DEV Community: puppet

Puppetlabs Modules Roundup – October 2026

Jason St-Cyr — Thu, 05 Nov 2026 16:50:25 +0000

October 2026 brought 31 Puppetlabs module releases, a quieter month after September's sprawling Puppet Core 9 rollout. That rollout continued this month, with more of the catalog still to come in future months, alongside a batch of dependency-ceiling bumps and two unrelated security fixes worth a closer look. This roundup pulls the most important changes into one place.

Highlighted Updates

Puppet Core 9 Rollout Continues for the Core Resource-API Modules

October continues the Puppet Core 9 compatibility push that dominated September's roundup, this time landing in the _core family of modules (augeas_core, cron_core, etc.) and also puppet_authorization, hocon, puppet_status_check, and facts. Thirteen modules in all picked up Puppet Core 9 support this past month, with more of the catalog expected to follow over the coming months.

Affected modules: augeas_core, cron_core, facts, hocon, host_core, mount_core, puppet_authorization, puppet_status_check, selinux_core, sshkeys_core, yumrepo_core, zfs_core, zone_core.

Dependency Ceilings Raised for puppet/archive, puppet/kmod, and puppet/systemd

Several modules widened their upper dependency bounds to allow newer companion-module releases, clearing the way for puppet/archive 9.x, puppet/kmod 5.1.x, and puppet/systemd 11.x without changing their own behavior.

Affected modules: tomcat, apache, kubernetes, java, postgresql.

Puppet 7 Support Dropped in 12 Modules This Month

As part of the Puppet Core 9 push, twelve modules dropped Puppet 7 support outright this month. Nine of those (the entire _core family) moved their Puppet floor straight from 6 to 8, while hocon, puppet_authorization, and puppet_status_check moved from 7 to 8. puppet_authorization 2.0.0 is also a major-version release, which required node_encrypt 4.1.0 to widen its dependency bound to allow it. If any of these modules are in your environment, confirm your Puppet version before upgrading.

Affected modules: augeas_core, cron_core, hocon, host_core, mount_core, puppet_authorization, puppet_status_check, selinux_core, sshkeys_core, yumrepo_core, zfs_core, zone_core.

Security Fixes in apt and postgresql

Two unrelated fixes this month close off real security gaps rather than routine CVE patching.

apt: Version 11.4.1 rejects and escapes shell characters in apt::ppa names, closing a shell-injection vector in PPA name handling.
postgresql: Version 10.8.0 stops the default_privileges type from revealing sensitive data in Puppet's catalog and report output.

What Updates Happened to Puppetlabs Modules in October 2026?

The following is an alphabetical listing of modules which received updates in October 2026. If a module had multiple versions released, the updates are collected together, numbered with the "latest" version available.

apache 13.5.0

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

This release raised the puppet/archive dependency ceiling to allow 9.x and refactored how apache::vhost configures ModSecurity, alongside acceptance-test fixes for SLES 12 and lbmethods.

(MODULES-11996) Allow puppet/archive 9.x #2657 (imaqsood)
feat(apache::vhost): refactor ModSecurity configuration handling #2627 (bovy89)
(MODULES-11990) Fix SLES 12 mod_security apache start failures in acceptance #2659 (imaqsood)
(MODULES-11979) Enable and correct spec files for lbmethods #2653 (imaqsood)
Remove mod_log_forensic from apache::default_mods (#2573) #2601 (stdietrich)

apt 11.4.1

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

This release closed a shell-injection vector by rejecting and escaping shell characters in apt::ppa names.

Reject shell characters in apt::ppa names and escape the name #1320 (bwitt)

audit_policy 1.2.2

📅 Latest release: 2026-10-09 (🌐 View on the Forge)

This release fixed broken links in the README by inlining the examples directly.

Fix broken links in README by inlining examples #33 (SugatD)

augeas_core 2.1.0

📅 Latest release: 2026-10-01 (🌐 View on the Forge)

This release added Puppet Core 9 support.

(PA-9117) Add Puppet 9 support #100 (tvpartytonight)

cd4pe_jobs 1.7.6

📅 Latest release: 2026-10-19 (🌐 View on the Forge)

This release fixed job-payload failures on Puppet Core 9 agents (Ruby 4.0) by having run_cd4pe_job.rb explicitly require fileutils, which was previously loaded implicitly.

run_cd4pe_job.rb now explicitly requires fileutils. Previously it relied on FileUtils being loaded implicitly, which is no longer the case with the Ruby bundled in Puppet Core 9 agents (Ruby 4.0). On those agents, jobs failed while unpacking the job payload with uninitialized constant GZipHelper::FileUtils.

cd4peadm 5.19.0

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

A few highlights from this release:

Updated the look-and-feel of, and made performance improvements to, the root console settings pages and deployment and Impact Analysis details pages in each workspace.
Updated the CD backend base image from Debian Bookworm to Debian Trixie.
The public puppetlabs/puppetlabs-cd4pe_deployments repository is now a mirror of an internal fork and remains a reference for custom deployments. File bug reports and feature requests as GitHub issues; fixes are made upstream and then mirrored to the public repository.

Check the official release notes for cd4peadm 5.19.0 for the full details.

chocolatey 9.1.1

📅 Latest release: 2026-10-12 (🌐 View on the Forge)

This release added support for runner metaparameters in chocolatey tasks.

(MODULES-11957) Accept runner metaparameters in chocolatey tasks #399 (imaqsood)

cron_core 2.1.0

📅 Latest release: 2026-10-01 (🌐 View on the Forge)

This release added Puppet Core 9 support.

(PA-9117) Add Puppet 9 support #98 (tvpartytonight)

facts 1.8.1

📅 Latest release: 2026-10-01 (🌐 View on the Forge)

This release added Puppet Core 9 compatibility and reverted a recent change to fact output for SuSE and AlmaLinux.

(BOLT-193): facts pdk update for Puppet 9 compatibility #71 (gavindidrichsen)
(BOLT-205) Revert outputs for SuSE and Almalinux #80 (gavindidrichsen)

hocon 3.0.0

📅 Latest release: 2026-10-21 (🌐 View on the Forge)

This release updated the module for Puppet Core 9 and PDK 4.0, dropping Puppet 7 support in the process.

(maint) update module for Puppet 9 and PDK 4.0 #126 (zaben903)

host_core 2.1.0

📅 Latest release: 2026-10-01 (🌐 View on the Forge)

This release added Puppet Core 9 support.

(PA-9117) Add Puppet 9 support #67 (tvpartytonight)

inifile 6.6.0

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

This release added a new ini_section type for managing whole INI sections as a single resource.

Add new ini_section type #537 (smortex)

java 12.2.0

📅 Latest release: 2026-10-19 (🌐 View on the Forge)

This release raised the puppet/archive dependency ceiling to allow 9.x, added Ubuntu 26.04 support, and fixed containment of java::config.

Includes monthly releases: 12.2.0 (2026-10-19), 12.1.1 (2026-10-16).

puppet/archive: Allow 9.x #636 (bastelfreak)
[PR #623]: Acceptance Test PR - Add support for Ubuntu 26.04 #628 (span786)
Fix containment of java::config #609 (alexjfisher)

kubernetes 8.3.0

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

This release raised the dependency ceilings for puppet/kmod (5.1.x) and puppet/archive (9.x).

(MODULES-12064) Allow puppet/kmod 5.1.x #731 (imaqsood)
(MODULES-11996) Allow puppet/archive 9.x #730 (imaqsood)

mount_core 2.1.0

📅 Latest release: 2026-10-01 (🌐 View on the Forge)

This release added Puppet Core 9 support.

(PA-9117) Add Puppet 9 support #75 (tvpartytonight)

mysql 17.4.0

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

This release added Ubuntu 24.04 support and fixed a Ruby 2.7-incompatible hash shorthand in the mysql provider that broke on older Puppet agents.

(CAT-2124) Add support for Ubuntu 24.04 #1655 (skyamgarp)
Fix Ruby 2.7 incompatible hash shorthand syntax in mysql provider #1751 (bronachfalls)

node_encrypt 4.1.0

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

This release widened the puppetlabs/puppet_authorization dependency bound to allow 2.x, following that module's Puppet Core 9 update.

(MODULES-12063) Allow puppetlabs/puppet_authorization 2.x #130 (imaqsood)

ntp 11.2.1

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

This release derived the SLES 15 legacy-module check from facts and added a guard around the exec resource.

(MODULES-11973) Derive SLES 15 legacy module from facts and guard the exec #755 (imaqsood)

postgresql 10.8.0

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

This release raised the puppet/systemd dependency ceiling to allow 11.x, fixed role-name quoting in the default_privileges type, and stopped that type from revealing sensitive data (see Security fixes above).

(MODULES-12078) Allow puppet/systemd 11.x #1722 (imaqsood)
Properly quote role name in default_privileges type #1666 (antaflos)
Do not reveal sensitive Data #1597 (cocker-cc)

puppet_authorization 2.0.0

📅 Latest release: 2026-10-21 (🌐 View on the Forge)

This release updated the module for Puppet Core 9, dropping Puppet 7 support in the process.

(maint) Update for Puppet 9 #62 (zaben903)

puppet_metrics_collector 8.3.0

📅 Latest release: 2026-10-09 (🌐 View on the Forge)

This release added collection of the code-version count-cap-binding counter.

(PE-46479) Collect the code-version count-cap-binding counter #217 (jonathannewman)

puppet_status_check 0.10.0

📅 Latest release: 2026-10-21 (🌐 View on the Forge)

This release added Puppet Core 9 support and hardened the status-check facts.

(MODULES-12038) Add Puppet 9 support and harden status-check facts #16 (zaben903)

reboot 6.1.0

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

This release added Windows Server 2025 support.

(MODULES-11888) Add Windows Server 2025 support #380 (imaqsood)

sce_windows 2.3.0

📅 Latest release: 2026-10-07 (🌐 View on the Forge)

A few highlights from this release:

Puppet-maintained modules. Puppet maintains the new modules, allowing features and fixes to be delivered independently of DSC module releases.
Per-setting reporting. Because each CIS control maps to its own resource in the Puppet catalog, Puppet agent reports now show changes to individual settings instead of grouping multiple settings within a DSC resource.

Check the official release notes for sce_windows 2.3.0 for the full details.

selinux_core 2.1.0

📅 Latest release: 2026-10-01 (🌐 View on the Forge)

This release added Puppet Core 9 support.

(PA-9117) Add Puppet 9 support #57 (tvpartytonight)

sshkeys_core 3.1.0

📅 Latest release: 2026-10-01 (🌐 View on the Forge)

This release added Puppet Core 9 support.

