DEV Community: puppet

New Benchmarks now Available for Puppet SCE for Linux

Jason St-Cyr — Thu, 30 Jul 2026 11:49:16 +0000

Security Compliance Enforcement (SCE) for Linux 2.8.0 is now available, delivering updated CIS Benchmark coverage along with improvements to policy enforcement, auditing, and logging reliability. These updates help organizations strengthen compliance programs, reduce operational risk, and maintain confidence that Linux systems remain aligned with security and governance requirements. SCE for Linux is available as part of Puppet Core and Puppet Enterprise Advanced.

Why Upgrade?

Stay aligned with current CIS guidance through updated benchmark coverage for major enterprise Linux distributions.
Improve audit readiness with expanded benchmark coverage and updated compliance checks.
Reduce operational risk through fixes that improve firewall, integrity monitoring, and logging behavior.
Increase confidence in enforcement by addressing issues that could prevent configurations from being applied as intended.

What's New?

Updated CIS Benchmark support for RHEL 8, AlmaLinux 8, Oracle Linux 8, and Rocky Linux 8.
Enhancements that improve alignment with current benchmark recommendations across system hardening, auditing, networking, and account management.
Reliability improvements for firewall zone enforcement, AIDE-based integrity monitoring, and log forwarding.
Updated platform dependencies to support ongoing compatibility and maintainability.

Security and Maintenance Updates

This release includes maintenance updates and issue resolutions that help improve platform stability, reduce security risk, and support more reliable compliance operations.

Next Steps

Review the release notes for complete details and upgrade guidance, then plan your upgrade to take advantage of the latest benchmark coverage and reliability improvements.

If you're new to SCE, visit the documentation page to learn how it helps automate compliance assessments, policy enforcement, and ongoing audit readiness across enterprise Linux environments.

Building with AI: Our Approach to Responsible Agentic Development in Open Source

Jason St-Cyr — Tue, 28 Jul 2026 12:36:14 +0000

The tech world has been building up towards the shift to a fully agentic development life cycle for a few years now. AI is changing how software gets built.

Across the Puppet ecosystem, we're seeing a shift toward more agentic engineering workflows. AI helps generate code, shape documentation, and accelerate how Puppet modules evolve. This brings real benefits in speed and consistency, but it also raises important questions from the community:

How are AI-generated changes validated?
How do you ensure consistency across modules?
What does this mean for contributors and maintainers?

These are exactly the kinds of questions we should be asking! This article will outline how Perforce and the Puppet team are approaching the use of AI in our open source modules and repositories.

How We Build Trust in AI-Assisted Contributions

At Perforce, AI is a core part of our process and our teams operate within a defined, governed framework for development. We don’t rely on trust in the tool itself. We rely on the processes around it.

Whether a change is written by a person, generated with AI, or some mix of both, they are held to the same standards before it’s accepted and released.

In practice, that means:

Human review is always the gate: Every change is reviewed by maintainers. AI can assist, but it doesn’t replace accountability.
AI works within established patterns: AI-generated code isn’t created in isolation. It’s guided by the same module structures, conventions, and expectations that already exist across the ecosystem.
Validation is continuous and enforced: AI doesn’t change our standards. It reinforces them. AI-generated changes go through the same checks as any other contribution:
- Test suites
- Integration validation
- Functional verification
AI output is a starting point, not a final artifact: Generated code is iterated on, refined, and aligned before acceptance. We treat AI as an accelerator, not an authority.
The community plays an important role Open source means visibility. The community can review changes, raise issues, and contribute ideas. That feedback loop adds another layer of resilience and helps shape how these workflows evolve.

At a high level, our approach is simple: the outcome matters more than how the code was created.

Community Contributions and AI

Community members are not required to use code assist tools when providing contributions to Puppet open source projects, even when those projects contain frameworks or files designed to support coding agents.

Contributions can be made using any tools or workflows that work best for you and there is no expectation to match the Perforce technology stack. While the Puppet team will be adding instructions, skills, and other artifacts to support agentic workflows, including tools like Claude Code, these are provided as optional enhancements, not requirements.

When contributions are reviewed, the same standards apply regardless of how they were created. This includes contributions that contain AI-generated code, are submitted by AI agents, or have been tested or reviewed using AI tools. We welcome contributions in any form, but all submissions go through the same review and approval process before they are accepted and released.

Maintaining Consistency Across the Ecosystem

Another important question we hear is how we avoid duplication or inconsistency as AI becomes part of the workflow. This is where ecosystem-level thinking and governance matter most and where we will be incrementally improving our engineering patterns.

Here’s how we approach that:

Changes are evaluated in context We don’t review contributions in isolation. We look at how they relate to existing modules and whether similar functionality already exists.
Reuse is prioritized over duplication When reviewing changes, we actively ask whether something can be reused instead of reimplemented. This helps maintain DRY principles across the ecosystem—not just within a single module.
Shared patterns guide development AI-assisted changes are aligned to standard module structures, established design patterns, and proven implementation approaches. This helps ensure consistency even as contribution velocity increases.
Documentation is treated as part of the system Generated documentation and supporting artifacts are treated as first-class components. This improves clarity, supports reuse, and helps maintain long-term consistency across modules.

Governance Is Built In, Not Bolted On

Building with AI tools is not left to individual discretion. AI usage at Perforce follows structured processes designed to ensure quality, security, and accountability across the lifecycle.

Here’s what that looks like for Puppet open source teams:

AI tools and workflows are intentionally reviewed We evaluate how AI tools are used within our development process, including how they interact with existing systems and patterns. Only tools approved for use by the Perforce AI governance team can be used for agentic development by Perforce employees.
Risks and dependencies are actively managed Using agentic development flows introduces new considerations from code duplication to unintended behaviors. These are identified, reviewed, and addressed as part of normal development workflows.
Security and compliance are built into the process AI-assisted development operates within the same security, permission, and compliance boundaries as any other contribution.

AI usage is part of a broader AI management system aligned with ISO 42001, ensuring responsible use across the lifecycle.

We also recognize the broader concerns around AI. We're deliberate about how and where AI is used. At its core, governance is about maintaining control while enabling progress. AI should operate within the systems teams already trust, not bypass them.

Our Commitment to the Open Source Community

This evolution isn’t happening in isolation. The Puppet modules team works within an open source ecosystem and it’s important that the community is informed about AI usage and included so that all members of the community are able to provide feedback as these processes evolve.

Our goal is to provide:

Clear communication about AI-assisted changes
Transparency in how contributions are reviewed
Ongoing dialogue as workflows evolve

This is a new world of software delivery that we all maintainers and contributors are collaborating in, and we'll need to work together to find the right process for everyone.

What This Means Going Forward

The agentic software development lifecycle is going to continue to shift and grow. AI will continue to play a growing role in how modules are developed and maintained.

In your favorite Puppetlabs modules, you are going to see:

Structural documentation, skills, instructions, and other frameworks to support agentic development
More AI-assisted contributions to open source repos
More structured documentation that aligns across the ecosystem
An increase in iteration cycles as agentic workflows grow and stabilize

There is one thing that won't change: Every contribution will be held to the same standards of quality, consistency, and trust.

In the end, trust in AI doesn’t come from the model. It comes from the systems, processes, and people behind it.

We want to hear from the community as we continue to evolve these practices and develop a solid agentic-supported workflow for our open source community. We’d love your feedback, so please share your thoughts here or in the Puppet Community Slack.

Additional Resources

These additional resources could be helpful if you are interested in this topic and want to learn more!

