4.0.0, with matching control updates for each operating system.
Updated dependency. SCE for Linux now supports puppetlabs-stdlib >= 9.2.0 < 11.0.0; avoid using earlier stdlib versions.
Fixed: the user-specified default_zone setting was not enforced for CIS control 3.4.1.2; it is now enforced correctly.
Fixed: aide --init failed on RHEL/AlmaLinux/Oracle Linux/Rocky Linux 8 hosts shipping AIDE 0.17.x, which renamed the database= directive to database_in=.
Fixed: CIS control 6.2.2.2 (journald log-forwarding) did not work as designed on RHEL/AlmaLinux/Oracle Linux/Rocky Linux 9 and 10; control 6.2.3.3 was also added.

Check the official release notes for sce_linux 2.8.0 for the full details.

scheduled_task 5.0.0

📅 Latest release: 2026-07-13 (🌐 View on the Forge)

Drops Puppet 7 support (BREAKING) and also adds Windows Server 2025 support.

(CAT-2391) Puppet Core upgrade (BREAKING) — drops Puppet 7 support #271 (LukasAud)
[MODULES-11616] Adding Windows 2025 support to module #275 (jst-cyr)
Update link to contributing documentation #273 (jst-cyr)

sslcertificate 6.0.0

📅 Latest release: 2026-07-22 (🌐 View on the Forge)

Drops Puppet 7 support (BREAKING) and allows the stdlib dependency to move to 10.x.

(CAT-2394) Puppet Core update (BREAKING) — drops Puppet 7 support #142 (LukasAud)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #143 (imaqsood)

windows_env 6.1.0

📅 Latest release: 2026-07-21 (🌐 View on the Forge)

Adds Windows Server 2025 support.

(MODULES-11891) Add Windows Server 2025 support #115 (imaqsood)

windows_eventlog 5.1.0

📅 Latest release: 2026-07-22 (🌐 View on the Forge)

Adds Windows Server 2025 support.

(MODULES-11892) Add Windows Server 2025 support #98 (imaqsood)

Until Next Time!

That wraps up the July 2026 roundup. If any of these modules intersect with your environment. especially the cd4peadm breaking change to commit status contexts and the Puppet 7 removals, the linked Forge pages and release notes are worth a closer look before upgrading.

Feedback on the series is always useful, especially if there are module families or release-note patterns that deserve more attention in future editions!

More updates coming next month when the August 2026 releases land.

🤖 AI Disclosure

This roundup is produced by a mostly-automated pipeline, with some AI sprinkled in for orchestration and enrichment (or 'Combobulating' and 'Finagling'), followed by a human review (that would be me) before publishing.

The automation is an open-source project with deterministic python scripts to crawl the Forge and determine which puppetlabs modules were released during a specific month (and catching when a module gets more than one release in a month). By combining a template, automation scripts, and some AI orchestration the content all gets pulled together for a structured markdown document. I then jump in to double-check the content and update any wording that seems repetitive or irrelevant (and sometimes I need to add some extra context that isn't in the changelog notes).

New Benchmarks now Available for Puppet SCE for Linux

Jason St-Cyr — Thu, 30 Jul 2026 11:49:16 +0000

Security Compliance Enforcement (SCE) for Linux 2.8.0 is now available, delivering updated CIS Benchmark coverage along with improvements to policy enforcement, auditing, and logging reliability. These updates help organizations strengthen compliance programs, reduce operational risk, and maintain confidence that Linux systems remain aligned with security and governance requirements. SCE for Linux is available as part of Puppet Core and Puppet Enterprise Advanced.

Why Upgrade?

Stay aligned with current CIS guidance through updated benchmark coverage for major enterprise Linux distributions.
Improve audit readiness with expanded benchmark coverage and updated compliance checks.
Reduce operational risk through fixes that improve firewall, integrity monitoring, and logging behavior.
Increase confidence in enforcement by addressing issues that could prevent configurations from being applied as intended.

What's New?

Updated CIS Benchmark support for RHEL 8, AlmaLinux 8, Oracle Linux 8, and Rocky Linux 8.
Enhancements that improve alignment with current benchmark recommendations across system hardening, auditing, networking, and account management.
Reliability improvements for firewall zone enforcement, AIDE-based integrity monitoring, and log forwarding.
Updated platform dependencies to support ongoing compatibility and maintainability.

Security and Maintenance Updates

This release includes maintenance updates and issue resolutions that help improve platform stability, reduce security risk, and support more reliable compliance operations.

Next Steps

Review the release notes for complete details and upgrade guidance, then plan your upgrade to take advantage of the latest benchmark coverage and reliability improvements.

If you're new to SCE, visit the documentation page to learn how it helps automate compliance assessments, policy enforcement, and ongoing audit readiness across enterprise Linux environments.

Building with AI: Our Approach to Responsible Agentic Development in Open Source

Jason St-Cyr — Tue, 28 Jul 2026 12:36:14 +0000

The tech world has been building up towards the shift to a fully agentic development life cycle for a few years now. AI is changing how software gets built.