(PA-9117) Add Puppet 9 support #119 (tvpartytonight)

stdlib 10.1.1

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

This release removed a Ruby 3.1-only hash shorthand so the module keeps working under the Ruby 2.7 runtime bundled with older Puppet agents.

Avoid Ruby 3.1-only hash shorthand #1493 (alexjfisher)

tomcat 8.2.0

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

This release raised the puppet/archive dependency ceiling to allow 9.x.

(MODULES-11996) Allow puppet/archive 9.x #595 (imaqsood)

yumrepo_core 3.1.0

📅 Latest release: 2026-10-01 (🌐 View on the Forge)

This release added Puppet Core 9 support.

(PA-9117) Add Puppet 9 support #88 (tvpartytonight)

zfs_core 2.1.0

📅 Latest release: 2026-10-01 (🌐 View on the Forge)

This release added Puppet Core 9 support.

(PA-9117) Add Puppet 9 support #102 (tvpartytonight)

zone_core 2.1.0

📅 Latest release: 2026-10-01 (🌐 View on the Forge)

This release added Puppet Core 9 support.

(PA-9117) Add Puppet 9 support #62 (tvpartytonight)

Until Next Time!

That wraps up the October 2026 roundup. If puppet_authorization or hocon intersect with your environment, take a look before upgrading since both dropped Puppet 7 support outright, and the apt and postgresql fixes are worth applying regardless of whether you track every release closely.

Feedback on the series is always useful, especially if there are module families or release-note patterns that deserve more attention in future editions.

More updates coming next month when the November 2026 releases land.

🤖 AI Disclosure

This roundup is produced by a mostly-automated pipeline, with some AI sprinkled in for orchestration and enrichment (or 'Combobulating' and 'Finagling'), followed by a human review (that would be me) before publishing.

The automation is an open-source project with deterministic python scripts to crawl the Forge and determine which puppetlabs modules were released during a specific month (and catching when a module gets more than one release in a month). By combining a template, automation scripts, and some AI orchestration the content all gets pulled together for a structured markdown document. I then jump in to double-check the content and update any wording that seems repetitive or irrelevant (and sometimes I need to add some extra context that isn't in the changelog notes).

Security Notice: Important Action Recommended for all Puppet Users

Jason St-Cyr — Wed, 04 Nov 2026 15:19:51 +0000

Perforce Puppet has just released a security release to address two critical vulnerabilities affecting Puppet Core, Puppet Enterprise, and Puppet Enterprise Advanced: CVE-2026-115731 (CVSS 9.4) and CVE-2026-115732 (CVSS 9.0)

Learn more from the official support article:

CVE-2026-115731 and CVE-2026-115732

Puppet Enterprise 2026.0, 2025.12.0, and 2023.8.12 Are Here

Gavin Patton — Mon, 19 Oct 2026 13:53:40 +0000

Puppet Enterprise (PE) 2026.0, 2025.12.0, and 2023.8.12 are now available.

PE 2026.0 highlights include: Puppet Core 9, new operating system support, patch management updates, security updates, and more.
PE 2025.12.0 moves to our latest-1 release, including critical security and bug fixes.
PE 2023.8.12 is now in extended support, which ends February 27, 2027. This release includes critical security and bug fixes.

What's New in Puppet Enterprise 2026.0

Built on Puppet Core 9

PE 2026.0 is the first Puppet Enterprise release built on Puppet Core 9. Puppet Core 9 updates key runtime and security foundations, including Ruby 4.0 and OpenSSL 3.5, and adds hardening for certificates, authentication, and server endpoints. Because you inherit these changes when you upgrade, we recommend testing your custom code and modules before rolling out.

Helpful resources:

Puppet Core 9 release notes
Puppet Core 9 upgrade documentation
Puppet Core platform support lifecycle
Validate your modules for Puppet Core 9 compatibility with Puppet Development Kit (PDK) 4.0

Patch Management Reporting

Patching tasks now report failures that occur while packages are being installed, instead of showing an overall success. Advanced Patching flags failed Windows patch runs as failures in the patch runs report, so your reports reflect what really happened.

Reliable CA Storage Migration and Recovery

PE 2026.0 uses database-backed CA storage by default. To make moving existing CA storage to the database, and recovering afterward, more dependable, this release includes several fixes:

Puppet runs no longer fail after cleanup
Missing on-disk CA files are handled
Mismatched backup restores are rejected up front
Fresh installs and imports are more reliable
Recovery no longer writes other nodes' settings into the primary

Security Refresh

PE 2026.0 includes many security updates, covering the Git tooling used by r10k, the nginx and Jetty web servers, FIPS cryptography, logging, and the toolchain used to build PE client tools. See Security Updates below, and Platform Support Updates for operating system changes.

What's Included in PE 2025.12.0 and PE 2023.8.12

PE 2025.12.0

This release moves PE 2025 into the latest-1 release. Highlights for the PE 2025 release include:

More reliable CA storage: Puppet runs no longer fail after a CA database-storage migration, and intentionally absent local CA files are handled correctly.
Security updates: See Security Updates below.

PE 2023.8.12 (LTS maintenance and security release)

This release includes security and bug fixes, including updated FIPS cryptography components, the Git tooling used by r10k, and related components. It does not add new features or change platform support.

Important for LTS customers: PE 2023.8.12 does not include the logging library (logback-core) fixes delivered in PE 2026.0 and 2025.12.0, which address CVE-2026-9828, CVE-2026-10532, and CVE-2026-13006. The 2023.8 line uses an older logging library branch that no longer receives upstream updates, so these fixes cannot be applied to it. Support for PE 2023.8.x ends February 27, 2027.

Platform Support Updates

Agent platform additions: AlmaLinux 10, Rocky Linux 10, Ubuntu 26.04 (AMD), and Ubuntu 26.04 (ARM)
Primary server platform additions: Ubuntu 26.04
Platform removals: Ubuntu 20.04 amd64 is removed for the primary server, and several older agent platforms are removed.
Manual installation: Debian 12 armhf requires manual installation.

Security Updates

All three releases include dependency updates that reduce your security exposure.

Release	Security updates
PE 2026.0	The broadest refresh: Git tooling used by r10k, nginx, Jetty, logging, FIPS cryptography, the toolchain used to build PE client tools, and many other components, including fixes for critical-severity vulnerabilities. Default PE deployments were assessed as not exploitable for the nginx vulnerabilities addressed.
PE 2025.12.0	Carries forward many of the same updates, including the Git tooling, nginx, Jetty, and client tools toolchain, plus additional dependency updates.
PE 2023.8.12	Updates the FIPS cryptography components (resolving ten vulnerabilities), the Git tooling used by r10k, and related components. Does not include the logging library fixes (see the note for LTS customers above).

For complete details, specific CVE identifiers, and component versions, see the release notes:

If you have questions about upgrading, contact Puppet Support or your account team.

Thank you for being a Puppet Enterprise customer.

The Puppet Enterprise Team

SCE 2.3.0 for Windows improves auditing performance by 70%

Jason St-Cyr — Mon, 12 Oct 2026 11:50:00 +0000

Some underlying pieces have been completely rebuilt to really improve the performance of Security Compliance Enforcement (SCE) for Windows. This release also provides more detailed compliance reporting and simplifies ongoing maintenance using Puppet native modules.

SCE automates the enforcement of CIS Benchmark recommendations and DISA STIG guidance across Windows and Linux environments, helping teams maintain secure and compliant configurations at scale. SCE is available with Puppet Core and Puppet Enterprise Advanced.

Why Upgrade?

Improve performance and scalability by reducing policy enforcement overhead.
Gain more precise visibility into compliance changes.
Simplify compliance operations by identifying, validating, and remediating configuration drift more efficiently.

What's New?

Direct enforcement of Windows security and audit policies through Puppet native modules and Windows APIs, reducing reliance on third-party DSC content.
Per-setting reporting, with each CIS control mapped to its own resource in the Puppet catalog.

Security and Maintenance Updates

This release resolves an issue that could cause CIS compliance scans to incorrectly report AutoAdminLogon settings as non-compliant on Windows Server 2019 and 2022.

Next Steps

Read the release notes: SCE for Windows v2.3.0 release notes
Plan your upgrade to SCE for Windows v2.3.0 !

New to SCE?

If you haven't looked at SCE before and are wondering how you can use your existing Puppet management capabilities to expand into compliance auditing and enforcement, please explore the documentation to learn how SCE helps maintain secure configurations, thus protecting systems and data.

👀 Learn more about SCE

Puppetlabs Modules Roundup – September 2026

Jason St-Cyr — Tue, 06 Oct 2026 11:47:00 +0000

September 2026 saw 53 Puppetlabs modules get releases (some of which got multiple releases) in the Puppetlabs Forge catalog, so it is going to be a full edition of this month's roundup as I try to pull all of these changes into one place.

Across the month, the clearest themes were Puppet Core 9 support as it rolls out across nearly the whole catalog. This preparation also saw Puppet 7 support dropped in seven modules, so the summary below focuses on support changes, maintenance work, and operational impact.

Highlighted Updates

Puppet Core 9 support rolls out across nearly the whole catalog

Forty-nine of the fifty-three modules released this month shipped explicit Puppet Core 9 compatibility work. This included metadata bumps, new CI lanes, and in several cases a parallel Ruby 4.0 compatibility pass. The releases range from Tier 1 modules (examples: puppetdb, mysql, postgresql, stdlib, apache, firewall) to the full set of Bolt task-helper and cloud-inventory modules, making this the single largest coordinated update the puppetlabs namespace has shipped in one month in 2026. facts 1.8.0 is part of the same push, after first correcting an accidental major-version bump to 2.0.0 back down to a minor release.

Affected modules: accounts, acl, apache, apt, audit_policy, aws_inventory, azure_inventory, bash_task_helper, chocolatey, concat, docker, dsc_lite, facter_task, facts, firewall, gcloud_inventory, haproxy, http_request, iis, java_ks, kubernetes, motd, mysql, ntp, pkcs7, postgresql, powershell, powershell_task_helper, puppet_conf, puppetdb, pwshlib, python_task_helper, registry, ruby_plugin_helper, ruby_task_helper, sce_linux, scheduled_task, secure_env_vars, security_policy, sqlserver, sslcertificate, stdlib, terraform, tomcat, vault, vcsrepo, windows_env, wsus_client, yaml.

Puppet Core prep drops Puppet 7 support in seven modules

As part of preparing for Puppet Core, puppetdb, registry, acl, facter_task, puppet_conf, java_ks, and vcsrepo shipped new releases that drop Puppet 7 support outright. Because registry 6.0.0 was a major release and a breaking change, four of its dependents (chocolatey, wsus_client, windows_eventlog, and motd) had to widen their puppetlabs/registry dependency bound to allow the new major version.