AI Governance at Perforce (trust.perforce.com)
Perforce AI Products and Features Achive ISO 42001 Certification (perforce.com)

🤖 AI Disclosure

You'll probably notice a few tell-tale structural suggestions from AI on this one. I experimented with drafting with AI on this one, using our AI Governance documentation and some context I provided about how we work on the Puppet team. From that draft, it has gone through multiple human reviews and a LOT of editing and rework, with a final review by an AI agent for brand voice alignment.

Integrar los datos de fichaje con el software de nóminas: el flujo real (export-validación-gestoría)

Nucleo360 — Mon, 27 Jul 2026 16:17:52 +0000

Desde el 12 de mayo de 2019, el Real Decreto-ley 8/2019 (BOE-A-2019-3481) obliga a todas las empresas en España a llevar un registro horario diario de su plantilla. Ese registro no vive aislado: cada mes, alguien tiene que convertir horas trabajadas, horas extra y ausencias en una nómina. Y ahí es donde muchas pymes pierden tiempo (y cometen errores).

En este artículo documentamos el flujo real para llevar los datos de fichaje de Nucleo360 hasta el software de nóminas o el gestor laboral, con un paso de validación intermedio que te puede ahorrar más de un disgusto.

Empecemos por la honestidad técnica

Nucleo360 no calcula nóminas. Es una decisión de producto deliberada: la plataforma cubre el registro horario, las vacaciones y ausencias, la gestión documental, el canal de denuncias y el resto de la gestión de RRHH de una pyme, y exporta la documentación y los datos al gestor laboral o al software de nóminas que ya usa la empresa. El cálculo de la nómina (convenios, cotizaciones, IRPF) lo hace quien mejor sabe hacerlo: tu asesoría o tu programa de nóminas.

Eso significa que la integración de la que hablamos aquí no es una sincronización mágica en tiempo real, sino un pipeline de datos clásico y robusto: exportar → validar → entregar. Es aburrido, y por eso funciona.

El flujo en tres pasos

Paso 1 · Exportar el periodo desde Nucleo360

Al cierre de cada mes (o del periodo que pacte tu gestoría), se exportan desde Nucleo360 los datos del registro horario del periodo: fichajes por empleado y día, con sus tramos de entrada y salida y los totales. El registro es inmutable y con trazabilidad (quién fichó, cuándo y desde dónde), así que lo que exportas refleja lo que realmente se registró, no una versión editada a posteriori.

Para nóminas, lo habitual es trabajar con el export en formato tabular (CSV) o con los informes del periodo, según lo que acepte tu gestor.

Paso 2 · Validar antes de enviar

Este es el paso que casi nadie hace y el que más errores evita. Antes de entregar los datos a quien hace la nómina, conviene comprobar tres cosas:

Totales por empleado: que las horas del mes cuadran con lo esperado (jornada pactada ± extras).
Huecos: días laborables sin ningún fichaje. Pueden ser vacaciones o ausencias legítimas (cotéjalo con el módulo de vacaciones), o pueden ser olvidos que hay que resolver antes de que lleguen a la nómina.
Solapes: tramos que se pisan entre sí (entrada a las 9:00 y a las 9:30 sin salida intermedia). Suelen indicar un fichaje duplicado o mal cerrado.

Aquí tienes un ejemplo genérico en Python (solo librería estándar) que hace exactamente eso sobre un CSV de fichajes. No depende de ningún proveedor: ajusta los nombres de columna a los de tu export real.

#!/usr/bin/env python3
"""
EJEMPLO GENÉRICO de validación de un CSV de fichajes antes de
entregarlo al gestor laboral. Ajusta columnas y delimitador a tu export.

Formato esperado (una fila por tramo de fichaje):
    empleado_id;nombre;fecha;hora_entrada;hora_salida
    E001;Ana;2026-07-01;08:00;15:00
"""
import csv
import sys
from collections import defaultdict
from datetime import datetime, timedelta

FORMATO_FECHA = "%Y-%m-%d"
FORMATO_HORA = "%H:%M"


def cargar(ruta):
    tramos = defaultdict(list)   # (empleado_id, fecha) -> [(inicio, fin), ...]
    nombres = {}
    with open(ruta, newline="", encoding="utf-8") as f:
        for n_linea, fila in enumerate(csv.DictReader(f, delimiter=";"), start=2):
            try:
                dia = datetime.strptime(fila["fecha"], FORMATO_FECHA).date()
                entrada = datetime.combine(
                    dia, datetime.strptime(fila["hora_entrada"], FORMATO_HORA).time())
                salida = datetime.combine(
                    dia, datetime.strptime(fila["hora_salida"], FORMATO_HORA).time())
            except (KeyError, ValueError) as e:
                print(f"[ERROR] Línea {n_linea}: fila ilegible ({e})")
                continue
            if salida <= entrada:
                # Turno nocturno: la salida cae en el día siguiente
                salida += timedelta(days=1)
            tramos[(fila["empleado_id"], dia)].append((entrada, salida))
            nombres[fila["empleado_id"]] = fila.get("nombre", "")
    return tramos, nombres


def validar(tramos, nombres):
    total = defaultdict(timedelta)
    dias = defaultdict(set)
    incidencias = 0

    for (emp, dia), lista in sorted(tramos.items()):
        lista.sort()
        # Solapes dentro del mismo día
        for (ini_a, fin_a), (ini_b, fin_b) in zip(lista, lista[1:]):
            if ini_b < fin_a:
                print(f"[SOLAPE] {emp} {dia}: "
                      f"{ini_a:%H:%M}-{fin_a:%H:%M} se pisa con {ini_b:%H:%M}-{fin_b:%H:%M}")
                incidencias += 1
        for ini, fin in lista:
            total[emp] += fin - ini
        dias[emp].add(dia)

    # Huecos: días laborables (L-V) sin fichajes dentro del rango del archivo.
    # OJO: pueden ser vacaciones o ausencias legítimas; esto solo los señala.
    for emp, fechas in dias.items():
        d, ultimo = min(fechas), max(fechas)
        while d <= ultimo:
            if d.weekday() < 5 and d not in fechas:
                print(f"[HUECO] {emp} ({nombres[emp]}): sin fichajes el {d} "
                      f"(¿vacaciones/ausencia sin cotejar?)")
                incidencias += 1
            d += timedelta(days=1)

    print("\n--- Totales por empleado ---")
    for emp, t in sorted(total.items()):
        horas = t.total_seconds() / 3600
        print(f"{emp} {nombres[emp]:<20} {horas:6.2f} h en {len(dias[emp])} días")
    return incidencias


if __name__ == "__main__":
    if len(sys.argv) != 2:
        sys.exit("Uso: python valida_fichajes.py fichajes.csv")
    tramos, nombres = cargar(sys.argv[1])
    n = validar(tramos, nombres)
    print(f"\n{n} incidencias detectadas.")
    sys.exit(1 if n else 0)

El script devuelve código de salida distinto de cero si hay incidencias, así que puedes encadenarlo en cualquier automatización: si algo no cuadra, el archivo no sigue viaje hacia la nómina.

Paso 3 · Entregar al gestor (bien empaquetado)

La entrega falla casi siempre por detalles tontos de formato, no por los datos. Pacta con tu gestoría o con quien opere el software de nóminas, una sola vez y por escrito:

Columnas y su orden (una tabla de mapeo de dos columnas es suficiente).
Codificación: UTF-8. Los nombres con tildes y eñes lo agradecerán.
Delimitador (; es lo habitual en España, porque la coma decimal rompe los CSV con ,).
Formato de fecha: ISO 8601 (2026-07-01) evita el clásico baile día/mes.
Fecha de corte: qué día del mes se exporta, para que la nómina no espere.