Across the Puppet ecosystem, we're seeing a shift toward more agentic engineering workflows. AI helps generate code, shape documentation, and accelerate how Puppet modules evolve. This brings real benefits in speed and consistency, but it also raises important questions from the community:

How are AI-generated changes validated?
How do you ensure consistency across modules?
What does this mean for contributors and maintainers?

These are exactly the kinds of questions we should be asking! This article will outline how Perforce and the Puppet team are approaching the use of AI in our open source modules and repositories.

How We Build Trust in AI-Assisted Contributions

At Perforce, AI is a core part of our process and our teams operate within a defined, governed framework for development. We don’t rely on trust in the tool itself. We rely on the processes around it.

Whether a change is written by a person, generated with AI, or some mix of both, they are held to the same standards before it’s accepted and released.

In practice, that means:

Human review is always the gate: Every change is reviewed by maintainers. AI can assist, but it doesn’t replace accountability.
AI works within established patterns: AI-generated code isn’t created in isolation. It’s guided by the same module structures, conventions, and expectations that already exist across the ecosystem.
Validation is continuous and enforced: AI doesn’t change our standards. It reinforces them. AI-generated changes go through the same checks as any other contribution:
- Test suites
- Integration validation
- Functional verification
AI output is a starting point, not a final artifact: Generated code is iterated on, refined, and aligned before acceptance. We treat AI as an accelerator, not an authority.
The community plays an important role Open source means visibility. The community can review changes, raise issues, and contribute ideas. That feedback loop adds another layer of resilience and helps shape how these workflows evolve.

At a high level, our approach is simple: the outcome matters more than how the code was created.

Community Contributions and AI

Community members are not required to use code assist tools when providing contributions to Puppet open source projects, even when those projects contain frameworks or files designed to support coding agents.

Contributions can be made using any tools or workflows that work best for you and there is no expectation to match the Perforce technology stack. While the Puppet team will be adding instructions, skills, and other artifacts to support agentic workflows, including tools like Claude Code, these are provided as optional enhancements, not requirements.

When contributions are reviewed, the same standards apply regardless of how they were created. This includes contributions that contain AI-generated code, are submitted by AI agents, or have been tested or reviewed using AI tools. We welcome contributions in any form, but all submissions go through the same review and approval process before they are accepted and released.

Maintaining Consistency Across the Ecosystem

Another important question we hear is how we avoid duplication or inconsistency as AI becomes part of the workflow. This is where ecosystem-level thinking and governance matter most and where we will be incrementally improving our engineering patterns.

Here’s how we approach that:

Changes are evaluated in context We don’t review contributions in isolation. We look at how they relate to existing modules and whether similar functionality already exists.
Reuse is prioritized over duplication When reviewing changes, we actively ask whether something can be reused instead of reimplemented. This helps maintain DRY principles across the ecosystem—not just within a single module.
Shared patterns guide development AI-assisted changes are aligned to standard module structures, established design patterns, and proven implementation approaches. This helps ensure consistency even as contribution velocity increases.
Documentation is treated as part of the system Generated documentation and supporting artifacts are treated as first-class components. This improves clarity, supports reuse, and helps maintain long-term consistency across modules.

Governance Is Built In, Not Bolted On

Building with AI tools is not left to individual discretion. AI usage at Perforce follows structured processes designed to ensure quality, security, and accountability across the lifecycle.

Here’s what that looks like for Puppet open source teams:

AI tools and workflows are intentionally reviewed We evaluate how AI tools are used within our development process, including how they interact with existing systems and patterns. Only tools approved for use by the Perforce AI governance team can be used for agentic development by Perforce employees.
Risks and dependencies are actively managed Using agentic development flows introduces new considerations from code duplication to unintended behaviors. These are identified, reviewed, and addressed as part of normal development workflows.
Security and compliance are built into the process AI-assisted development operates within the same security, permission, and compliance boundaries as any other contribution.

AI usage is part of a broader AI management system aligned with ISO 42001, ensuring responsible use across the lifecycle.

We also recognize the broader concerns around AI. We're deliberate about how and where AI is used. At its core, governance is about maintaining control while enabling progress. AI should operate within the systems teams already trust, not bypass them.

Our Commitment to the Open Source Community

This evolution isn’t happening in isolation. The Puppet modules team works within an open source ecosystem and it’s important that the community is informed about AI usage and included so that all members of the community are able to provide feedback as these processes evolve.

Our goal is to provide:

Clear communication about AI-assisted changes
Transparency in how contributions are reviewed
Ongoing dialogue as workflows evolve

This is a new world of software delivery that we all maintainers and contributors are collaborating in, and we'll need to work together to find the right process for everyone.

What This Means Going Forward

The agentic software development lifecycle is going to continue to shift and grow. AI will continue to play a growing role in how modules are developed and maintained.

In your favorite Puppetlabs modules, you are going to see:

Structural documentation, skills, instructions, and other frameworks to support agentic development
More AI-assisted contributions to open source repos
More structured documentation that aligns across the ecosystem
An increase in iteration cycles as agentic workflows grow and stabilize

There is one thing that won't change: Every contribution will be held to the same standards of quality, consistency, and trust.