Affected modules: acl, chocolatey, facter_task, java_ks, motd, puppet_conf, puppetdb, registry, vcsrepo, windows_eventlog, wsus_client.

Breaking changes to review

A small number of releases include compatibility-impacting changes that may need extra review in your modules or environments before rolling them out.

puppetdb: The new version 9.0.0 drops Puppet 7 support, changes the default postgres_version from 14 to 17 to match what Puppet Enterprise now installs, and adds strict Puppet data-type validation across module parameters that may reject previously-accepted invalid values.
registry: Version 6.0.0 drops Puppet 7 support as part of its Puppet Core update, a major-version change that required chocolatey, wsus_client, windows_eventlog, and motd to widen their dependency bounds to allow it. If your module is dependent on registry, you may want to look at updating your upper bound to allow it.

What Updates Happened to Puppetlabs Modules in September 2026?

The following is an alphabetical listing of modules which received updates in September 2026. If a module had multiple versions released, the updates are collected together, numbered with the "latest" version available.

accounts 9.1.0

📅 Latest release: 2026-09-04 (🌐 View on the Forge)

This release focused on adding Puppet Core 9 support.

(MODULES-11699) Add Puppet Core 9 support #515 (skyamgarp)

acl 6.0.0

📅 Latest release: 2026-09-04 (🌐 View on the Forge)

This release focused on adding Puppet Core 9 support and dropping support for Puppet 7.

(CAT-2360) Prepare module for Puppet Core / Drop Support for Puppet 7 #310 (david22swan)
MODULES-11712: Add Puppet Core 9 support #315 (span786)

apache 13.4.0

📅 Latest release: 2026-09-02 (🌐 View on the Forge)

This release focused on adding Puppet Core 9 support.

(MODULES-11700) Add Puppet Core 9 support #2638 (imaqsood)

apt 11.4.0

📅 Latest release: 2026-09-09 (🌐 View on the Forge)

This release focused on adding support for Puppet Core 9.

(MODULES-11701) Add support for Puppet Core 9 #1275 (shubhamshinde360)

audit_policy 1.2.1

📅 Latest release: 2026-09-10 (🌐 View on the Forge)

This release fixed misleading ensure-change reports, added Puppet Core 9 support, and addressed some maintenance issues with the repo.

Includes monthly releases: 1.2.1 (2026-09-10), 1.2.0 (2026-09-08), 1.1.0 (2026-09-02).

[MODULES-11879] Fix misleading ensure-change reports when only flag differs #31 (mehul-jain1)
fix(MODULES-11932): Add Puppet Core 9 support in puppetlabs-audit_policy #28 (SugatD)
[MODULES-11839] Implement manifest init and add specs #26 (SugatD)
[MODULES-11794] Reformat CHANGELOG.md to Keep a Changelog format #24 (SugatD)

aws_inventory 0.9.0

📅 Latest release: 2026-09-11 (🌐 View on the Forge)

This release reverted the version bump from major to minor (1.0.0 -> 0.9.0) while also adding support for Puppet Core 9.

Revert version bump from major to minor (1.0.0 -> 0.9.0) #33 (gavindidrichsen)
(BOLT-193) aws_inventory Pdk update to Puppet Core 9 #28 (gavindidrichsen)

azure_inventory 0.6.0

📅 Latest release: 2026-09-11 (🌐 View on the Forge)

This release reverted the version bump from major to minor (1.0.0 -> 0.6.0) while also updating to Puppet Core 9.

Revert version bump from major to minor (1.0.0 -> 0.6.0) #21 (gavindidrichsen)
(BOLT-193) azure_inventory pdk update to Puppet Core 9 #18 (gavindidrichsen)

bash_task_helper 2.3.0

📅 Latest release: 2026-09-11 (🌐 View on the Forge)

This release reverted the version bump from major to minor (3.0.0 -> 2.3.0) while also adding the PDK update to Puppet Core 9.

Revert version bump from major to minor (3.0.0 -> 2.3.0) #40 (gavindidrichsen)
(BOLT-193) bash_task_helper pdk update to Puppet Core 9 #37 (gavindidrichsen)

chocolatey 9.1.0

📅 Latest release: 2026-09-10 (🌐 View on the Forge)

This release added Puppet Core 9 support and widened the puppetlabs/registry dependency to allow 6.x.

(MODULES-11731) Add Puppet Core 9 support #390 (shubhamshinde360)
(MODULES-11708) Widen puppetlabs/registry dependency to allow 6.x #392 (span786)

comply 3.9.1

📅 Latest release: 2026-09-01 (🌐 View on the Forge)

5 CVEs were addressed in this release. Check the official release notes for comply 3.9.1 for the full details.

complyadm 3.9.1

📅 Latest release: 2026-09-01 (🌐 View on the Forge)

5 CVEs were addressed in this release. Check the official release notes for complyadm 3.9.1 for the full details.

concat 10.1.0

📅 Latest release: 2026-09-03 (🌐 View on the Forge)

This release focused on adding Puppet Core 9 support.

(MODULES-11714) Add Puppet Core 9 support #840 (amitkarsale)

docker 10.5.0

📅 Latest release: 2026-09-23 (🌐 View on the Forge)

This release added Puppet Core 9 support and fixed the EL7 Docker CE repository path to point at the correct CentOS source.

(MODULES-11718) Add Puppet Core 9 support in puppetlabs-docker #1065 (imaqsood)
(MODULES-11929) Point EL7 at the centos Docker CE repo path #1067 (imaqsood)

dsc_lite 5.1.0

📅 Latest release: 2026-09-08 (🌐 View on the Forge)

This release focused on adding Puppet Core 9 support.

Add Puppet Core 9 support #243 (LukasAud)

facter_task 3.0.0

📅 Latest release: 2026-09-15 (🌐 View on the Forge)

This release focused on adding Puppet Core 9 support and dropping support for Puppet 7, along with some CI maintenance.

(CAT-2372) Prepare module for Puppet Core / Drop Support for Puppet 7 #243 (SugatD)
(MODULES-11722) Add Puppet Core 9 support #246 (shubhamshinde360)
(CAT-2296) Update github runner image to ubuntu-24.04 #242 (shubhamshinde360)

facts 1.8.0

📅 Latest release: 2026-09-11 (🌐 View on the Forge)

This release reverted the version bump from major to minor (2.0.0 -> 1.8.0) while also adding Puppet Core 9 compatibility.

Revert version bump from major to minor (2.0.0 -> 1.8.0) #74 (gavindidrichsen)
(BOLT-193): facts pdk update for Puppet Core 9 compatibility #71 (gavindidrichsen)

firewall 8.6.0

📅 Latest release: 2026-09-02 (🌐 View on the Forge)

This release focused on adding Puppet Core 9 support.

MODULES-11717: Add Puppet Core 9 support #1302 (span786)

gcloud_inventory 0.4.0

📅 Latest release: 2026-09-11 (🌐 View on the Forge)

This release reverted the version bump from major to minor (1.0.0 -> 0.4.0) while also adding Puppet Core 9 support.

Revert version bump from major to minor (1.0.0 -> 0.4.0) #19 (gavindidrichsen)
(BOLT-193): gcloud_inventory pdk update to Puppet Core 9 #16 (gavindidrichsen)

haproxy 9.2.0

📅 Latest release: 2026-09-16 (🌐 View on the Forge)

This release added Puppet Core 9 support, introduced the haproxy::http_errors and haproxy::ring resource types, and added Ubuntu 24.04 support.

feat(MODULES-11716) Add Puppet Core 9 support #654 (imaqsood)
Add haproxy::http_errors and haproxy::ring resources #651 (UiP9AV6Y)
(CAT-2125) Add Ubuntu 24.04 support #620 (shubhamshinde360)

http_request 0.4.0

📅 Latest release: 2026-09-11 (🌐 View on the Forge)

This release reverted the version bump from major to minor (1.0.0 -> 0.4.0) while also adding Puppet Core 9 support.

Revert version bump from major to minor (1.0.0 -> 0.4.0) #24 (gavindidrichsen)
(BOLT-193): http_request pdk update to Puppet Core 9 #20 (gavindidrichsen)

iis 11.1.0

📅 Latest release: 2026-09-15 (🌐 View on the Forge)

This release focused on adding Puppet Core 9 support.

(MODULES-11733) Add Puppet Core 9 support #420 (shubhamshinde360)

java_ks 6.1.0

📅 Latest release: 2026-09-23 (🌐 View on the Forge)

This month's releases made the keytool path configurable, dropped support for Puppet 7, and added Puppet Core 9 support. It also fixed incorrect boolean parameter handling and a Tempfile race condition.

Includes monthly releases: 6.1.0 (2026-09-23), 6.0.0 (2026-09-16).

Make keytool path configureable #477 (bastelfreak)
(CAT-2377) Prepare module for Puppet Core / Drop Support for Puppet 7 #471 (shubhamshinde360)
MODULES-11721: Add Puppet Core 9 support #475 (span786)
Fix boolean parameters #469 (alexjfisher)
Fix race condition by memoizing Tempfile objects #461 (alexjfisher)

kubernetes 8.2.0

📅 Latest release: 2026-09-24 (🌐 View on the Forge)

This release focused on adding Puppet Core 9 support.

MODULES-11735: Add Puppet Core 9 support #723 (span786)

motd 8.1.1

📅 Latest release: 2026-09-04 (🌐 View on the Forge)

This month's releases added Puppet Core 9 support and widened the puppetlabs/registry dependency to allow 6.x.

Includes monthly releases: 8.1.1 (2026-09-04), 8.1.0 (2026-09-02).

(MODULES-11708) Widen puppetlabs/registry dependency to allow 6.x #571 (span786)
(MODULES-11702) Add Puppet Core 9 support #561 (imaqsood)

mysql 17.3.0

📅 Latest release: 2026-09-28 (🌐 View on the Forge)

This month's releases added Puppet Core 9 support, support for hex hashes with the caching_sha2_password plugin, and a fix for the mysqld_version fact on FreeBSD. It also tightened validation on purge_conf_dir, fixed .my.cnf root password resolution timing, and allowed metacharacters in SQL file paths.

Includes monthly releases: 17.3.0 (2026-09-28), 17.2.0 (2026-09-16), 17.1.1 (2026-09-02).

Add ability to use hex hash with caching_sha2_password plugin #1612 (C24-AK)
Correct Fact mysqld_version on FreeBSD #1654 (kapouik)
feat(MODULES-11715) Add Puppet Core 9 support #1742 (imaqsood)
Restrict mysql::server::purge_conf_dir type to valid values (#1740) #1741 (jst-cyr)
Use deferrable_epp for .my.cnf to ensure root password resolve correctly #1698 (jiayuchen888)
Update conditional logic xtrabackup.pp to properly... #1609 (ndelic0)
allow metacharacters * and ? in sql file path #1544 (zivis)

ntp 11.2.0

📅 Latest release: 2026-09-04 (🌐 View on the Forge)

This release focused on adding Puppet Core 9 support.