Y conserva una copia de lo entregado: el registro horario debe conservarse 4 años (art. 34.9 del Estatuto de los Trabajadores).

¿Y la integración directa por API?

Pregunta legítima de cualquier perfil técnico: «¿puedo saltarme el CSV y tirar de API?».

Respuesta honesta: a fecha de este artículo, la integración directa vía API con sistemas de nóminas está [PENDIENTE DE CONFIRMAR CON CLIENTE] — no hay una API pública documentada que podamos enseñarte aquí, y preferimos no inventárnosla. El flujo soportado y probado es el que acabas de leer: export, validación y entrega.

¿Se integra directamente con algún programa de nóminas concreto?

Misma honestidad: no hay integraciones directas confirmadas con programas concretos de nóminas ni con gestorías [PENDIENTE DE CONFIRMAR CON CLIENTE]. Lo que sí funciona hoy es el puente universal: la mayoría de software de nóminas y gestorías aceptan importación de datos tabulares (CSV) o trabajan directamente con los informes del periodo. Pregunta a tu gestor qué formato de importación acepta su herramienta y pacta el mapeo de columnas del Paso 3.

¿Menos glamuroso que un webhook? Sí. ¿Funciona con cualquier gestoría de España sin depender de que dos proveedores se pongan de acuerdo? También.

En resumen

Nucleo360 registra la jornada (registro inmutable, con trazabilidad) y exporta; la nómina la calcula tu gestor o tu software de nóminas.
Valida siempre antes de entregar: totales, huecos y solapes. El script de arriba es un punto de partida.
Pacta el formato con tu gestoría una vez y por escrito; UTF-8, ; e ISO 8601 te evitan el 90 % de los problemas.
API pública e integraciones directas con programas concretos: pendientes de confirmar; hoy el camino es el export.

Si quieres ver el módulo de registro horario en detalle (el plan Basic es gratuito y sin permanencia), tienes toda la información en nucleo360.com.

Última actualización: julio de 2026.

Nucleo360.com

Puppetlabs Modules Now Have Tiered Review Cycles

Jason St-Cyr — Tue, 14 Jul 2026 14:16:39 +0000

If you've been watching the Puppetlabs namespace on the Forge (or waiting on a pull request you opened) you've likely noticed that the pace of inclusion of community pull requests and fixes into the module releases has slowed over the last several cycles. That isn't how we want to serve the community that built these modules with us. The team has been reviewing how we can improve and this post is our commitment to do better. Here are the steps we're taking now:

Clear tiers with review cadences. Modules in the puppetlabs namespace will be grouped into three tiers, each with a defined review schedule (weekly, monthly, or quarterly).
Defining what “review cadence” means in practice. Every community PR gets engineering review in the next scheduled cycle for that module’s tier.
Showing progress monthly. We’ll continue to publish the monthly Modules Roundup covering what was released.

A Tiered Approach to Priorities

We've categorized supported modules in the puppetlabs namespace into three tiers, each with a defined community review cadence:

Tier	Count	Community review cadence
Tier 1: core, business-critical modules	25	Weekly
Tier 2: important, meaningfully used modules	19	Monthly
Tier 3: niche or low-usage modules	22	Quarterly

What a Review Cadence Means

Every community pull request (PR) on a module in the puppetlabs namespace gets engineering review during the next scheduled cycle for that module's tier. This doesn’t mean that every PR will be accepted. Sometimes a pull request needs feedback or changes, some pull requests won't fit a module's direction, but the cadence is intended to make sure that PRs will no longer sit quietly in a queue. That is the baseline we're holding ourselves to with these tiers and review cadences.

We do have a backlog of requests over the years and we will be working through that backlog as well, but priority will be given to active contributions for the purposes of our review cadence.

Tier 1: Our highest-priority modules

The following modules are our committed Tier 1 set. These modules will get a weekly review, with nightly CI coverage, and get priority on maintenance capacity:

puppetlabs-apache
puppetlabs-apt
puppetlabs-augeas_core
puppetlabs-concat
puppetlabs-cron_core
puppetlabs-docker
puppetlabs-firewall
puppetlabs-haproxy
puppetlabs-inifile
puppetlabs-java
puppetlabs-java_ks
puppetlabs-lvm
puppetlabs-mount_core
puppetlabs-mysql
puppetlabs-ntp
puppetlabs-package
puppetlabs-postgresql
puppetlabs-powershell
puppetlabs-reboot
puppetlabs-registry
puppetlabs-ruby_task_helper
puppetlabs-service
puppetlabs-sshkeys_core
puppetlabs-stdlib
puppetlabs-vcsrepo

Tier 2: Monthly reviews

The following modules have currently been assigned to our Tier 2 for prioritization. These modules will get a monthly review.

puppetlabs-accounts
puppetlabs-acl
puppetlabs-bolt_shim
puppetlabs-chocolatey
puppetlabs-facter_task
puppetlabs-iis
puppetlabs-kubernetes
puppetlabs-motd
puppetlabs-mount_iso
puppetlabs-node_encrypt
puppetlabs-puppet_conf
puppetlabs-satellite_pe_tools
puppetlabs-scheduled_task
puppetlabs-sqlserver
puppetlabs-sslcertificate
puppetlabs-tomcat
puppetlabs-windows_env
puppetlabs-windows_eventlog
puppetlabs-wsus_client

Tier 3: Quarterly reviews

The modules assigned to Tier 3 are still supported but will not generally be getting a high degree of priority. These modules will be reviewed quarterly and released as needed.

ca_extend
influxdb
puppet_operational_dashboards
puppetlabs-bash_task_helper
puppetlabs-dropsonde
puppetlabs-dsc_lite
puppetlabs-facts
puppetlabs-host_core
puppetlabs-node_manager
puppetlabs-pe_databases
puppetlabs-pe_event_forwarding
puppetlabs-pe_status_check
puppetlabs-puppet_bolt_server
puppetlabs-puppet_metrics_collector
puppetlabs-puppet_status_check
puppetlabs-selinux_core
puppetlabs-splunk_hec
puppetlabs-yumrepo_core
puppetlabs-zfs_core
puppetlabs-zone_core
ruby-pwsh
support-tasks

The Product and Engineering teams are still reviewing the puppetlabs modules for final placement in Tier 2 or Tier 3 and will follow the cadence associated with their tier once that placement is confirmed. Ultimately, the lists above might shift slightly as the team finds that some modules might need more attention than others.

What has already shipped?

It is one thing to say you will do better and quite another to follow through. We’re sharing this now because we have tangible changes already underway. In a focused sprint on Tier 1 modules, the team triaged and actioned several open community pull requests, some merged after review, some closed after discussion, others consolidated with newer work. You’ll see several modules released this month and next with these merged changes on the Forge. Keep an eye on the Forge modules list or check out the next Puppet Modules Roundup post for a summary!

On the Issues With CI for community PRs

We're aware that testing community contributions has been harder than it should be. The current pull request model makes it difficult to run the full acceptance test suite against a contributor's PR without manual effort by Perforce employees, which slows reviews and discourages contributions. Solving this is a priority for the team and we have been prototyping an improved approach that will meet both user expectations and maintaining a secure infrastructure. We’ll share specifics once it's working end-to-end. This is a known gap we're committed to closing.