In the end, trust in AI doesn’t come from the model. It comes from the systems, processes, and people behind it.

We want to hear from the community as we continue to evolve these practices and develop a solid agentic-supported workflow for our open source community. We’d love your feedback, so please share your thoughts here or in the Puppet Community Slack.

Additional Resources

These additional resources could be helpful if you are interested in this topic and want to learn more!

AI Governance at Perforce (trust.perforce.com)
Perforce AI Products and Features Achive ISO 42001 Certification (perforce.com)

🤖 AI Disclosure

You'll probably notice a few tell-tale structural suggestions from AI on this one. I experimented with drafting with AI on this one, using our AI Governance documentation and some context I provided about how we work on the Puppet team. From that draft, it has gone through multiple human reviews and a LOT of editing and rework, with a final review by an AI agent for brand voice alignment.

Puppetlabs Modules Now Have Tiered Review Cycles

Jason St-Cyr — Tue, 14 Jul 2026 14:16:39 +0000

If you've been watching the Puppetlabs namespace on the Forge (or waiting on a pull request you opened) you've likely noticed that the pace of inclusion of community pull requests and fixes into the module releases has slowed over the last several cycles. That isn't how we want to serve the community that built these modules with us. The team has been reviewing how we can improve and this post is our commitment to do better. Here are the steps we're taking now:

Clear tiers with review cadences. Modules in the puppetlabs namespace will be grouped into three tiers, each with a defined review schedule (weekly, monthly, or quarterly).
Defining what “review cadence” means in practice. Every community PR gets engineering review in the next scheduled cycle for that module’s tier.
Showing progress monthly. We’ll continue to publish the monthly Modules Roundup covering what was released.

A Tiered Approach to Priorities

We've categorized supported modules in the puppetlabs namespace into three tiers, each with a defined community review cadence:

Tier	Count	Community review cadence
Tier 1: core, business-critical modules	25	Weekly
Tier 2: important, meaningfully used modules	19	Monthly
Tier 3: niche or low-usage modules	22	Quarterly

What a Review Cadence Means

Every community pull request (PR) on a module in the puppetlabs namespace gets engineering review during the next scheduled cycle for that module's tier. This doesn’t mean that every PR will be accepted. Sometimes a pull request needs feedback or changes, some pull requests won't fit a module's direction, but the cadence is intended to make sure that PRs will no longer sit quietly in a queue. That is the baseline we're holding ourselves to with these tiers and review cadences.

We do have a backlog of requests over the years and we will be working through that backlog as well, but priority will be given to active contributions for the purposes of our review cadence.

Tier 1: Our highest-priority modules

The following modules are our committed Tier 1 set. These modules will get a weekly review, with nightly CI coverage, and get priority on maintenance capacity:

puppetlabs-apache
puppetlabs-apt
puppetlabs-augeas_core
puppetlabs-concat
puppetlabs-cron_core
puppetlabs-docker
puppetlabs-firewall
puppetlabs-haproxy
puppetlabs-inifile
puppetlabs-java
puppetlabs-java_ks
puppetlabs-lvm
puppetlabs-mount_core
puppetlabs-mysql
puppetlabs-ntp
puppetlabs-package
puppetlabs-postgresql
puppetlabs-powershell
puppetlabs-reboot
puppetlabs-registry
puppetlabs-ruby_task_helper
puppetlabs-service
puppetlabs-sshkeys_core
puppetlabs-stdlib
puppetlabs-vcsrepo

Tier 2: Monthly reviews

The following modules have currently been assigned to our Tier 2 for prioritization. These modules will get a monthly review.

puppetlabs-accounts
puppetlabs-acl
puppetlabs-bolt_shim
puppetlabs-chocolatey
puppetlabs-facter_task
puppetlabs-iis
puppetlabs-kubernetes
puppetlabs-motd
puppetlabs-mount_iso
puppetlabs-node_encrypt
puppetlabs-puppet_conf
puppetlabs-satellite_pe_tools
puppetlabs-scheduled_task
puppetlabs-sqlserver
puppetlabs-sslcertificate
puppetlabs-tomcat
puppetlabs-windows_env
puppetlabs-windows_eventlog
puppetlabs-wsus_client

Tier 3: Quarterly reviews

The modules assigned to Tier 3 are still supported but will not generally be getting a high degree of priority. These modules will be reviewed quarterly and released as needed.

ca_extend
influxdb
puppet_operational_dashboards
puppetlabs-bash_task_helper
puppetlabs-dropsonde
puppetlabs-dsc_lite
puppetlabs-facts
puppetlabs-host_core
puppetlabs-node_manager
puppetlabs-pe_databases
puppetlabs-pe_event_forwarding
puppetlabs-pe_status_check
puppetlabs-puppet_bolt_server
puppetlabs-puppet_metrics_collector
puppetlabs-puppet_status_check
puppetlabs-selinux_core
puppetlabs-splunk_hec
puppetlabs-yumrepo_core
puppetlabs-zfs_core
puppetlabs-zone_core
ruby-pwsh
support-tasks

The Product and Engineering teams are still reviewing the puppetlabs modules for final placement in Tier 2 or Tier 3 and will follow the cadence associated with their tier once that placement is confirmed. Ultimately, the lists above might shift slightly as the team finds that some modules might need more attention than others.