(MODULES-11705) Add Puppet Core 9 support #745 (skyamgarp)

peadm 3.38.3

📅 Latest release: 2026-09-15 (🌐 View on the Forge)

This month's releases completed the CA storage migration for split topologies, added support for PE 2023.8.11 and 2025.11.3, and surfaced provision_replica failures in the add_replica plan instead of hiding them.

Includes monthly releases: 3.38.3 (2026-09-15), 3.38.2 (2026-09-01).

Adding support for PE 2023.8.11 and 2025.11.3 #702 (Jade2153)
(PE-45431) Complete CA storage migration for split topologies #696 (Jade2153)
(PE-43490) Surface provision_replica failures in add_replica plan #677 (CharithaDunuwille)
(PE-45885) Add code-manager to the managed database list #698 (Magisus)
(PE-45110) Ruby 4.0 compatibility: fix missing default-gem deps, document upstream blockers maintenance #685 (CharithaDunuwille)
(PE-45390) Add code coverage reporting to CI #686 (seamymckenna)
Adding support for PE 2025.11.2 #694 (Jade2153)

pkcs7 0.2.0

📅 Latest release: 2026-09-11 (🌐 View on the Forge)

This release reverted the version bump from major to minor (1.0.0 -> 0.2.0) while also adding Puppet Core 9 support.

Revert version bump from major to minor (1.0.0 -> 0.2.0) #19 (gavindidrichsen)
(BOLT-193): pkcs7 pdk update to Puppet Core 9 #15 (gavindidrichsen)

postgresql 10.7.0

📅 Latest release: 2026-09-08 (🌐 View on the Forge)

This release added Puppet Core 9 support, allowed puppet/systemd 10.x, and fixed default_privileges idempotency on PostgreSQL 17.

(MODULES-11720) Add Puppet Core 9 support in puppetlabs-postgresql #1700 (imaqsood)
Allow puppet/systemd 10.x #1691 (deric)
(MODULES-11935) Fix default_privileges idempotency on PostgreSQL 17 #1701 (imaqsood)

powershell 6.2.0

📅 Latest release: 2026-09-09 (🌐 View on the Forge)

This release focused on adding support for Puppet Core 9.

(MODULES-11706) Add support for Puppet Core 9 #440 (shubhamshinde360)

powershell_task_helper 0.2.0

📅 Latest release: 2026-09-11 (🌐 View on the Forge)

This release reverted the version bump from major to minor (1.0.0 -> 0.2.0) while also adding Puppet Core 9 support.

Revert version bump from major to minor (1.0.0 -> 0.2.0) #10 (gavindidrichsen)
(BOLT-193) powershell_task_helper pdk update to Puppet Core 9 #7 (gavindidrichsen)

puppet_conf 3.0.0

📅 Latest release: 2026-09-02 (🌐 View on the Forge)

This release focused on adding Puppet Core 9 support and dropping support for Puppet 7.

(CAT-2387) Prepare module for Puppet Core / Drop Support for Puppet 7 #223 (SugatD)
(MODULES-11736) Add Puppet Core 9 support #225 (imaqsood)

puppetdb 9.0.0

📅 Latest release: 2026-09-30 (🌐 View on the Forge)

This release dropped Puppet 7 support, changed the default postgres_version from 14 to 17, and added strict data-type validation and Sensitive-type handling for secrets across module parameters, along with several other fixes.

Add strict Puppet data type validation across module parameters (String, Integer, Boolean, Enum, Array, Hash, Absolutepath, Stdlib::Host, etc.), including port validation restricted to the unprivileged range (1024-49151) #411 (chambersmp)
Support for Puppet Core 9
Breaking: Default postgres_version bumped from 14 to 17 to match the version installed by the latest Puppet Enterprise
Use the Sensitive data type for secrets (passwords) #331 (cocker-cc)
Extend the puppetdb_version fact to handle Debian packages #416 (rwaffen)
Updated to PDK 3.8.0, dropped Puppet 7 support, and tightened version requirements on module dependencies
Update CI workflows (maint) #410 (h0tw1r3)
Update CODEOWNERS #417 (chambersmp)
Correct spelling of "certificates" #414 (viscountstyx)
Lower the stdlib requirement back down, since puppetdb depends on puppetlabs/postgresql, which depends on puppet/systemd, and puppet/systemd does not yet support stdlib >= 10.0.0
Correct stale postgres_version documentation in puppetdb::init and puppetdb::database::postgresql that still referenced the old 11/9.6 defaults
Set open_ssl_port to default false instead of undef in unit test shared examples
Prepare module for Puppet Core 9 #438 (gavindidrichsen)
Feature maintenance #436 (klab-systems)
Update storeconfig ini section with masters #432 (XMol)
Issue 430: Fix Datatype for listen_addresses #431 (cocker-cc)
Only include 'firewall' module when necessary #415 (Geod24)

pwshlib 2.1.1

📅 Latest release: 2026-09-07 (🌐 View on the Forge)

This release declared Puppet Core 9 support in metadata.json and added a Ruby 4.0 / Puppet Core 9 CI lane, sourcing gems from Puppet Core.

Includes monthly releases: 2.1.1 (2026-09-07), 2.1.0 (2026-09-07).

Declare Puppet Core 9 support in metadata.json requirements #393 (LukasAud)
(CAT-2589) Add Ruby 4.0 / Puppet Core 9 lane, source gems from Puppet Core #385 (LukasAud)

python_task_helper 0.7.0

📅 Latest release: 2026-09-11 (🌐 View on the Forge)

This release reverted the version bump from major to minor (1.0.0 -> 0.7.0) while also adding Puppet Core 9 support.

Revert version bump from major to minor (1.0.0 -> 0.7.0) #25 (gavindidrichsen)
(BOLT-193): python_task_helper pdk update to Puppet Core 9 #22 (gavindidrichsen)

registry 6.0.0

📅 Latest release: 2026-09-04 (🌐 View on the Forge)

This release dropped Puppet 7 support, added Puppet Core 9 support, and added Sensitive data type support for registry_value.

(CAT-2389) Puppet Core update / Drop Puppet 7 support #315 (LukasAud)
MODULES-11708: Add Puppet Core 9 support #320 (span786)
(PA-8354): Add support for Sensitive data in registry_value #319 (span786)
Update link to Puppet modules contribution documentation #318 (jst-cyr)

ruby_plugin_helper 0.4.0

📅 Latest release: 2026-09-11 (🌐 View on the Forge)

This release reverted the version bump from major to minor (1.0.0 -> 0.4.0) while also adding Puppet Core 9 support.

Revert version bump from major to minor (1.0.0 -> 0.4.0) #13 (gavindidrichsen)
(BOLT-193) ruby_plugin_helper pdk update to Puppet Core 9 #10 (gavindidrichsen)

ruby_task_helper 1.1.0

📅 Latest release: 2026-09-11 (🌐 View on the Forge)

This release reverted the version bump from major to minor (2.0.0 -> 1.1.0) while also adding Puppet Core 9 support.

Revert version bump from major to minor (2.0.0 -> 1.1.0) #31 (gavindidrichsen)
(BOLT-193): ruby_task_helper pdk update to Puppet Core 9 #26 (gavindidrichsen)

sce_linux 2.9.0

📅 Latest release: 2026-09-09 (🌐 View on the Forge)

A few highlights from this release:

Crypto controls incorrectly configured on Rocky Linux 8. Crypto controls are intended to prevent the use of weak Message Authentication Code (MAC) algorithms. On Rocky Linux 8, the controls were not working as designed. The manage_crypto_policies block was updated to resolve the issue and enforce strong algorithms.
Error occurs when specifying active zone target for firewalld. Previously, an error occurred when users set an active zone target for the firewalld solution by specifying {"public"=>{"target"=>"DROP"}}. The "unable to parse" error was displayed because the {"public"=>{"target"=>"DROP"}} example shown on the Puppet Forge Reference page was invalid. To resolve the issue, the Reference page was updated to display only the valid example:.
PAM profiles not applied on Ubuntu Linux. Previously, pluggable authentication module (PAM) profiles were enabled but not applied, causing some 5.3.x controls to fail on nodes reported as compliant. The issue was resolved to ensure that the profiles are applied and the PAM stack is hardened.

Check the official release notes for sce_linux 2.9.0 for the full details.

scheduled_task 5.1.0

📅 Latest release: 2026-09-03 (🌐 View on the Forge)

This release focused on adding support for Puppet Core 9.

(MODULES-11734) Add support for Puppet Core 9 #277 (SugatD)

secure_env_vars 0.3.0

📅 Latest release: 2026-09-11 (🌐 View on the Forge)

This release reverted the version bump from major to minor (1.0.0 -> 0.3.0) while also adding Puppet Core 9 support.

Revert version bump from major to minor (1.0.0 -> 0.3.0) #8 (gavindidrichsen)
(BOLT-193): secure_env_vars pdk update to Puppet Core 9 #5 (gavindidrichsen)

security_policy 1.2.0

📅 Latest release: 2026-09-24 (🌐 View on the Forge)

This release added Puppet Core 9 support, isolated per-SID translation failures so one bad SID no longer fails the whole batch, and fixed the security_option provider missing out-of-band policy drift.

Includes monthly releases: 1.2.0 (2026-09-23), 1.1.2 (2026-09-18), 1.1.1 (2026-09-01).

[MODULES-11933] Add Puppet Core 9 support #57 (SugatD)
[MODULES-11947] Isolate per-SID translation failures from the whole batch #55 (mehul-jain1)
Fix security_option provider missing out-of-band security policy drift #50 (mehul-jain1)

sqlserver 5.2.0

📅 Latest release: 2026-09-02 (🌐 View on the Forge)

This release focused on adding Puppet Core 9 support, along with several CI and test-infrastructure fixes.

(MODULES-11725) Add Puppet Core 9 support in puppetlabs-sqlserver #511 (imaqsood)
(MODULES-11902) Force reinstall puppet_agent module in acceptance bootstrap #507 (SugatD)
(MODULES-11838) Update link to Puppet modules contributing documentation #504 (imaqsood)
(maint) Bump nightly ruby version to 3.2 #513 (imaqsood)
(maint) Bump actions/checkout from v3 to v4 #503 (imaqsood)
Release prep v5.1.1 #502 (github-actions)
Fix #464 #494 (InsanesTheName)

sslcertificate 6.1.0

📅 Latest release: 2026-09-02 (🌐 View on the Forge)

This release focused on adding Puppet Core 9 support.