How We'll Show Our Work

Monthly Modules Roundup. We publish a roundup each month covering what modules have been released, who contributed, and what’s next. You can follow the series here: Puppetlabs Modules Roundup on dev.to.
Contributor recognition. The release notes on the Forge and in the monthly roundup will call out merged community PRs by name.
Public GitHub transparency. We will be following up with contributors directly in pull requests and issues in our open source modules. In advance of a release, we will continue to merge and close PRs so that you can see what will be included in an upcoming release.

How can you help?

Keep contributing! Keep filing issues. Keep telling us when a module is in your way. If a PR of yours has stalled out, please rebase it or comment on the PR. And if the tiering above looks wrong for how you use Puppet day-to-day, let us know! The whole point of publishing this article is so that the community can understand what is changing and also to invite you to shape where the priority goes.

Tiering is not a one-way decision. 

The tiers outlined here have been based on the activity we have observed in our analytics and the importance identified by customers. If a module you depend on isn't in the tier you think it should be, or perhaps a long-waiting PR or issue is blocking you, reach out via the Puppet Community Slack or leave a comment on the monthly Puppet Modules Roundup posts. We want your input to make sure the tiering meet the needs of all our users.

Driving Value from Puppet Metrics: Puppet Observability Data Connector

klab-systems — Mon, 13 Jul 2026 16:28:45 +0000

What is the Puppet Observability Data Connector?

The Puppet Observability Data Connector is a premium Forge module included with Puppet Enterprise Advanced (PEA). This module provides a deeper dive into your Puppet agent reports. Visualizing these metrics gives you a great way to identify what is healthy and unhealthy in your environment.

Behind the scenes, this module provides 2 core functionalities.

It provides a report processor to convert Puppet reports into usable metrics.
It manages an exporter to serve these metrics for your time series database to scrape.

Example Metrics

Failed nodes
Changed nodes
Catalog cache failures
Stale nodes
Corrective changes
Out of sync resources
Average total run time
Max run time
Run time breakdowns
- Total run time
- Fact generation time
- Catalog application time
- Config retrieval time
- Plugin sync time
- Convert catalog time
Managed resource count by host
Managed resource count over time
Catalog application time trends

Using the metrics provided by Puppet Observability Data Connector, you can make impactful dashboards. Below are some examples that I have created.

Note: All dashboards can be filtered by the environment and/or host. All thresholds for color coding can be modified to fit your environment.

Fleet Status Dashboard Example

This example 'Fleet Status' dashboard provides an always-open first-look insight into whether anything in your fleet requires immediate attention. I will break this down by section.

When to Use a Fleet Status Dashboard?

After deploying Puppet code to confirm no regressions
During incidents to identify affected nodes
As part of a daily ops review to verify fleet-wide compliance

Fleet Health Summary (stat panels)

A top-level count of nodes in each state from the most recent run. Six stats that give you an instant fleet pulse without scrolling.

What this tells you:

Term	Description
Total Nodes Reporting	Quantity of nodes submitting reports; this number should be 1:1 with the amount of Puppet agent managed nodes in your environment
Failed Nodes	Nodes where `puppet_status{state="failed"} == 1;` any non-zero value requires immediate investigation
Changed Nodes	Nodes where Puppet applied changes in the last run; expected after a code push, unexpected otherwise
Unchanged Nodes	Nodes fully converged — your desired steady state
Catalog Cache Failures	Nodes that could not obtain a fresh catalog and fell back to a cached one. Triggers on server/network unreachable or any catalog compilation error (duplicate resource declaration, undefined variable, syntax error, missing module)
Stale Nodes (>2h)	Nodes that haven't reported in over two run intervals; the agent may be down, hung, or disconnected

Node Run Status (bar gauges)

Per-node breakdowns of the two most critical run-level signals.

What this tells you:

Term	Description
Time Since Last Puppet Run	Minutes since each node last phoned home. Green = within one run interval (~30 min), yellow = approaching stale, red = definitely stale. Use to find silent failures where the agent has stopped running entirely.
Transaction Completed by Host	Whether the last run completed (1) or was aborted mid-run (0). An aborted transaction means the node's actual state is unknown — treat it the same as a failure.

Compliance & Drift (stats + bar gauges + time series)

This section separates intentional changes (deployments) from unintentional drift (external actors modifying managed state).

What this tells you:

Term	Description
Total Corrective Changes (Fleet)	Aggregate count of corrective changes across all nodes. A corrective change means Puppet found a resource in the wrong state and fixed it — something external changed it. Persistent non-zero values are a compliance red flag.
Total Failed Resources (Fleet)	Resources that Puppet attempted to enforce but could not. Non-zero always warrants investigation.
Total Event Failures (Fleet)	Resource-level event failures, which can appear even on nodes not marked failed. Catches partial failures.
Total Out-of-Sync Resources (Fleet)	Resources declared in the catalog but not yet in the desired state. Elevated values indicate pending convergence or a broken dependency chain.
Corrective Changes by Host	Identifies which specific nodes are experiencing drift. Nodes with persistent corrective changes may have rogue processes or manual interventions overwriting Puppet-managed state.
Failed Resources by Host	Identifies which nodes have broken resources. Cross-reference with the node's Puppet report for the specific resource type and error message.
Corrective Changes Over Time	Trend view — spikes correlate with manual changes, automated tooling conflicts, or software self-repair mechanisms overwriting managed files.
Failed Resources Over Time	Trend view — a step-change increase after a code push indicates a bug in new Puppet code. A gradual increase may indicate environment drift.

Catalog Cache Status (stats + bar gauge)

Catalog cache usage is a leading indicator of Puppet infrastructure health, often surfacing issues before nodes start failing outright.

What this tells you:

Term	Description
Nodes: Cache Used on Failure	A fresh catalog could not be obtained. Common causes: Puppet server unreachable, network failure, or a catalog compilation error (duplicate resource declaration, undefined variable, syntax error, missing module). The node ran with a potentially stale catalog — investigate PE server logs and the agent's last run report.
Nodes: Cache Explicitly Requested	Nodes intentionally running offline (e.g., --use-cached-catalog). Expected during planned maintenance; unexpected otherwise.
Nodes: No Cache (Fresh Catalog)	Healthy nodes compiling a fresh catalog every run — your desired steady state.
Catalog Cache on Failure – by Host	Pinpoints which nodes are falling back to cache. Use to determine whether it's a widespread compiler/network issue or a node-specific catalog compilation error (check that node's agent log for the exact cause).

Full Dashboard Snapshot

Run Performance Example Dashboard

This example 'Run Performance' dashboard acts as your performance and capacity planning dashboard. It answers whether Puppet is running efficiently and helps you locate bottlenecks before they become outages. I will break this down by section.

When to use a Run Performance dashboard?

Run times are creeping up across the fleet
After adding new modules or resource types to identify compile/apply costs
To compare performance across environments (production vs. feature_demo)
When planning infrastructure scaling (for example, adding more compilers or faster agents)

Performance Summary (stat panels)

Fleet-wide performance KPIs. These numbers represent your overall SLA for Puppet run completion.

What this tells you:

Term	Description
Avg Total Run Time	The mean end-to-end run duration across all selected nodes. Green < 120s, yellow 120–300s, red > 300s.
Max Total Run Time	The slowest node in the fleet — identifies outliers dragging down SLA.
Avg Fact Generation Time	How long Facter is taking on average. This phase runs before catalog compilation so delays here block everything downstream.
Avg Catalog Application Time	How long Puppet spends enforcing resources. A reliable proxy for catalog complexity and system responsiveness.