What has already shipped?

It is one thing to say you will do better and quite another to follow through. We’re sharing this now because we have tangible changes already underway. In a focused sprint on Tier 1 modules, the team triaged and actioned several open community pull requests, some merged after review, some closed after discussion, others consolidated with newer work. You’ll see several modules released this month and next with these merged changes on the Forge. Keep an eye on the Forge modules list or check out the next Puppet Modules Roundup post for a summary!

On the Issues With CI for community PRs

We're aware that testing community contributions has been harder than it should be. The current pull request model makes it difficult to run the full acceptance test suite against a contributor's PR without manual effort by Perforce employees, which slows reviews and discourages contributions. Solving this is a priority for the team and we have been prototyping an improved approach that will meet both user expectations and maintaining a secure infrastructure. We’ll share specifics once it's working end-to-end. This is a known gap we're committed to closing.

How We'll Show Our Work

Monthly Modules Roundup. We publish a roundup each month covering what modules have been released, who contributed, and what’s next. You can follow the series here: Puppetlabs Modules Roundup on dev.to.
Contributor recognition. The release notes on the Forge and in the monthly roundup will call out merged community PRs by name.
Public GitHub transparency. We will be following up with contributors directly in pull requests and issues in our open source modules. In advance of a release, we will continue to merge and close PRs so that you can see what will be included in an upcoming release.

How can you help?

Keep contributing! Keep filing issues. Keep telling us when a module is in your way. If a PR of yours has stalled out, please rebase it or comment on the PR. And if the tiering above looks wrong for how you use Puppet day-to-day, let us know! The whole point of publishing this article is so that the community can understand what is changing and also to invite you to shape where the priority goes.

Tiering is not a one-way decision. 

The tiers outlined here have been based on the activity we have observed in our analytics and the importance identified by customers. If a module you depend on isn't in the tier you think it should be, or perhaps a long-waiting PR or issue is blocking you, reach out via the Puppet Community Slack or leave a comment on the monthly Puppet Modules Roundup posts. We want your input to make sure the tiering meet the needs of all our users.

Puppetlabs Modules Roundup – June 2026

Jason St-Cyr — Thu, 09 Jul 2026 19:38:46 +0000

In June 2026 we saw the release of a new stdlib 10 that was mentioned in an earlier article along with numerous modules bumped to use the new stdlib 10. In total, 24 Puppetlabs modules were released to the Forge, ranging from a brand-new Windows security policy module to a large batch of third-party CVE fixes in Security Compliance Management. This roundup pulls the most important changes into one place.

Highlighted Updates

New Module: Windows Local Security Policy Management

The new security_policy module manages Windows local security policy using the Puppet Resource API, replacing manual secedit/Local Security Policy editor work.

Provides the security_option and user_right_assignment resource types, covering all 45 Windows Privilege Rights and the System Access settings.
Ships a well-known SID map with a PowerShell fallback for domain and custom accounts.

stdlib 10.x Compatibility Pass

A coordinated maintenance pass loosened the puppetlabs/stdlib dependency constraint across the module set to allow stdlib 10.x, clearing the way for downstream modules to pick up stdlib's latest release.

Affected modules: accounts, apache, apt, chocolatey, concat, docker, firewall, haproxy, inifile, lvm, motd, mysql, ntp, postgresql, wsus_client.

More modules will be released in July as we roll out the support for stdlib 10.x.

Puppet Core Alignment / Puppet 7 Support Dropped

Several modules completed their Puppet Core alignment pass this month, dropping Puppet 7 support in favor of Puppet 8 as Puppet 7 reaches end-of-life.

Affected modules: accounts, chocolatey, haproxy, java, motd, mysql, postgresql, stdlib.

A note that the change to drop Puppet 7 in postgresql was done in a patch release, instead of a major release. This has been corrected in postgresql 10.6.3 and the change will be done again in a major release of that module.

Security Compliance Management Patches ~40 CVEs

Security Compliance Management 3.8.0, shipped as both comply and complyadm, updates a long list of bundled third-party components — Gorm.io, Protobuf, several Netty codec libraries, react-router, and KeyCloak — to close out roughly 40 CVEs.

Also updates the bundled CIS-CAT Pro Assessor to v4.63.0, adding new STIG benchmarks for Amazon Linux 2023, Windows 11, Oracle Linux 9, and RHEL 10.

What Updates Happened to Puppetlabs Modules in June 2026?

The following is an alphabetical listing of modules which received updates in June 2026. If a module had multiple versions released, the updates are collected together, numbered with the "latest" version available.

accounts 9.0.0

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

This release drops Puppet 7 support (BREAKING) as part of the module's Puppet Core alignment work, and allows the stdlib dependency to move to 10.x.