(MODULES-11726) Add Puppet Core 9 support #145 (imaqsood)

stdlib 10.1.0

📅 Latest release: 2026-09-07 (🌐 View on the Forge)

This release focused on adding Puppet Core 9 support.

(MODULES-11710) Add Puppet Core 9 support #1482 (skyamgarp)

terraform 0.8.0

📅 Latest release: 2026-09-11 (🌐 View on the Forge)

This release reverted the version bump from major to minor (1.0.0 -> 0.8.0) while also adding Puppet Core 9 (Ruby 4) support.

Revert version bump from major to minor (1.0.0 -> 0.8.0) #46 (gavindidrichsen)
(BOLT-193) terraform pdk update to Puppet Core 9 (Ruby 4) #43 (gavindidrichsen)

tomcat 8.1.0

📅 Latest release: 2026-09-03 (🌐 View on the Forge)

This release focused on adding Puppet Core 9 support.

fix(MODULES-11727): Add Puppet Core 9 support in puppetlabs-tomcat #587 (SugatD)

vault 0.5.0

📅 Latest release: 2026-09-11 (🌐 View on the Forge)

This release reverted the version bump from major to minor (1.0.0 -> 0.5.0) while also adding Puppet Core 9 support.

Fix metadata versionRevert version bump from major to minor (1.0.0 -> 0.5.0) #24 (gavindidrichsen)
(BOLT-193): vault pdk update to Puppet Core 9 #21 (gavindidrichsen)

vcsrepo 8.0.0

📅 Latest release: 2026-09-02 (🌐 View on the Forge)

This release dropped Puppet 7 support, added Puppet Core 9 support, and added support for Git sparse checkouts via Git includes.

(CAT-2397) Puppet Core upgrade / Drop Support for Puppet 7 #654 (LukasAud)
MODULES-11711: Add Puppet Core 9 support #659 (span786)
Enable Git Includes (Sparse Checkout) #637 (jplindquist)
(CAT-2296) Update github runner image to ubuntu-24.04 #652 (shubhamshinde360)
Configure Mend for GitHub.com #649 (mend-for-github-com)

windows_env 6.2.0

📅 Latest release: 2026-09-04 (🌐 View on the Forge)

This release focused on adding support for Puppet Core 9.

(MODULES-11728) Add support for Puppet Core 9 #117 (SugatD)

windows_eventlog 5.2.1

📅 Latest release: 2026-09-04 (🌐 View on the Forge)

This release widened the puppetlabs/registry dependency to allow 6.x and included some repo maintenance work.

(MODULES-11708) Widen puppetlabs/registry dependency to allow 6.x #103 (span786)
Configure Mend for GitHub.com #92 (mend-for-github-com)

wsus_client 6.4.0

📅 Latest release: 2026-09-09 (🌐 View on the Forge)

This release added Puppet Core 9 support and widened the puppetlabs/registry dependency to allow 6.x.

MODULES-11737: Add Puppet Core 9 support #240 (span786)
(MODULES-11708) Widen puppetlabs/registry dependency to allow 6.x #241 (span786)

yaml 0.3.0

📅 Latest release: 2026-09-11 (🌐 View on the Forge)

This release reverted the version bump from major to minor (1.0.0 -> 0.3.0) while also adding Puppet Core 9 support.

Revert version bump from major to minor (1.0.0 -> 0.3.0) #11 (gavindidrichsen)
(BOLT-193): yaml pdk update to Puppet Core 9 #8 (gavindidrichsen)

Until Next Time!

That wraps up the September 2026 roundup! If any of puppetdb, mysql intersect with your environment, the linked Forge pages and release notes are worth a closer look.

Feedback on the series is always useful, especially if there are module families or release-note patterns that deserve more attention in future editions.

More updates coming next month when the October 2026 releases land, after Hallowe'en.🎃
Have a great month!

🤖 AI Disclosure

Puppet Core 9.1 and 8.22 adds Debian 12 ARM V7L support

Jason St-Cyr — Tue, 22 Sep 2026 12:58:58 +0000

The latest releases of Puppet Core 9 and Puppet Core 8 are now available! Both releases contain the same types of changes, with minor differences in versions of components that were updated. The new Debian 12 ARM V7L is the only new addition this release while the focus of the changes are on security updates and a pair of compatibility fixes that address issues some users may have encountered in production environments.

If you're currently running Puppet Core 8.x or 9.x, this is a straightforward update worth planning for.

What Changed in Puppet Core 9.1.0 and Puppet Core 8.22.0

New agent platform: Debian 12 ARM V7L added as a supported agent platform.
Security updates: Several bundled components received updates to address recently disclosed vulnerabilities: OpenSSL, curl, libxml2, RubyGems, Ruby's resolv gem.
Compatibility fix for hiera-eyaml and Bouncy Castle
JSON dependency constraints updated to >=2.0, <4 to prevent compatibility issues with latest JSON releases.

Together these updates address more than a dozen published CVEs. If you track vulnerabilities internally, review the release notes for the complete CVE listing associated with your Puppet version.

Notes for Puppet 8 vs Puppet 9 Users

The customer-facing changes are effectively the same in both releases. There are a couple of implementation differences:

Puppet Core 8.22.0 updates OpenSSL 3.0.x, whereas 9.1.0 updates to OpenSSL 3.5.x
Puppet Core 8.22.0 ships hiera-eyaml 4.3.0, whereas Puppet Core 9.1.0 ships hiera-eyaml 5.0.1

The fixes and outcomes delivered by these updates are equivalent across both release tracks.

Full Release Notes

Before upgrading, make sure to review the release notes for your release track:

This update is a small one operationally but an important one from a security and maintenance perspective. Make sure to drop any questions you have about the release either here or in the Puppet community slack.

SCE for Linux: now with Debian 12 and Puppet 9 support

Jason St-Cyr — Tue, 15 Sep 2026 11:44:00 +0000

Debian 12 support and Puppet 9 compatibility are now available in version 2.9.0 of Security Compliance Enforcement (SCE) for Linux!

For teams already using SCE, this release adds CIS Benchmark enforcement for Debian Linux 12 (Bookworm) and ensures SCE can run on Puppet 9, making it easier to keep compliance automation aligned across more Linux deployments and Puppet deployments.

Other notable updates include:

Fixes for Ubuntu authentication hardening where profiles were enabled but not always applied correctly
Updates to strong cryptography enforcement on Rocky Linux 8
Resolution for file integrity monitoring initialization issues on Ubuntu

Check out the full release notes for these and other details!
➡️ SCE for Linux v2.9.0 Release Notes

Puppetlabs Modules Roundup – August 2026

Jason St-Cyr — Tue, 08 Sep 2026 18:54:01 +0000

August 2026 brought 24 releases across 22 Puppetlabs modules (puppet_metrics_collector and cd4peadm each shipped twice), headlined by a broad Puppet Core 9 compatibility rollout. Continuous Delivery for PE also shipped a required upgrade, Security Compliance Management 3.9.0 closed out 117 CVEs, and a few community contributions were rolled into modules as well. This roundup pulls the most important changes into one place.

Highlighted Updates

Puppet Core 9 Support Continues to be Added Across Modules

Fourteen puppetlabs modules added Puppet Core 9 compatibility this month, continuing the ongoing Puppet 9 rollout. Five of them (package, node_encrypt, service, reboot, and tomcat) paired the Puppet Core 9 addition with dropping Puppet 7 support in major version bumps as part of a broader Puppet Core modernization pass; see below.

Affected modules: exec, package, node_encrypt, mount_iso, lvm, service, java, inifile, reboot, windows_eventlog, cd4pe, cd4pe_jobs, cd4peadm, tomcat.

Puppet 7 Support Dropped

Five modules dropped Puppet 7 support in major version bumps this month as part of the same Puppet Core modernization pass: package, node_encrypt, service, reboot, and tomcat. reboot also picked up CentOS 9 support in the same release.

Affected modules: package, node_encrypt, service, reboot, tomcat.

Continuous Delivery for PE: Required Upgrade for Newer PE Versions

cd4peadm 5.17.0 is a required upgrade if you're integrating with PE 2023.8.11, 2025.12.0, or 2026.0.0+. Those PE versions now require cert-based auth on puppetserver's /status/v1/services endpoint, and CD's older unauthenticated calls to it fail with a 403 until you upgrade.

The same release also adds Puppet 9 support and closes a second batch of CVEs (bouncycastle, react-router, nanoid, and others).

Security Compliance Management Patches 117 CVEs

Security Compliance Management 3.9.0, shipped as both comply and complyadm, updates roughly 20 bundled third-party components to address 117 CVEs. These included curl/libcurl, OpenSSL, the Netty codec family, Jackson Databind, Keycloak services, and libxml2. — .

Also restricts the Keycloak administration console and Admin REST API from public access by default, and adds support for pulling container images from a private or air-gapped registry instead of only the public default.

What Updates Happened to Puppetlabs Modules in August 2026?

The following is an alphabetical listing of modules which received updates in August 2026. If a module had multiple versions released, the updates are collected together, numbered with the "latest" version available.

cd4pe 3.4.1

📅 Latest release: 2026-08-13 (🌐 View on the Forge)

Adds Puppet version 9 to the version requirements and updates the module with PDK 3.8.0, along with allowing the stdlib dependency to move to 10.x.

Added version 9 to the Puppet version range.
Updated module with PDK 3.8.0.
Expanded the puppetlabs-stdlib dependency to allow stdlib 10.x.
Removed unused/dead methods from cd4pe_client.rb.

cd4pe_jobs 1.7.5

📅 Latest release: 2026-08-12 (🌐 View on the Forge)

Adds Puppet version 9 support without dropping Puppet 7.

Support for Puppet 9. The puppet requirement in metadata.json is now >= 7.24 < 10.0.0.

cd4peadm 5.18.0

📅 Latest release: 2026-08-26 (🌐 View on the Forge)

Two releases this month for Continuous Delivery for PE: 5.17.0 is a required upgrade for anyone integrating with PE 2023.8.11, 2025.12.0, or 2026.0.0+ — those PE versions require cert-based auth on puppetserver's /status/v1/services endpoint, which CD previously called unauthenticated, and integration fails with a 403 until you upgrade. 5.17.0 also adds Puppet version 9 support. 5.18.0 follows up with a smaller set of fixes: ssl_cert_chain and ssl_crl in common.yaml can now reference file paths instead of requiring inline PEM contents, and several UI rendering bugs are fixed. Combined, the two releases close 42 CVEs.

Includes monthly releases: 5.18.0 (2026-08-26), 5.17.0 (2026-08-18).