Run Time Trends (time series)

Long-term trend views to distinguish persistent regressions from one-off anomalies.

What this tells you:

Term	Description
Total Run Time Over Time	The most important single trend. A sudden step-change after a deployment indicates new expensive resources. A gradual increase over weeks suggests catalog bloat or system degradation. A red threshold line at 300s provides a visual SLA boundary.
Fact Generation Time Over Time	Isolates Facter performance from the rest of the run. Upward trends often indicate new custom facts, growing hardware inventories, or external fact sources becoming slow.

Run Time Breakdown – Latest Run (by Host) (bar gauges)

Per-node, per-phase timing from the most recent run. Use this to pinpoint which phase is slow on which node rather than just knowing the total is high.

What this tells you:

Panel	Phase	Optimization Lever
Total Run Time	End-to-end wall clock	—
Fact Generation Time	Running Facter	Audit custom facts; disable unused external facts
Catalog Application Time	Enforcing all resources	Reduce catalog size; identify slow resource types (Package, Exec)
Config Retrieval Time	Fetching compiled catalog from PE server	Scale compilers; check network latency between agent and server
Plugin Sync Time	Downloading Puppet functions/types/providers	Audit and prune modules; check if all plugins are necessary
Convert Catalog Time	Transforming compiled catalog into apply-ready format	Indicates catalog structural complexity

Resource Catalog (bar gauge + time series)

Catalog size is the root cause of many performance problems. These panels correlate resource count with run time.

What this tells you:

Term	Description
Total Managed Resources by Host	Nodes with significantly more resources than peers warrant investigation — are all those resources intentional? `pe.klab.internal` managing 2,419 resources vs 61 for simpler nodes is expected for a PE server; unexpected divergence between similar nodes is not.
Total Managed Resources Over Time	A sudden jump indicates a code change added many new resources. Gradual growth over months indicates catalog bloat — exported resources collecting without cleanup, or defined resource types generating more instances than expected.

Catalog Application Time Trends (time series)

Deeper trend analysis for the two phases most sensitive to infrastructure and code changes.

What this tells you:

Term	Description
Catalog Application Time Over Time	Correlate spikes with git commit timestamps. A spike immediately following a deployment confirms the new code introduced expensive resources. Persistent elevation after the spike stabilizes means the cost is structural, not transient.
Config Retrieval Time Over Time	Sustained increases across all nodes simultaneously point to a PE server bottleneck (JVM heap, database pressure, or compiler overload). Increases on a single node suggest agent-side network issues.

Full Dashboard Snapshot

Download the Puppet Data Connector Forge Module

Want to try it in your environment? Download the premium Forge module now.

Get the Module

Wrap-up

The Puppet Observability Data Connector provides valuable information about the Puppet agent nodes across your environment. Visualizing these metrics gives organizations key insights, allowing team members to identify problems, measure performance, and track changes. The dashboards shown here are just one of the many ways to drive value from your Puppet metrics.

For assistance driving value from your Puppet metrics please ask your account team about how Professional Services could help you with dashboards that match your environment and operational priorities.

Puppetlabs Modules Roundup – June 2026

Jason St-Cyr — Thu, 09 Jul 2026 19:38:46 +0000

In June 2026 we saw the release of a new stdlib 10 that was mentioned in an earlier article along with numerous modules bumped to use the new stdlib 10. In total, 24 Puppetlabs modules were released to the Forge, ranging from a brand-new Windows security policy module to a large batch of third-party CVE fixes in Security Compliance Management. This roundup pulls the most important changes into one place.

Highlighted Updates

New Module: Windows Local Security Policy Management

The new security_policy module manages Windows local security policy using the Puppet Resource API, replacing manual secedit/Local Security Policy editor work.

Provides the security_option and user_right_assignment resource types, covering all 45 Windows Privilege Rights and the System Access settings.
Ships a well-known SID map with a PowerShell fallback for domain and custom accounts.

stdlib 10.x Compatibility Pass

A coordinated maintenance pass loosened the puppetlabs/stdlib dependency constraint across the module set to allow stdlib 10.x, clearing the way for downstream modules to pick up stdlib's latest release.

Affected modules: accounts, apache, apt, chocolatey, concat, docker, firewall, haproxy, inifile, lvm, motd, mysql, ntp, postgresql, wsus_client.

More modules will be released in July as we roll out the support for stdlib 10.x.

Puppet Core Alignment / Puppet 7 Support Dropped

Several modules completed their Puppet Core alignment pass this month, dropping Puppet 7 support in favor of Puppet 8 as Puppet 7 reaches end-of-life.

Affected modules: accounts, chocolatey, haproxy, java, motd, mysql, postgresql, stdlib.

A note that the change to drop Puppet 7 in postgresql was done in a patch release, instead of a major release. This has been corrected in postgresql 10.6.3 and the change will be done again in a major release of that module.

Security Compliance Management Patches ~40 CVEs

Security Compliance Management 3.8.0, shipped as both comply and complyadm, updates a long list of bundled third-party components — Gorm.io, Protobuf, several Netty codec libraries, react-router, and KeyCloak — to close out roughly 40 CVEs.

Also updates the bundled CIS-CAT Pro Assessor to v4.63.0, adding new STIG benchmarks for Amazon Linux 2023, Windows 11, Oracle Linux 9, and RHEL 10.

What Updates Happened to Puppetlabs Modules in June 2026?

The following is an alphabetical listing of modules which received updates in June 2026. If a module had multiple versions released, the updates are collected together, numbered with the "latest" version available.

accounts 9.0.0

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

This release drops Puppet 7 support (BREAKING) as part of the module's Puppet Core alignment work, and allows the stdlib dependency to move to 10.x.

(CAT-2352) Drop Puppet 7 support (BREAKING) — Puppet Core alignment #509 (LukasAud)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #513 (imaqsood)

apache 13.2.0

📅 Latest release: 2026-06-28 (🌐 View on the Forge)

Adds RHEL 10 support, restores the ModSecurity engine on RHEL 10 via EPEL, and allows both stdlib and concat to move to their 10.x releases.

Add missing parameters to mod_md #2621 (smortex)
(MODULES-11851) Restore ModSecurity engine on RHEL 10 via EPEL #2635 (SugatD)
(MODULES-11739) Add RHEL 10 support #2629 (SugatD)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #2632 (imaqsood)
puppetlabs/concat: Allow 10.x #2630 (bastelfreak)

apt 11.3.2

📅 Latest release: 2026-06-26 (🌐 View on the Forge)

A small release that only bumps the stdlib dependency to allow 10.x.

(MODULES-11840) Allow puppetlabs/stdlib 10.x #1288 (imaqsood)

aws_inventory 0.8.0

📅 Latest release: 2026-06-17 (🌐 View on the Forge)

This release allows the ruby_task_helper dependency to move to 1.x.

Allow ruby_task_helper 1.x #25 (bastelfreak)

chocolatey 9.0.0

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

Completes its Puppet Core alignment pass, improves package prefetch caching with case-insensitive matching, and allows stdlib 10.x.

(CAT-2369) Puppet Core update #378 (LukasAud)
(MODULES-11769) Cache prefetch results and match packages case-insensitively #388 (skyamgarp)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #387 (imaqsood)

comply 3.8.0

📅 Latest release: 2026-06-12 (🌐 View on the Forge)

Security Compliance Management 3.8.0 addresses roughly 40 CVEs across bundled third-party components, alongside operational fixes and licensing improvements.