(CAT-2352) Drop Puppet 7 support (BREAKING) — Puppet Core alignment #509 (LukasAud)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #513 (imaqsood)

apache 13.2.0

📅 Latest release: 2026-06-28 (🌐 View on the Forge)

Adds RHEL 10 support, restores the ModSecurity engine on RHEL 10 via EPEL, and allows both stdlib and concat to move to their 10.x releases.

Add missing parameters to mod_md #2621 (smortex)
(MODULES-11851) Restore ModSecurity engine on RHEL 10 via EPEL #2635 (SugatD)
(MODULES-11739) Add RHEL 10 support #2629 (SugatD)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #2632 (imaqsood)
puppetlabs/concat: Allow 10.x #2630 (bastelfreak)

apt 11.3.2

📅 Latest release: 2026-06-26 (🌐 View on the Forge)

A small release that only bumps the stdlib dependency to allow 10.x.

(MODULES-11840) Allow puppetlabs/stdlib 10.x #1288 (imaqsood)

aws_inventory 0.8.0

📅 Latest release: 2026-06-17 (🌐 View on the Forge)

This release allows the ruby_task_helper dependency to move to 1.x.

Allow ruby_task_helper 1.x #25 (bastelfreak)

chocolatey 9.0.0

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

Completes its Puppet Core alignment pass, improves package prefetch caching with case-insensitive matching, and allows stdlib 10.x.

(CAT-2369) Puppet Core update #378 (LukasAud)
(MODULES-11769) Cache prefetch results and match packages case-insensitively #388 (skyamgarp)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #387 (imaqsood)

comply 3.8.0

📅 Latest release: 2026-06-12 (🌐 View on the Forge)

Security Compliance Management 3.8.0 addresses roughly 40 CVEs across bundled third-party components, alongside operational fixes and licensing improvements.

Increased the CIS-CAT Pro Assessor license expiry time to a full year.
Added a license_path parameter to update the CIS-CAT Pro Assessor license without upgrading SCM.
Added an assessor_scan_timeout option to control the task timeout for Windows 2022 domain controllers.
Added a background scan sweeper to detect and cancel scans stuck in the "running" state.
Fixed a race condition where timed-out PE job status polls could leave scans permanently stuck.
Updated Gorm.io, Protobuf, multiple Netty codec libraries, react-router, and KeyCloak to address roughly 40 CVEs.

Check the official release notes for comply 3.8.0 for the full details.

complyadm 3.8.0

📅 Latest release: 2026-06-12 (🌐 View on the Forge)

Ships the same Security Compliance Management 3.8.0 update as comply, covering the same ~40 CVE remediations and operational fixes.

Increased the CIS-CAT Pro Assessor license expiry time to a full year.
Added a license_path parameter to update the CIS-CAT Pro Assessor license without upgrading SCM.
Added an assessor_scan_timeout option to control the task timeout for Windows 2022 domain controllers.
Added a background scan sweeper to detect and cancel scans stuck in the "running" state.
Fixed a race condition where timed-out PE job status polls could leave scans permanently stuck.
Updated Gorm.io, Protobuf, multiple Netty codec libraries, react-router, and KeyCloak to address roughly 40 CVEs.

Check the official release notes for complyadm 3.8.0 for the full details.

concat 10.0.1

📅 Latest release: 2026-06-25 (🌐 View on the Forge)

This targeted release was part of the wave of bumps for the stdlib dependency to allow 10.x.

(MODULES-11840) Allow puppetlabs/stdlib 10.x #837 (imaqsood)

docker 10.4.1

📅 Latest release: 2026-06-28 (🌐 View on the Forge)

Removes the upper version limit on the puppetlabs/apt dependency, fixes compose up argument ordering, and allows stdlib 10.x.

Do not limit puppetlabs/apt requirement < v12 #1056 (mpdude)
Fix argument order on compose up #1037 (deligatedgeek)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #1057 (imaqsood)

edgeops 1.1.0

📅 Latest release: 2026-06-25 (🌐 View on the Forge)

Adds host key fingerprint verification for Bolt 5.1.0+ targets, along with a batch of NETCONF/SSH hardening fixes.

(PE-43703) Verify host key fingerprints supplied as host-key-fingerprint in the target hash; takes precedence over host-key-check and requires Bolt 5.1.0+. #38 (owenbeckles)
(PE-42584) Correctly handle host key verification parameter #23 (Ziaunys)
(PE-43619) Clean up SSH on timeout and always raise instead of returning partial data #33 (Ziaunys)
(PE-43614) Add mutex synchronization for RPC message ID allocation #29 (Ziaunys)
(PE-43652) Rename netconf_lock task to netconf_check_lock #35 (Ziaunys)

firewall 8.5.0

📅 Latest release: 2026-06-25 (🌐 View on the Forge)

Two releases this month: 8.4.0 added CONNMARK-based policy routing support and several bugfixes, while 8.5.0 allows stdlib 10.x, drops iptables-services from EL9+ package defaults, and fixes several ipset and chain-detection edge cases.