Added support for version 9 of Puppet.
Fixed an issue where lastLoginTime data might not be current in some situations. The lastLoginTime field of the user details response from GET /v1/users/{userID} is now correctly updated for LDAP and SAML logins, as well as the initial login after account creation.
Fixed an issue where some upgraded environments could show a blank Pipelines as Code view and a blank approval details page for module repo pipelines. These pages now render properly without recreating the pipeline.
42 CVEs addressed.

Check the official release notes for cd4peadm 5.18.0 for the full details.

comply 3.9.0

📅 Latest release: 2026-08-21 (🌐 View on the Forge)

Security Compliance Management 3.9.0 addresses 117 CVEs across bundled third-party components, adds support for a private or air-gapped image registry, and restricts the Keycloak administration console and Admin REST API from public access by default.

Supported benchmarks updated in this release: Microsoft Windows 11 Enterprise Benchmark v5.1.0 Microsoft Windows Server 2022 Benchmark v5.1.0 Microsoft Windows Server 2025 Benchmark v2.1.0.
Fixed an issue where Assessor CLI downloads could fail if the assessor files were added after the comply-ui container started. Downloads now work after the files are deployed without requiring a manual container restart.
Fixed an issue where default desired compliance could select different non-STIG benchmarks for the same operating system and version depending on database query ordering. SCM now uses a deterministic selection rule so the default benchmark is chosen consistently.
117 CVEs addressed.

Check the official release notes for comply 3.9.0 for the full details.

complyadm 3.9.0

📅 Latest release: 2026-08-21 (🌐 View on the Forge)

Ships the same Security Compliance Management 3.9.0 update as comply, covering the same 117 CVE remediations, the new private/air-gapped image registry option, and the Keycloak admin console/API restriction.

Supported benchmarks updated in this release: Microsoft Windows 11 Enterprise Benchmark v5.1.0 Microsoft Windows Server 2022 Benchmark v5.1.0 Microsoft Windows Server 2025 Benchmark v2.1.0.
Fixed an issue where Assessor CLI downloads could fail if the assessor files were added after the comply-ui container started. Downloads now work after the files are deployed without requiring a manual container restart.
Fixed an issue where default desired compliance could select different non-STIG benchmarks for the same operating system and version depending on database query ordering. SCM now uses a deterministic selection rule so the default benchmark is chosen consistently.
117 CVEs addressed.

Check the official release notes for complyadm 3.9.0 for the full details.

cron_core 2.0.3

📅 Latest release: 2026-08-12 (🌐 View on the Forge)

Fixes a bug where CronParam#numfix used the =~ operator on non-String values, and updates the related spec tests.

(PE-45112) Don't use =~ on non-String in CronParam#numfix and update spec tests #94 (AriaXLi)

exec 4.1.0

📅 Latest release: 2026-08-31 (🌐 View on the Forge)

Adds support for Puppet Core 9.

(MODULES-11713) Add Puppet 9 support #250 (imaqsood)

inifile 6.5.0

📅 Latest release: 2026-08-31 (🌐 View on the Forge)

Adds Puppet Core 9 support, and fixes array_matching to return the first element when it isn't set to :all.

(MODULES-11703) Add Puppet 9 support #573 (imaqsood)
Return the first element if array_matching is not :all #571 (bwitt)

java 12.1.0

📅 Latest release: 2026-08-31 (🌐 View on the Forge)

Adds Puppet Core 9 support and defaults RHEL 10 nodes to OpenJDK 21.

(MODULES-11704) Add Puppet 9 support #630 (imaqsood)
(MODULES-11917) Default RHEL 10 to OpenJDK 21 #631 (imaqsood)

kubernetes 8.1.1

📅 Latest release: 2026-08-11 (🌐 View on the Forge)

Bumps several dependency constraints (augeasproviders_sysctl, augeas core, stdlib) and moves the module to Puppet Core 8, alongside a fix for kubernetes_version matching and a batch of CI/environment maintenance work.

fix(MODULES-11856): Bump augeasproviders_sysctl to <5.0.0 and core to <6.0.0 #722 (imaqsood)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #718 (imaqsood)
CAT-2378: Update puppetlabs-kubernetes to use Puppet Core 8 #712 (span786)
Fix kubernetes_version matching #705 (xbulat)
ci(MODULES-11557): add Twingate setup step to GitHub Actions workflow #704 (imaqsood)
MODULES-11577 chore(ruby): upgrade Ruby from 2.7 to 3.1 #702 (imaqsood)
(MAINT): Updated the version for puppetlabs-apt module in metadata.json file #698 (span786)
(CAT-2193): Fixed kubernetes environment setup for Debian. #694 (span786)
(CAT-2095): Fixed puppetlabs-kubernetes modules CI & nightly failures #693 (span786)

lvm 4.1.0

📅 Latest release: 2026-08-31 (🌐 View on the Forge)

Now supports Puppet Core 9.

(MODULES-11719) Add Puppet 9 support #391 (imaqsood)

mount_iso 5.1.0

📅 Latest release: 2026-08-31 (🌐 View on the Forge)

Puppet Core 9 is now supported.

(MODULES-11723) Add Puppet 9 support #61 (imaqsood)

node_encrypt 4.0.0

📅 Latest release: 2026-08-31 (🌐 View on the Forge)

Drops Puppet 7 support (BREAKING) as part of a Puppet Core update, and adds version 9 support in the same release.

(CAT-2382) Update for Puppet Core / Drop Support for Puppet 7 #125 (david22swan)
(MODULES-11724) Add Puppet 9 support #126 (imaqsood)

package 4.0.0

📅 Latest release: 2026-08-31 (🌐 View on the Forge)

Puppet 7 support gets dropped (BREAKING) as part of a Puppet Core update and also adds Puppet Core 9 support. Also, Chocolatey bootstrap failures are now surfaced more clearly in Windows acceptance testing.

(CAT-2384) Prepare module for Puppet Core / Drop Support for Puppet 7 #346 (shubhamshinde360)
(MODULES-11927) Surface chocolatey bootstrap failures in Windows acceptance #354 (imaqsood)
(MODULES-11730) Add Puppet 9 support #353 (imaqsood)
(CAT-2296) Update github runner image to ubuntu-24.04 #345 (shubhamshinde360)

puppet_metrics_collector 8.2.3

📅 Latest release: 2026-08-14 (🌐 View on the Forge)

Fixes a PostgreSQL 17 checkpoints query and hardens version parsing, cleans up puppet-lint warnings, and removes a broken plaintext-port fallback in PuppetDB metrics collection.

Includes monthly releases: 8.2.3 (2026-08-14), 8.2.2 (2026-08-07).

(PE-45849) Fix PG17 checkpoints query and harden version parsing #213 (beechtom)
Fix puppet-lint space_before_arrow and 140chars warnings #210 (jonathannewman)
Remove broken plaintext-port fallback in PuppetDB metrics collection #209 (jonathannewman)

reboot 6.0.0

📅 Latest release: 2026-08-26 (🌐 View on the Forge)

Drops Puppet 7 (BREAKING) amd adds support for Puppet Core 9 and CentOS 9.

(CAT-2388) Puppet Core update and Remove Puppet 7 support #378 (LukasAud)
(MODULES-11707) Add Puppet 9 support #381 (skyamgarp)
(CAT-7110) Add CentOS 9 support #373 (shubhamshinde360)

security_policy 1.1.0

📅 Latest release: 2026-08-04 (🌐 View on the Forge)

A kerberos_policy type/provider and a new_guest_name class parameter are added, expanding the module's native parity coverage ahead of SCE integration.

[MODULES-11883/MODULES-11884] Epic F: kerberos_policy type/provider (F.1) + new_guest_name parameter (F.2) #45 (mehul-jain1)
[MODULES-11884] Add new_guest_name class parameter (Epic F.2) #44 (mehul-jain1)
[MODULES-11848] plan: add Epic F (native parity superset for SCE integration) #43 (mehul-jain1)
plan/: post-release cleanup — Epics A/B/D/E done, Epic C transferred to puppetlabs-sce_windows #42 (mehul-jain1)
[MODULES-11804] CHANGELOG: rename Breaking Changes -> Changed (release-blocker) #41 (mehul-jain1)

service 4.0.0

📅 Latest release: 2026-08-31 (🌐 View on the Forge)

Drops support for Puppet version 7 (BREAKING) and adds version 9 support.

(CAT-2392) Puppet Core update / Drop support for puppet 7 #263 (LukasAud)
(MODULES-11709) Add Puppet 9 support #268 (imaqsood)
Update link for contributing documentation #264 (jst-cyr)
(CAT-2296) Update github runner image to ubuntu-24.04 #262 (shubhamshinde360)

sshkeys_core 3.0.2

📅 Latest release: 2026-08-05 (🌐 View on the Forge)

Hardens the sshkey type by rejecting key values that contain embedded whitespace, preventing malformed authorized_keys entries.

(PA-8911) Reject embedded whitespace in sshkey key #1 (mhashizume)

stdlib 10.0.2

📅 Latest release: 2026-08-06 (🌐 View on the Forge)

Fixes a stdlib::manage parser bug that failed to parse $type resources.

fix(stdlib::manage) parser fails $type resources #1477 (jcpunk)

tomcat 8.0.0

📅 Latest release: 2026-08-11 (🌐 View on the Forge)

Drops Puppet 7 support (BREAKING) as part of a Puppet Core update, and allows the stdlib dependency to move to 10.x.

(CAT-2396) Prepare module for Puppet Core / Drop Support for Puppet 7 #580 (david22swan)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #584 (imaqsood)
Update link for contributing documentation #583 (jst-cyr)
(CAT-2296) Update github runner image to ubuntu-24.04 #579 (shubhamshinde360)

windows_eventlog 5.2.0

📅 Latest release: 2026-08-31 (🌐 View on the Forge)

Adds Puppet Core 9 support to the module.

(MODULES-11729) Add Puppet 9 support #100 (imaqsood)

Until Next Time!

That wraps up the August 2026 roundup. If any of these modules intersect with your environment, especially the five modules that removed Puppet 7 support (package, node_encrypt, service, reboot, and tomcat), or some of the other breaking or required changes, the linked Forge pages and release notes are worth a closer look before upgrading.

Feedback on the series is always useful, especially if there are module families or release-note patterns that deserve more attention in future editions.

More updates coming next month when the September 2026 releases land, and you should expect to see continued Puppet Core 9 support rolling out across September!

🤖 AI Disclosure

Security Compliance Management 3.9.0 now supports Ubuntu 24.04, RHEL 10, Puppet Core 9 and new benchmarks!