Increased the CIS-CAT Pro Assessor license expiry time to a full year.
Added a license_path parameter to update the CIS-CAT Pro Assessor license without upgrading SCM.
Added an assessor_scan_timeout option to control the task timeout for Windows 2022 domain controllers.
Added a background scan sweeper to detect and cancel scans stuck in the "running" state.
Fixed a race condition where timed-out PE job status polls could leave scans permanently stuck.
Updated Gorm.io, Protobuf, multiple Netty codec libraries, react-router, and KeyCloak to address roughly 40 CVEs.

Check the official release notes for comply 3.8.0 for the full details.

complyadm 3.8.0

📅 Latest release: 2026-06-12 (🌐 View on the Forge)

Ships the same Security Compliance Management 3.8.0 update as comply, covering the same ~40 CVE remediations and operational fixes.

Increased the CIS-CAT Pro Assessor license expiry time to a full year.
Added a license_path parameter to update the CIS-CAT Pro Assessor license without upgrading SCM.
Added an assessor_scan_timeout option to control the task timeout for Windows 2022 domain controllers.
Added a background scan sweeper to detect and cancel scans stuck in the "running" state.
Fixed a race condition where timed-out PE job status polls could leave scans permanently stuck.
Updated Gorm.io, Protobuf, multiple Netty codec libraries, react-router, and KeyCloak to address roughly 40 CVEs.

Check the official release notes for complyadm 3.8.0 for the full details.

concat 10.0.1

📅 Latest release: 2026-06-25 (🌐 View on the Forge)

This targeted release was part of the wave of bumps for the stdlib dependency to allow 10.x.

(MODULES-11840) Allow puppetlabs/stdlib 10.x #837 (imaqsood)

docker 10.4.1

📅 Latest release: 2026-06-28 (🌐 View on the Forge)

Removes the upper version limit on the puppetlabs/apt dependency, fixes compose up argument ordering, and allows stdlib 10.x.

Do not limit puppetlabs/apt requirement < v12 #1056 (mpdude)
Fix argument order on compose up #1037 (deligatedgeek)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #1057 (imaqsood)

edgeops 1.1.0

📅 Latest release: 2026-06-25 (🌐 View on the Forge)

Adds host key fingerprint verification for Bolt 5.1.0+ targets, along with a batch of NETCONF/SSH hardening fixes.

(PE-43703) Verify host key fingerprints supplied as host-key-fingerprint in the target hash; takes precedence over host-key-check and requires Bolt 5.1.0+. #38 (owenbeckles)
(PE-42584) Correctly handle host key verification parameter #23 (Ziaunys)
(PE-43619) Clean up SSH on timeout and always raise instead of returning partial data #33 (Ziaunys)
(PE-43614) Add mutex synchronization for RPC message ID allocation #29 (Ziaunys)
(PE-43652) Rename netconf_lock task to netconf_check_lock #35 (Ziaunys)

firewall 8.5.0

📅 Latest release: 2026-06-25 (🌐 View on the Forge)

Two releases this month: 8.4.0 added CONNMARK-based policy routing support and several bugfixes, while 8.5.0 allows stdlib 10.x, drops iptables-services from EL9+ package defaults, and fixes several ipset and chain-detection edge cases.

Includes monthly releases: 8.5.0 (2026-06-25), 8.4.0 (2026-06-10).

(MODULES-11840) Allow puppetlabs/stdlib 10.x #1288 (imaqsood)
(#1254) Remove iptables-services from EL9+ package defaults #1296 (david22swan)
(feat) Add restore_mark, nfmask, ctmask support for CONNMARK-based policy routing #1291 (david22swan)
(bugfix) Fix ipset idempotency: single-element array not in sync with String equivalent #1286 (david22swan)
(bugfix) Fix log_level idempotency when explicitly setting the iptables default value #1284 (david22swan)

haproxy 8.2.1

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

Completes the module's Puppet 8 upgrade work, drops Puppet 7 support, and allows stdlib 10.x.

(MODULES-11840) Allow puppetlabs/stdlib 10.x #642 (imaqsood)
(CAT-2373) Remove puppet 7 #631 (gavindidrichsen)
(CAT-2373)(02) Upgrade module to puppet 8 #629 (gavindidrichsen)

inifile 6.4.1

📅 Latest release: 2026-06-25 (🌐 View on the Forge)

A small release to allow stdlib 10.x.

(MODULES-11840) Allow puppetlabs/stdlib 10.x #570 (imaqsood)

java 12.0.0

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

Adds CentOS 9 and Debian 13 support, allows stdlib 10.x, and adds support for downloading from a login/password-protected URL.

(CAT-2376) Puppet Core update #614 (LukasAud)
(CAT-2152) Add support for CentOS 9 #606 (skyamgarp)
Add support for Debian 13 (trixie) #613 (mika)
Feat: Allow downloading from a login/password protected URL #588 (JGodin-C2C)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #626 (imaqsood)

lvm 4.0.2

📅 Latest release: 2026-06-28 (🌐 View on the Forge)

This lvm release bumps the stdlib dependency to allow 10.x.

(MODULES-11840) Allow puppetlabs/stdlib 10.x #384 (imaqsood)

motd 8.0.0

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

Adds Bolt 5.0 support, and allows stdlib 10.x.

(CAT-2352) Puppet Core update #531 (LukasAud)
(CAT-2463) Add bolt 5.0 support #535 (gavindidrichsen)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #558 (imaqsood)

mysql 17.0.0

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

Fixes the RHEL/CentOS Stream 10 version check, and allows stdlib 10.x.

(CAT-2381) Puppet Core update #1688 (LukasAud)
Fix version check for RHEL/CentOS Stream 10 #1686 (kajinamit)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #1707 (imaqsood)

ntp 11.1.1

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

A small release that only bumps the stdlib dependency to allow 10.x.

(MODULES-11840) Allow puppetlabs/stdlib 10.x #742 (imaqsood)

peadm 3.38.0

📅 Latest release: 2026-06-30 (🌐 View on the Forge)

Adds support for installing and upgrading to Puppet Enterprise 2023.8.10 and 2025.11.0, along with a cloud_database_host parameter for cloud-DB-backed installs.

Adding support for PE 2023.8.10 and 2025.11.0 #673 (CharithaDunuwille)
(PE-44022) Add cloud_database_host parameter for cloud-DB-backed installs #665 (mcdonaldseanp)
(PE-44247) Add peadm-path PG-major HA upgrade coverage for replica pe-puppetdb #666 (steveax)
(PE-44595) Don't emit empty dns_alt_names flag in subplans::install #672 (steveax)

postgresql 10.6.2

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

Adds basic EL10 support, allows both stdlib and concat to move to their 10.x releases, and fixes a bug where postgresql_conf resources set to absent were handled incorrectly.

NOTE: This release also incorrectly removed Puppet 7 support as a breaking change in a patch release. This has since been rolled back in 10.6.3. Removing Puppet 7 support will happen in a future major release.

add EL10 basic support - align EL10 PGSQL 16 default package version #1650 (ikonia)
fix: ignore postgresql_conf resource value when set to absent #1657 (davidassigbi)
grant creation via hiera through server::grant.pp #1668 (ikonia)
(MODULES-11840) Allow puppetlabs/stdlib 10.x #1681 (imaqsood)
puppetlabs/concat: Allow 10.x #1669 (bastelfreak)

sce_linux 2.7.0

📅 Latest release: 2026-06-16 (🌐 View on the Forge)

Adds CIS Benchmark support for the RHEL 10 family, fixes an rsyslog configuration file that was unconditionally overwritten, and drops RHEL 7 now that it's end of life.