Includes monthly releases: 8.5.0 (2026-06-25), 8.4.0 (2026-06-10).

(MODULES-11840) Allow puppetlabs/stdlib 10.x #1288 (imaqsood)
(#1254) Remove iptables-services from EL9+ package defaults #1296 (david22swan)
(feat) Add restore_mark, nfmask, ctmask support for CONNMARK-based policy routing #1291 (david22swan)
(bugfix) Fix ipset idempotency: single-element array not in sync with String equivalent #1286 (david22swan)
(bugfix) Fix log_level idempotency when explicitly setting the iptables default value #1284 (david22swan)

haproxy 8.2.1

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

Completes the module's Puppet 8 upgrade work, drops Puppet 7 support, and allows stdlib 10.x.

(MODULES-11840) Allow puppetlabs/stdlib 10.x #642 (imaqsood)
(CAT-2373) Remove puppet 7 #631 (gavindidrichsen)
(CAT-2373)(02) Upgrade module to puppet 8 #629 (gavindidrichsen)

inifile 6.4.1

📅 Latest release: 2026-06-25 (🌐 View on the Forge)

A small release to allow stdlib 10.x.

(MODULES-11840) Allow puppetlabs/stdlib 10.x #570 (imaqsood)

java 12.0.0

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

Adds CentOS 9 and Debian 13 support, allows stdlib 10.x, and adds support for downloading from a login/password-protected URL.

(CAT-2376) Puppet Core update #614 (LukasAud)
(CAT-2152) Add support for CentOS 9 #606 (skyamgarp)
Add support for Debian 13 (trixie) #613 (mika)
Feat: Allow downloading from a login/password protected URL #588 (JGodin-C2C)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #626 (imaqsood)

lvm 4.0.2

📅 Latest release: 2026-06-28 (🌐 View on the Forge)

This lvm release bumps the stdlib dependency to allow 10.x.

(MODULES-11840) Allow puppetlabs/stdlib 10.x #384 (imaqsood)

motd 8.0.0

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

Adds Bolt 5.0 support, and allows stdlib 10.x.

(CAT-2352) Puppet Core update #531 (LukasAud)
(CAT-2463) Add bolt 5.0 support #535 (gavindidrichsen)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #558 (imaqsood)

mysql 17.0.0

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

Fixes the RHEL/CentOS Stream 10 version check, and allows stdlib 10.x.

(CAT-2381) Puppet Core update #1688 (LukasAud)
Fix version check for RHEL/CentOS Stream 10 #1686 (kajinamit)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #1707 (imaqsood)

ntp 11.1.1

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

A small release that only bumps the stdlib dependency to allow 10.x.

(MODULES-11840) Allow puppetlabs/stdlib 10.x #742 (imaqsood)

peadm 3.38.0

📅 Latest release: 2026-06-30 (🌐 View on the Forge)

Adds support for installing and upgrading to Puppet Enterprise 2023.8.10 and 2025.11.0, along with a cloud_database_host parameter for cloud-DB-backed installs.

Adding support for PE 2023.8.10 and 2025.11.0 #673 (CharithaDunuwille)
(PE-44022) Add cloud_database_host parameter for cloud-DB-backed installs #665 (mcdonaldseanp)
(PE-44247) Add peadm-path PG-major HA upgrade coverage for replica pe-puppetdb #666 (steveax)
(PE-44595) Don't emit empty dns_alt_names flag in subplans::install #672 (steveax)

postgresql 10.6.2

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

Adds basic EL10 support, allows both stdlib and concat to move to their 10.x releases, and fixes a bug where postgresql_conf resources set to absent were handled incorrectly.

NOTE: This release also incorrectly removed Puppet 7 support as a breaking change in a patch release. This has since been rolled back in 10.6.3. Removing Puppet 7 support will happen in a future major release.

add EL10 basic support - align EL10 PGSQL 16 default package version #1650 (ikonia)
fix: ignore postgresql_conf resource value when set to absent #1657 (davidassigbi)
grant creation via hiera through server::grant.pp #1668 (ikonia)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #1681 (imaqsood)
puppetlabs/concat: Allow 10.x #1669 (bastelfreak)

sce_linux 2.7.0

📅 Latest release: 2026-06-16 (🌐 View on the Forge)

Adds CIS Benchmark support for the RHEL 10 family, fixes an rsyslog configuration file that was unconditionally overwritten, and drops RHEL 7 now that it's end of life.

Support for RHEL 10, AlmaLinux 10, Oracle Linux 10, and Rocky Linux 10. Enforces the CIS Benchmark for RHEL 10 (v1.0.1, Server Levels 1 and 2) and CIS Benchmark v1.0.0 for AlmaLinux 10, Oracle Linux 10, and Rocky Linux 10.
rsyslog.conf file unconditionally overwritten. Previously overwritten on every Puppet run even when logging configuration was set to ignore, affecting RHEL 7/8/9 and derivatives. No action required from users.
Advanced Intrusion Detection Environment (AIDE) utility class. Fixed incorrect configuration options generated for AIDE 0.19.x on RHEL 9 that caused aide --init to fail.
RHEL 7. RHEL 7 is end of life and no longer supported.