Jason St-Cyr — Thu, 27 Aug 2026 14:29:27 +0000

The latest Security Compliance Management (SCM) 3.9.0 has new supported platforms, improvements for air-gapped environments, benchmark updates, feature improvements, and security updates to address vulnerabilities.

Highlights

Expanded platform support: SCM 3.9.0 now supports Ubuntu 24.04, Red Hat Enterprise Linux (RHEL) 10, and Puppet 9
Private image registry support: complyadm can now pull SCM container images from a private image registry to better support air-gapped and private-registry environments.
IP-based access restrictions: Keycloak Administration Console and Admin REST APIs can now be access restricted to IP addresses defined in the frontdoor allowlist.
Expanded benchmarks: CIS-CAT Pro Assessor was updated to 4.65.0, expanded benchmark support for AlmaLinux and MacOS, and updated coverage on Microsoft Windows.
119 security vulnerabilities addressed via updates and fixes, along with several other security hardening fixes.

Below are some other summary details, but you may want to jump straight into the full release notes right away!

CIS-CAT Pro Assessor Updates

Along with updating to CIS-CAT Pro Assessor 4.65.0, the following benchmarks were added:

AlmaLinux OS 9 STIG v1.0.0
Apple macOS 15 (Sequoia) STIG v1.1.0
Apple macOS 26 Tahoe STIG v1.0.0

These supported benchmarks were also updated:

Microsoft Windows 11 Enterprise Benchmark v5.1.0
Microsoft Windows Server 2022 Benchmark v5.1.0
Microsoft Windows Server 2025 Benchmark v2.1.0

Operational Improvements and Security updates

There were several changes made to improve behavior and address vulnerabilities in this release, including addressing 119 security reports.

A few notable changes:

SCM handles interrupted scheduled scans after reboots more reliably.
Default benchmark selection is now more reliable when multiple non-STIG benchmarks are available.
Hasura GraphQL field suggestions are now disabled to prevent schema enumeration.

See the full list in the release notes!

Why Upgrade?

For customers running Ubuntu 24.04, RHEL 10, Puppet 9, private registries, or security-sensitive environments, SCM 3.9.0 delivers meaningful operational, platform, and security improvements. Combined with expanded benchmark coverage and enhanced upgrade behavior, this release helps organizations maintain compliance with greater confidence and less administrative overhead.

View the full SCM 3.9.0 release notes!

🤖 AI Disclosure

This summary was initially drafted by AI and deterministic automation to pull together release notes information from the latest Security Compliance Management 3.9.0 release notes. The draft was then human edited, rewritten, and reviewed before publishing.

Puppet Core 9.0 and 8.21 Released: Ruby 4.0, OpenSSL 3.5, Platform Changes, and Security Hardening

Jason St-Cyr — Thu, 20 Aug 2026 15:26:21 +0000

Did you know there's a new major version in town for Puppet Core? You might have heard about it through the grapevine or in the Are You Ready for Puppet 9? webinar that @gpatton and I recently hosted. The wait is over and Puppet Core 9.0.0 is now available alongside Puppet Core 8.21.0.

Puppet Core 9 introduces significant runtime and platform changes, moving to Ruby 4.0, OpenSSL 3.5, and other changes, but the essential Puppet under the hood is largely unchanged from Puppet 8. The majority of upgrade effort will center on Ruby 4 compatibility and runtime dependency changes rather than Puppet language changes.

If you are staying on the Puppet Core 8.x release track, the latest Puppet Core 8.21 delivers the basic support fixes and security improvements you might need without the major dependency changes found in Puppet Core 9.

What matters most for the admins

Before upgrading to Puppet Core 9:

Test custom facts, functions, types, and providers against Ruby 4.0.
Validate any Forge modules you use for Ruby 4 compatibility.
Review integrations that depend on OpenSSL behavior.
Verify any workflows that still rely on SHA-1.
Confirm managed nodes are running supported operating systems.
Review any custom code that depends on PSON or multi_json.
Check deferred function behavior if you have custom types or providers.

Perforce will be rolling out updates to Puppetlabs modules on the Forge based on their priority tier and dependencies. The first batch of these should be rolling out soon.

Puppet Core 9.0 highlights

These are a few highlights I pulled from the release notes. Make sure to reference the full 9.0 release notes to get all the details about what has changed!

Ruby updated to 4.0.5: With a new Ruby baseline some deprecated syntax from older Ruby versions will no longer be compatible. This is the primary focus area for upgrades as you will want to validate your custom code and modules. The latest PDK 3.8.0 introduced some Ruby 4 validators to help you update your syntax while you are still on Puppet Core 8, before upgrading to Puppet Core 9.
OpenSSL updated to 3.5.7: This lays the groundwork for supporting post-quantum cryptography (PQC) and moves to TLS 1.3 as the default protocol version. This upgrade will resolve several OpenSSL-related CVEs.
Puppet Server has updated baseline components: As part of the move to JRuby 10.1, Puppet Server is now updated to require minimum JDK 21. The embedded web server is now using Jetty 12.
PSON support removed: You will need to migrate to a supported data format if your code has relied on PSON.
Deferred functions return to Puppet 7 behavior: While Puppet Core 9 largely keeps the same underlying behavior as Puppet Core 8.x, there is one change worth noting about deferred functions. In older versions (like Puppet 7), preprocess_deferred was enabled by default, but this was disabled by default in Puppet 8. In Puppet Core 9, preprocess_deferred is now enabled by default again.
UTF-8 encoding now used on Windows: Puppet Core now uses UTF-8 as the default external encoding on Windows. You will want to look for any configuration files encoded in non-UTF-8 before upgrading.

These are just some highlights I pulled from the full list, I really recommend taking a look at the release notes to get a full picture.

Security hardening

Both the 9.0 and 8.21 releases contain security-related fixes.

Stricter SSH key validation: Puppet now rejects malformed SSH keys that previously passed validation. This includes invalid inputs such as embedded newline characters. The goal is to prevent unsafe content from being written to managed files.
Improved autoloader validation: The puppet resource command now performs stricter validation of autoloader inputs. This change helps prevent unintended code loading through user-controlled values.
curl updated to 8.21.0: Both Puppet Core 9.0 and Puppet Core 8.21 update curl from 8.20.0 to 8.21.0. The update addresses numerous curl CVEs.

Admins who track dependency risk should review the release notes for the complete CVE list:

Platform updates

New agent platforms

The following agent platforms are now supported in both Puppet Core 9.0 and 8.21:

Rocky Linux 10 (x86_64)
Alma Linux 10 (x86_64)

Operating systems removed from support

Several end-of-life operating systems have been removed: Debian 10, macOS 13, RHEL 7, Ubuntu 18.04 and 20.04, and others.

The official full list is in the docs. The list in this article is not complete, so make sure to reference those notes to check your systems!

If you need to keep using a platform that has been removed you should know there is an extended support option. Migrating to a more modern OS is likely the best path, but if you can't migrate just yet, make sure to reach out to the team to get help with extended platform support

Upgrade resources

Before moving to Puppet Core 9, review the official upgrade documentation and release notes:

Make sure to start your Puppet Core 9 compatibility testing early and send over any questions as you encounter issues so that the team can help!

PDK 3.8.0 now has Ruby validation to prepare for Puppet 9!

Jason St-Cyr — Tue, 11 Aug 2026 12:53:45 +0000

A new release is out for the Puppet Development Kit and it has some new additions like Debian 13 support, some security-related updates, and some new validation for Ruby syntax to help you get yourself ready for Puppet Core 9!

The next releases of Puppet Core 9 and Puppet Enterprise 2026, due out soon, will be moving to Ruby 4. To help you get ready, you can start using this new version of PDK on your Puppet 8 installation to look for areas that might need updates.

When you run pdk validate, it can now identify changes you can make that will be safe to run on Puppet 8, but also will prepare your codebase for Puppet Core 9:

Code that uses legacy Ruby Hash#inspect formatting, for example {:x=>1, "baz"=>3} . Legacy formatting can cause module code to fail after you upgrade to Puppet Core 9.
Ruby 4 syntax compatibility checks.
The Security/Open Rubocop flags Ruby patterns associated with Kernel#open and IO.open invocation that are no longer valid in Ruby 4.

Once Puppet Core 9 is out, you'll be able to do additional validation, but this should help you get started finding those places where the syntax might need some updates.

Full release notes: https://help.puppet.com/pdk/current/topics/release_notes_pdk.htm#PDK380

Download PDK: https://forge.puppet.com/resources/pdk

Puppetlabs Modules Roundup - July 2026

Jason St-Cyr — Thu, 06 Aug 2026 12:19:41 +0000

July 2026 brought 17 Puppetlabs module releases, headlined by a fairly large Continuous Delivery release. cd4peadm 5.16.0 added external PostgreSQL database support and a configurable image pull policy, and closes 11 CVEs, alongside a breaking change to commit status contexts. More modules dropped Puppet 7 support, some others picked up stdlib 10, and Windows Server 2025 support started rolling out into the modules. This roundup pulls the most important changes into one place.

Highlighted Updates

Continuous Delivery Adds External Databases, Configurable Image Pull Policies, and Closes 11 CVEs

cd4peadm 5.16.0 is the biggest release of the month. It adds support for pointing Continuous Delivery at an externally managed PostgreSQL database. That could be a self-managed instance, Amazon RDS for PostgreSQL, or Amazon Aurora. This externally managed db can be used instead of the database CD manages internally, giving operators control over durability, backups, and high availability. It also adds a configurable image_pull_policy option for job templates (Always/IfNotPresent/Never) and removes the docker.io fallback when using Podman; the matching cd4pe_jobs 1.7.4 release adds the same task parameter and fallback removal, so upgrade both together.

BREAKING: Commit status contexts now include the pipeline name (cd-pe/<pipelineName>/stage-<N> instead of cd-pe/stage-<N>). Review any branch protection rules or required status checks that reference the old format.
This release also closed 11 CVEs across opentelemetry, NGINX, jetty, jackson, log4j, postgresql, golang.org/x/sys, and react-router.

Puppet 7 Support Dropped

Five modules dropped Puppet 7 support in major version bumps:

haproxy, iis, mount_iso, scheduled_task, sslcertificate.

There were all released as major version bumps to ensure that users still working on upgrading from Puppet 7 can stay pinned on the previous major version releases.

In related news, postgresql 10.6.3 restored the Puppet 7 support that 10.6.2 broke in a previous release; see its entry below.

stdlib 10.x Rollout Continues

Following June's stdlib 10.x rollout, four more modules now allow the puppetlabs-stdlib dependency to move to 10.x: haproxy, mount_iso, puppet_authorization, and sslcertificate. haproxy also widens its concat constraint to 10.x.

Affected modules: haproxy, mount_iso, puppet_authorization, sslcertificate.