Support for RHEL 10, AlmaLinux 10, Oracle Linux 10, and Rocky Linux 10. Enforces the CIS Benchmark for RHEL 10 (v1.0.1, Server Levels 1 and 2) and CIS Benchmark v1.0.0 for AlmaLinux 10, Oracle Linux 10, and Rocky Linux 10.
rsyslog.conf file unconditionally overwritten. Previously overwritten on every Puppet run even when logging configuration was set to ignore, affecting RHEL 7/8/9 and derivatives. No action required from users.
Advanced Intrusion Detection Environment (AIDE) utility class. Fixed incorrect configuration options generated for AIDE 0.19.x on RHEL 9 that caused aide --init to fail.
RHEL 7. RHEL 7 is end of life and no longer supported.

Check the official release notes for sce_linux 2.7.0 for the full details.

security_policy 1.0.0

🌟 New Module: 2026-06-25 (🌐 View on the Forge)

Brand-new module for managing Windows local security policy. Provides the security_option and user_right_assignment resource types (Puppet Resource API), covering all 45 Windows Privilege Rights and System Access settings. Initial release contains:

security_option and user_right_assignment resource types for managing Windows local security policy settings via secedit.
security_policy class exposing 45 Optional[Array[String]] parameters (one per privilege right), matching the layout of the legacy dsc/securitypolicydsc module.
PuppetX::Sid module: a static well-known SID map covering the 19 standard SIDs, with a PowerShell fallback via Pwsh::Manager for domain and custom accounts.
YAML-driven setting metadata loader (PuppetX::SecurityPolicy.all_settings) instead of a hardcoded settings hash.
Puppet requirement pinned to >= 8.0.0 < 9.0.0.

stdlib 10.0.1

📅 Latest release: 2026-06-30 (🌐 View on the Forge)

Drops Puppet 7 support, adds CentOS 9 support, extends Sensitive value support to more functions, and fixes has_ip_address/has_ip_network.

(CAT-2395) Puppet Core upgrade - drop support for Puppet 7 #1457 (LukasAud)
(CAT-2152) Add support for CentOS 9 #1442 (skyamgarp)
Support Sensitive values in more functions #1463 (alexjfisher)
Support sensitive values in to_json_pretty #1418 (alexjfisher)
Fix has_ip_address and has_ip_network functions #1448 (alexjfisher)

wsus_client 6.3.1

📅 Latest release: 2026-06-25 (🌐 View on the Forge)

stdlib 10.x now allowed as part of the dependency range bump.

(MODULES-11840) Allow puppetlabs/stdlib 10.x #238 (imaqsood)

Until Next Time!

That wraps up the June 2026 roundup. If any of these modules intersect with your environment — especially the Security Compliance Management CVE fixes — the linked Forge pages and release notes are worth a closer look.

Feedback on the series is always useful, especially if there are module families or release-note patterns that deserve more attention in future editions.

More updates coming next month when the July 2026 releases land.

🤖 AI Disclosure

This roundup is produced by a mostly-automated pipeline, with some AI sprinkled in for orchestration and enrichment (or 'Combobulating' and 'Finagling'), followed by a human review (that would be me) before publishing.

The automation is an open-source project with deterministic python scripts to crawl the Forge and determine which puppetlabs modules were released during a specific month (and catching when a module gets more than one release in a month). By combining a template, automation scripts, and some AI orchestration the content all gets pulled together for a structured markdown document. I then jump in to double-check the content and update any wording that seems repetitive or irrelevant (and sometimes I need to add some extra context that isn't in the changelog notes).

Puppet Core 8.20 adds Ubuntu 26.04 and Security Fixes

Jason St-Cyr — Mon, 06 Jul 2026 12:15:19 +0000

The latest release of Puppet Core was targeted at addressing reported CVEs and adding agent support for Ubuntu 26.04, along with some other items that might be of interest to you! Here's a quick rundown on the highlights:

Ubuntu 26.04 (x86_64 and ARM) support added for Puppet agents
Updated components for OpenSSL, net-imap, and concurrent-Ruby to address 13 CVEs
Sensitive values are now handled correctly in transactionstore.yaml
On macOS, plist files are now written atomically to prevent partial or zero-length reads.
PXP agent metadata now uses uniquely named temporary files to resolve file-rename race conditions that were happening for Windows tasks.

This was just my quick summary of the notes, so make sure to read the full release notes for Puppet Core 8.20 to get all the details before you upgrade!

Puppet Enterprise Introduces Database-Backed CA Storage in 2025.11 release

Jason St-Cyr — Thu, 02 Jul 2026 15:32:28 +0000

The latest Puppet Enterprise releases are out and this one has a huge load of improvements, fixes, and security patches included!

Puppet Enterprise (PE) 2025.11 released!

The full PE 2025.11 release notes are always the best way to get a full detail on what has changed, but here are some highlights of PE 2025.11!

Certificate Authority (CA): Database-backed Storage

This new optional feature adds support for storing CA data in a PostgreSQL database instead of the file system. This improves performance and reliability and introduces API-driven capabilities and enhanced backup and recovery handling.

PostgreSQL 17 Supported

PE-managed installations will automatically upgrade from verson 14 to 17 as part of the upgrade process, or you can update yourself before upgrading to PE 2025.11

Infra Assistant Goes GPT-5

GPT-5 series models are now running under the hood of Infra Assistant, improving the quality of responses and the consistency for queries.

Advanced Patching Enhancements

The advanced patching feature now has improvements across a variety of areas

New puppet_run_concurrency setting allows you to get better performance out of patch group enrollment
Improved validation of scheduled and immediate jobs to reduce risk of unintended or skipped executions.
Cron scheduling has better user experience and improved validation across features.
New configurable option to enable Puppet to run after patch jobs to refresh pe_patch facts

New Endpoints for Classifier and Activity Service APIs

The Classifier API introduced new tags, add-tags and remove-tags endpoints to manage node group tags. The Activity service API now has subscriptions endpoints to create subscriptions, list subscriptions, or fetch/delete a specific subscription.

Agent Platform Updates, Resolved Issues, and Security Fixes

The macOS 26 platform is now supported for both ARM and x86_64, while support has been removed for Ubuntu 18.04 and Ubuntu 20.04.

Nearly 60 CVEs were addressed in this release, along with many resolved issues. You should definitely check out the release notes for the full list of fixes!

PE 2023.8.10 Released

Along with the new 2025.11 release, the latest patches for the LTS version PE 2023.8 has also been put out.

Agent platforms were a big change, as macOS 26 was added, along with removing support for Ubuntu 18 and Ubuntu 20.
Nearly 60 CVEs resolved in this release, many by component updates.
Some additional fixes made in 2025.11 have also been inherited for the Activity service API and LDAP group attributes handling.

Official Release Notes

Read more in the full release notes on help.puppet.com ⬇️

Download Puppet Enterprise

SaaS Globalization Strategy: Technical Preparation for Chinese, European, and US Markets

sweet — Wed, 24 Jun 2026 00:45:00 +0000

Expanding a SaaS product into global markets requires more than translation — it demands infrastructure changes (edge deployment for low latency), compliance adaptation (GDPR, PIPL, CCPA), payment localization (Alipay, SEPA, Stripe), and cultural UX adjustments. This guide breaks down the technical and business preparation needed for the three largest SaaS markets: the US, Europe, and China. Each section includes actionable code examples, configuration snippets, and deployment patterns you can implement immediately. See the architecture in action at tanstackship.com, a production SaaS shipping globally on Cloudflare Workers.