Check the official release notes for sce_linux 2.7.0 for the full details.

security_policy 1.0.0

🌟 New Module: 2026-06-25 (🌐 View on the Forge)

Brand-new module for managing Windows local security policy. Provides the security_option and user_right_assignment resource types (Puppet Resource API), covering all 45 Windows Privilege Rights and System Access settings. Initial release contains:

security_option and user_right_assignment resource types for managing Windows local security policy settings via secedit.
security_policy class exposing 45 Optional[Array[String]] parameters (one per privilege right), matching the layout of the legacy dsc/securitypolicydsc module.
PuppetX::Sid module: a static well-known SID map covering the 19 standard SIDs, with a PowerShell fallback via Pwsh::Manager for domain and custom accounts.
YAML-driven setting metadata loader (PuppetX::SecurityPolicy.all_settings) instead of a hardcoded settings hash.
Puppet requirement pinned to >= 8.0.0 < 9.0.0.

stdlib 10.0.1

📅 Latest release: 2026-06-30 (🌐 View on the Forge)

Drops Puppet 7 support, adds CentOS 9 support, extends Sensitive value support to more functions, and fixes has_ip_address/has_ip_network.

(CAT-2395) Puppet Core upgrade - drop support for Puppet 7 #1457 (LukasAud)
(CAT-2152) Add support for CentOS 9 #1442 (skyamgarp)
Support Sensitive values in more functions #1463 (alexjfisher)
Support sensitive values in to_json_pretty #1418 (alexjfisher)
Fix has_ip_address and has_ip_network functions #1448 (alexjfisher)

wsus_client 6.3.1

📅 Latest release: 2026-06-25 (🌐 View on the Forge)

stdlib 10.x now allowed as part of the dependency range bump.

(MODULES-11840) Allow puppetlabs/stdlib 10.x #238 (imaqsood)

Until Next Time!

That wraps up the June 2026 roundup. If any of these modules intersect with your environment — especially the Security Compliance Management CVE fixes — the linked Forge pages and release notes are worth a closer look.

Feedback on the series is always useful, especially if there are module families or release-note patterns that deserve more attention in future editions.

More updates coming next month when the July 2026 releases land.

🤖 AI Disclosure

Puppet Core 8.20 adds Ubuntu 26.04 and Security Fixes

Jason St-Cyr — Mon, 06 Jul 2026 12:15:19 +0000

The latest release of Puppet Core was targeted at addressing reported CVEs and adding agent support for Ubuntu 26.04, along with some other items that might be of interest to you! Here's a quick rundown on the highlights:

Ubuntu 26.04 (x86_64 and ARM) support added for Puppet agents
Updated components for OpenSSL, net-imap, and concurrent-Ruby to address 13 CVEs
Sensitive values are now handled correctly in transactionstore.yaml
On macOS, plist files are now written atomically to prevent partial or zero-length reads.
PXP agent metadata now uses uniquely named temporary files to resolve file-rename race conditions that were happening for Windows tasks.

This was just my quick summary of the notes, so make sure to read the full release notes for Puppet Core 8.20 to get all the details before you upgrade!

Puppet Enterprise Introduces Database-Backed CA Storage in 2025.11 release

Jason St-Cyr — Thu, 02 Jul 2026 15:32:28 +0000

The latest Puppet Enterprise releases are out and this one has a huge load of improvements, fixes, and security patches included!

Puppet Enterprise (PE) 2025.11 released!

The full PE 2025.11 release notes are always the best way to get a full detail on what has changed, but here are some highlights of PE 2025.11!

Certificate Authority (CA): Database-backed Storage

This new optional feature adds support for storing CA data in a PostgreSQL database instead of the file system. This improves performance and reliability and introduces API-driven capabilities and enhanced backup and recovery handling.

PostgreSQL 17 Supported

PE-managed installations will automatically upgrade from verson 14 to 17 as part of the upgrade process, or you can update yourself before upgrading to PE 2025.11

Infra Assistant Goes GPT-5

GPT-5 series models are now running under the hood of Infra Assistant, improving the quality of responses and the consistency for queries.

Advanced Patching Enhancements

The advanced patching feature now has improvements across a variety of areas

New puppet_run_concurrency setting allows you to get better performance out of patch group enrollment
Improved validation of scheduled and immediate jobs to reduce risk of unintended or skipped executions.
Cron scheduling has better user experience and improved validation across features.
New configurable option to enable Puppet to run after patch jobs to refresh pe_patch facts

New Endpoints for Classifier and Activity Service APIs

The Classifier API introduced new tags, add-tags and remove-tags endpoints to manage node group tags. The Activity service API now has subscriptions endpoints to create subscriptions, list subscriptions, or fetch/delete a specific subscription.

Agent Platform Updates, Resolved Issues, and Security Fixes

The macOS 26 platform is now supported for both ARM and x86_64, while support has been removed for Ubuntu 18.04 and Ubuntu 20.04.