Windows Server 2025 Support Added

Three Windows-focused modules added support for Windows Server 2025 this month: scheduled_task, windows_env, and windows_eventlog. These now all run acceptance testing against the 2025 version of the OS, in addition to other supported Windows versions.

What Updates Happened to Puppetlabs Modules in July 2026?

The following is an alphabetical listing of modules which received updates in July 2026. If a module had multiple versions released, the updates are collected together, numbered with the "latest" version available.

apache 13.3.0

📅 Latest release: 2026-07-23 (🌐 View on the Forge)

Added OWASP CRS v4 support on modern Enterprise Linux (EL10) while preserving existing EL7/8/9 behaviour.

(MODULES-11857) Scaffold OWASP CRS v4 support on EL10 via crs_source enum #2637 (SugatD)

cd4pe_jobs 1.7.4

📅 Latest release: 2026-07-28 (🌐 View on the Forge)

Adds the same configurable image_pull_policy task parameter and Podman fallback removal shipping in cd4peadm 5.16.0 — upgrade both together to get matching behavior.

A new optional image_pull_policy task parameter controls whether the container image is pulled before a job runs: Always (the default, and the previous behavior) pulls on every run; IfNotPresent pulls only when the image is absent from the local runtime; Never skips the pull entirely and relies on the locally present image. Presence is checked with docker image inspect / podman image exists. Omitting the parameter keeps the existing pull-every-run behavior.
The module no longer retries a failed image pull against docker.io. Image names are now pulled exactly as given. If you rely on unqualified image names (e.g. nginx, myuser/myimage) on a Podman host, add docker.io to unqualified-search-registries in registries.conf, or use a fully-qualified name.

cd4peadm 5.16.0

📅 Latest release: 2026-07-29 (🌐 View on the Forge)

The changes this month added external PostgreSQL database support, a configurable image pull policy, source control token management improvements, and closed 11 CVEs. There is also a breaking change to commit status contexts — see below (and the linked release notes).

Added support for external databases. You can now point Continuous Delivery at a PostgreSQL instance you operate yourself, Amazon RDS for PostgreSQL, Amazon Aurora (PostgreSQL-compatible), or a self-managed PostgreSQL server, instead of the database CD manages for you. This gives you control over durability, backups, and high availability. You can configure external mode on a fresh install or migrate an existing managed install.
Added a feature to Continuous Delivery job templates so you can set an image pull policy per job (Always, IfNotPresent, or Never). In an air-gapped environment, for example, setting the policy to Never stops Continuous Delivery's attempts to reach out to the internet for the image.
Updated the Source Control settings page to show when a configured Personal Access Token (PAT) expires on each connected GitHub, GitHub Enterprise, and GitLab integration card. Tokens that have already expired or will expire within 30 days are clearly flagged so you can renew them before they cause failures.
BREAKING: Commit status contexts now include the pipeline name (cd-pe/<pipelineName>/stage-<N> instead of cd-pe/stage-<N>), which prevents collisions when multiple pipelines report status for the same commit. Review any branch protection rules or required status checks that reference the old format.
11 CVEs addressed, including opentelemetry, NGINX, jetty, jackson, log4j, postgresql, golang.org/x/sys, and react-router.

Check the official release notes for cd4peadm 5.16.0 for the full details.

comply 3.8.1

📅 Latest release: 2026-07-03 (🌐 View on the Forge)

A Security Compliance Management maintenance release that did not have any new CVE fixes this time and was mostly operational and licensing improvements.

Increased the CIS-CAT Pro Assessor license expiry time; licenses are now good for a full year.
Added a license_path parameter to update the CIS-CAT Pro Assessor license without upgrading SCM.
Added an assessor_scan_timeout option to control the task timeout for Windows 2022 domain controllers.
Added a background scan sweeper that detects and cancels scans stuck in a "running" state.
Increased the default Max graphql requests limit to 300 requests per window; use the complyadm::configure Bolt plan to customize.

Check the official release notes for comply 3.8.1 for the full details.

haproxy 9.1.0

📅 Latest release: 2026-07-28 (🌐 View on the Forge)

Two releases this month: 9.0.0 dropped Puppet 7 support (BREAKING) and added cache resource support, while 9.1.0 removed a sensitive-data workaround and allows both stdlib and concat to move to their 10.x releases.

Includes monthly releases: 9.1.0 (2026-07-28), 9.0.0 (2026-07-20).

Eliminate Workaround for Sensitive Data; raises minimum puppetlabs/concat requirement to 7.4.0 #607 (cocker-cc)
Add support for running programs #604 (deric)
Pass install_options to package installer #603 (deric)
examples: disable default stats listener #640 (bastelfreak)
make picking haproxy::globals::sort_options_alphabetic work #573 (trefzer)
Remove Puppet 7 support (BREAKING); the module now requires puppet >= 8.0.0 < 9.0.0 #631 (gavindidrichsen)
Add support for cache resource, extra backend options, and docs #626 (matejzero)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #642 (imaqsood)
Allow puppetlabs/concat 10.x #641 (bastelfreak)
dependency: create mapfile before configfile #572 (trefzer)

iis 11.0.0

📅 Latest release: 2026-07-01 (🌐 View on the Forge)

Dropped Puppet 7 support (BREAKING) as part of ongoing modernization efforts, and marked the iis_application_pool password parameter as sensitive so it no longer leaks into Puppet reports.

(CAT-2374) Puppet Core update (BREAKING) — drops Puppet 7 support #414 (LukasAud)
(MODULES-11595) Mark iis_application_pool password as sensitive to stop report leak #418 (imaqsood)

mount_iso 5.0.0

📅 Latest release: 2026-07-22 (🌐 View on the Forge)

Dropped Puppet 7 support (BREAKING) and allowed the stdlib dependency to move to 10.x.

(CAT-2380) Update for Puppet Core / Drop Support for Puppet 7 (BREAKING) #58 (david22swan)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #59 (imaqsood)

mysql 17.1.0

📅 Latest release: 2026-07-02 (🌐 View on the Forge)

This month was a small update but important as RHEL 10 support was added.

(MODULES-11802) Add support for RHEL 10 #1712 (skyamgarp)

node_encrypt 3.2.0

📅 Latest release: 2026-07-22 (🌐 View on the Forge)

Adds Ubuntu 24 and Debian 12 support, and upgrades rexml to address a CVE.

(CAT-2124) Add support for Ubuntu 24 #120 (skyamgarp)
(CAT-2100) Add Debian 12 support #119 (shubhamshinde360)
(CAT-2158) Upgrade rexml to address CVE-2024-49761 #121 (amitkarsale)

peadm 3.38.1

📅 Latest release: 2026-07-08 (🌐 View on the Forge)

Restores public-schema privileges on PostgreSQL 15+ in restore.pp, fixing a bug that could affect PE restores on newer PostgreSQL versions.

(PE-44867) Restore public-schema privileges on PostgreSQL 15+ in restore.pp #676 (CharithaDunuwille)

postgresql 10.6.3

📅 Latest release: 2026-07-07 (🌐 View on the Forge)

Restores Puppet 7 support that was unintentionally dropped in the 10.6.2 patch release last month.

NOTE: As flagged in June's roundup, the Puppet 7 removal in 10.6.2 shipped in a patch release rather than a major one. 10.6.3 restores Puppet 7 support; the removal will happen again, correctly, in a future major release.

(MODULES-11858) Restore Puppet 7 support broken by 10.6.2 #1686 (imaqsood)

puppet_authorization 1.0.1

📅 Latest release: 2026-07-21 (🌐 View on the Forge)

A maintenance release: allows both the stdlib and concat dependencies to move to 10.x, tweaks a CI workflow flag, and adds a LICENSE file.

Change flag option in CI workflow #56 (zaben903)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #57 (imaqsood)
puppetlabs/concat: Allow 10.x #55 (bastelfreak)
Create LICENSE #52 (binford2k)

sce_linux 2.8.0

📅 Latest release: 2026-07-28 (🌐 View on the Forge)

Updates CIS Benchmarks from v3.0.0 to v4.0.0 for RHEL 8, AlmaLinux 8, and Oracle Linux 8, with matching control updates for each, and fixes three bugs affecting benchmark enforcement.

Updated CIS Benchmarks. RHEL 8, AlmaLinux 8, and Oracle Linux 8 move from CIS Benchmark v3.0.0 to v4.0.0, with matching control updates for each operating system.
Updated dependency. SCE for Linux now supports puppetlabs-stdlib >= 9.2.0 < 11.0.0; avoid using earlier stdlib versions.
Fixed: the user-specified default_zone setting was not enforced for CIS control 3.4.1.2; it is now enforced correctly.
Fixed: aide --init failed on RHEL/AlmaLinux/Oracle Linux/Rocky Linux 8 hosts shipping AIDE 0.17.x, which renamed the database= directive to database_in=.
Fixed: CIS control 6.2.2.2 (journald log-forwarding) did not work as designed on RHEL/AlmaLinux/Oracle Linux/Rocky Linux 9 and 10; control 6.2.3.3 was also added.

Check the official release notes for sce_linux 2.8.0 for the full details.

scheduled_task 5.0.0

📅 Latest release: 2026-07-13 (🌐 View on the Forge)

Drops Puppet 7 support (BREAKING) and also adds Windows Server 2025 support.

(CAT-2391) Puppet Core upgrade (BREAKING) — drops Puppet 7 support #271 (LukasAud)
[MODULES-11616] Adding Windows 2025 support to module #275 (jst-cyr)
Update link to contributing documentation #273 (jst-cyr)

sslcertificate 6.0.0

📅 Latest release: 2026-07-22 (🌐 View on the Forge)

Drops Puppet 7 support (BREAKING) and allows the stdlib dependency to move to 10.x.

(CAT-2394) Puppet Core update (BREAKING) — drops Puppet 7 support #142 (LukasAud)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #143 (imaqsood)

windows_env 6.1.0

📅 Latest release: 2026-07-21 (🌐 View on the Forge)

Adds Windows Server 2025 support.

(MODULES-11891) Add Windows Server 2025 support #115 (imaqsood)

windows_eventlog 5.1.0

📅 Latest release: 2026-07-22 (🌐 View on the Forge)

Adds Windows Server 2025 support.

(MODULES-11892) Add Windows Server 2025 support #98 (imaqsood)

Until Next Time!

That wraps up the July 2026 roundup. If any of these modules intersect with your environment. especially the cd4peadm breaking change to commit status contexts and the Puppet 7 removals, the linked Forge pages and release notes are worth a closer look before upgrading.

Feedback on the series is always useful, especially if there are module families or release-note patterns that deserve more attention in future editions!

More updates coming next month when the August 2026 releases land.