Nearly 60 CVEs were addressed in this release, along with many resolved issues. You should definitely check out the release notes for the full list of fixes!

PE 2023.8.10 Released

Along with the new 2025.11 release, the latest patches for the LTS version PE 2023.8 has also been put out.

Agent platforms were a big change, as macOS 26 was added, along with removing support for Ubuntu 18 and Ubuntu 20.
Nearly 60 CVEs resolved in this release, many by component updates.
Some additional fixes made in 2025.11 have also been inherited for the Activity service API and LDAP group attributes handling.

Official Release Notes

Read more in the full release notes on help.puppet.com ⬇️

Download Puppet Enterprise

RHEL 10 support now available in Puppet SCE for Linux

Jason St-Cyr — Thu, 18 Jun 2026 16:16:41 +0000

Version 2.7.0 of Security Compliance Enforcement (SCE) for Linux is now available for download from the Forge!

Support for the RHEL 10 family

This release adds Red Hat Enterprise Linux (RHEL) 10 CIS benchmarks (v1.0.1, Server Levels 1 and 2). Teams adopting RHEL 10 or a compatible platform can bring those systems into compliance using the same trusted standards already in place across earlier RHEL versions.

Other improvements

Some other issues were also addressed, including logging issues with the rsyslog configuration file and intrusion detection on RHEL 9.

For all the details, make sure to read the full release notes

SCE Module on Puppet Forge

Security Compliance Management 3.8.0 Is Now Available

Jason St-Cyr — Tue, 16 Jun 2026 13:31:38 +0000

Security Compliance Management (SCM) 3.8.0 is here, with updates focused on keeping compliance scans running reliably with less manual intervention and an important license update.

This release introduces automatic cleanup for stuck scans, improved control over scan behavior with configurable timeouts, extended CIS-CAT® Pro Assessor license support, and updated benchmark content. It also includes important security fixes across core components.

⚠️ We recommend upgrading to SCM 3.8.0 before June 21, 2026 to avoid disruption, as the CIS-CAT Pro Assessor license included in SCM 3.7.1 expires on that date.

What’s changing in SCM 3.8.0

CIS-CAT Pro Assessor licensing and version

SCM 3.8.0 now contains CIS-CAT Pro Assessor v4.63.0
The bundled CIS-CAT® Pro Assessor license is now valid for one year
- The license shipped with SCM 3.8.0 is valid until June 2027
- The license included in SCM 3.7.1 expires on June 21, 2026

You can now also update the license without upgrading SCM:

New license_path parameter
- Allows updating the CIS-CAT Pro Assessor license independently
- Documentation: https://help.puppet.com/scm/current/Content/UserGuide/SCM/update_assessor_license.htm

Scan management, configuration, and reliability

Added a background scan sweeper to detect and cancel scans stuck in a "running" state
Fixed a race condition where timed-out Puppet Enterprise job status polls could leave scans permanently stuck
New assessor_scan_timeout option controls task timeout for Windows Server 2022 domain controllers (Note: this isn't set by default)
Increased default Max GraphQL requests limit to 300 requests

Benchmark coverage updates

New benchmarks added for Amazon Linux 2023 STIG, Microsoft Windows 11 STIG, Oracle Linux 9 STIG, RHEL 10 STIG, and SUSE 16
Updated benchmarks for: Amazon Linux 2, macOS, Debian, Windows, and Ubuntu (see the release notes for specific benchmark updates)
Removed benchmarks for:
- Azure Compute Windows Server 2019 v1.0.1
- Azure Compute Windows Server 2022 v1.0.0

Security fixes

This release includes updates to address 40 vulnerabilities across several components. The following components were updated to address the vulnerabilities:

Gorm.io
Keycloak
netty-codec
netty-codec-http
netty-codec-http2
netty-codec-haproxy
netty-handler
Protobuf
react-router

Refer to the full release notes for the complete list of CVEs.

Upgrade guidance

To avoid scan interruptions, upgrade to SCM 3.8.0 before June 21, 2026. This ensures continued use of the CIS-CAT Pro Assessor, access to updated benchmark content, improved security posture, and improvements in scan processing.

Learn more

Full release notes: https://help.puppet.com/scm/current/Content/UserGuide/SCM/Release_notes/release_notes.htm#SecurityComplianceManagement380

If you have questions or need assistance upgrading, reach out to Puppet Support.

🤖 AI Disclosure

This article was written and reviewed by the author, with the help of AI to assist in pulling together the details from multiple sources and general brand voice alignment.

How did I do that? For this particular article, I provided Microsoft 365 Copilot with the original release notes, my previous release announcement for 3.7.0, our company brand voice guidelines, and the official product release announcement that went out to customers. The LLM can then pull together the list of things that were updated and create a skeleton of an article. I then rewrite the content as needed to meet with my own tone of voice and get rid of the over-list-based approach that LLMs often take. It's also important to actually check back against the original release notes because sometimes the LLM will change certain words or remove words that change the meaning of what was in the release. I hope this helps if you are also writing with LLMs!