Why Globalization Must Be Built, Not Bolted On

The biggest mistake SaaS founders make with globalization is treating it as a phase-two feature. Retrofitting i18n, multi-currency pricing, and regional compliance onto a monolithic codebase typically costs 3-5x more than building it in from the start — and often requires a full rewrite of the database schema, routing layer, and deployment pipeline.

The three largest SaaS markets have fundamentally different requirements:

Requirement	US Market	European Market	Chinese Market
Language	English	Multi (DE, FR, ES, etc.)	Chinese (Simplified)
Data regulation	CCPA/State laws	GDPR (strictest)	PIPL + CSL
Payment methods	Credit cards, Stripe	SEPA, PayPal, credit cards	Alipay, WeChat Pay, UnionPay
Infrastructure	AWS/US-East	GDPR-compliant hosting	ICP license, China-hosted
Authentication	Google, GitHub	EU-specific (eIDAS)	WeChat, Alipay, phone SMS
Pricing display	$ (tax excl.)	€ (VAT incl.)	¥ (tax incl.)
Content delivery	Global CDN	Edge (300ms latency target)	China CDN (ICP + DDoS shield)
Social login	Google, Apple, GitHub	Google, Apple, LinkedIn	WeChat, Alipay, phone OTP
Email deliverability	SendGrid, AWS SES	SendGrid (DPA signed)	QQ Mail, Alibaba Direct Mail

Market 1: European Market Preparation

GDPR Compliance Checklist

GDPR applies to any SaaS processing data of EU residents — regardless of where your company is incorporated. Here is the technical implementation:

// src/lib/gdpr.ts
// GDPR-compliant data handling utilities

// 1. Explicit consent tracking
interface ConsentRecord {
  userId: string
  consentType: "analytics" | "marketing" | "functional" | "third_party"
  granted: boolean
  timestamp: number
  ipAddress: string // Anonymized
}

export async function recordConsent(
  userId: string,
  consentType: ConsentRecord["consentType"],
  granted: boolean
) {
  await env.DB.prepare(
    `INSERT INTO consent_records (user_id, consent_type, granted, timestamp, ip_address)
     VALUES (?, ?, ?, unixepoch(), ?)`
  ).bind(
    userId,
    consentType,
    granted ? 1 : 0,
    anonymizeIp(getClientIp())
  ).run()
}

// 2. Data portability export
export const exportUserData = createServerFn({ method: "GET" }).handler(
  async (_, { request }) => {
    const userId = await getUserId(request)

    const [profile, subscriptions, invoices, events] = await Promise.all([
      env.DB.prepare("SELECT * FROM users WHERE id = ?").bind(userId).first(),
      env.DB.prepare("SELECT * FROM subscriptions WHERE user_id = ?").bind(userId).all(),
      env.DB.prepare("SELECT * FROM invoices WHERE user_id = ?").bind(userId).all(),
      env.DB.prepare("SELECT * FROM analytics_events WHERE user_id = ?").bind(userId).all(),
    ])

    return Response.json({
      exportedAt: new Date().toISOString(),
      data: { profile, subscriptions, invoices, events },
    })
  }
)

// 3. Right to erasure (GDPR Article 17)
export const deleteUserData = createServerFn({ method: "POST" }).handler(
  async (_, { request }) => {
    const userId = await getUserId(request)

    // Anonymize personal data (keep transactional records for legal retention)
    await env.DB.batch([
      env.DB.prepare(`UPDATE users SET
        email = 'deleted-' || id || '@redacted.com',
        name = 'Deleted User',
        avatar_url = NULL,
        deleted_at = unixepoch()
        WHERE id = ?`).bind(userId),
      env.DB.prepare("DELETE FROM analytics_events WHERE user_id = ?").bind(userId),
      env.DB.prepare("DELETE FROM session_tokens WHERE user_id = ?").bind(userId),
    ])

    return { success: true }
  }
)

EU Data Residency

GDPR requires that EU user data stays within the EU or in countries with adequate protection. With Cloudflare Workers, use data localization:

# wrangler.jsonc
{
  "name": "tanstack-ship",
  "compatibility_date": "2026-06-01",
  "workers_dev": false,
  "routes": [
    { "pattern": "tanstackship.com", "zone_id": "YOUR_ZONE_ID" },
    { "pattern": "eu.tanstackship.com", "zone_id": "YOUR_ZONE_ID", "custom_domain": true }
  ],
  "d1_databases": [
    { "binding": "DB", "database_id": "GLOBAL_DB", "database_name": "tanstack-ship" },
    { "binding": "EU_DB", "database_id": "EU_DB", "database_name": "tanstack-ship-eu" }
  ]
}

// Route EU users to EU D1 instance
async function getDb(request: Request) {
  const country = request.cf?.country
  if (country && EU_COUNTRIES.has(country)) {
    return env.EU_DB // GDPR-compliant D1 instance
  }
  return env.DB
}

EU Payment: SEPA Direct Debit

// With Stripe, SEPA is handled via Payment Methods
const paymentIntent = await stripe.paymentIntents.create({
  amount: 2999, // €29.99
  currency: "eur",
  payment_method_types: ["sepa_debit", "card"],
  customer: customerId,
})

Key EU-specific pricing considerations:

Display prices including VAT (unlike the US)
Register for VAT MOSS to handle cross-border EU sales
Issue VAT-compliant invoices (required by law for B2B)
SEPA transfers can take 1-3 business days — do not grant access until payment clears

Market 2: Chinese Market Preparation

Entering China is the most technically demanding market expansion. Here is what you need:

ICP License (Required for Any Hosted Service)

Any website or app hosted on servers in mainland China or using a Chinese CDN must have an ICP (Internet Content Provider) license. The process takes 4-8 weeks and requires:

Registered Chinese company (WFOE or joint venture) or partnership with a Chinese ICP-licensed entity
ICP filing submission through your cloud provider (Alibaba Cloud, Tencent Cloud, AWS China)
Domain name already ICP-filed

Without an ICP license, your site will be blocked by the Great Firewall of China (GFW).

Infrastructure: Bypassing the Great Firewall

// src/lib/geo-routing.ts
// Route Chinese users to China-hosted instances

const CHINA_REGIONS = new Set(["CN", "HK", "MO"])

export async function getRegionalEndpoint(request: Request): Promise<string> {
  const country = request.cf?.country

  if (CHINA_REGIONS.has(country ?? "")) {
    // Route to China-hosted instance via Cloudflare China Network
    return "https://tanstack-ship.cn"
  }

  // Global instance
  return "https://tanstackship.com"
}

Cloudflare China Network provides a GFW-compliant CDN layer without requiring your own Chinese servers. All major Chinese cloud providers also offer GPU/CPU instances:

Alibaba Cloud (aliyun.com) — largest market share
Tencent Cloud — second largest, WeChat integration
AWS China (Beijing/Ningxia) — requires separate account

Chinese Payment Integration

// src/lib/payment/china.ts
// Alipay integration via Stripe or direct API

// Option 1: Stripe (simplest, higher fees)
const paymentIntent = await stripe.paymentIntents.create({
  amount: 19900, // ¥199.00
  currency: "cny",
  payment_method_types: ["alipay", "card"],
  payment_method_options: {
    alipay: {},
  },
})

// Option 2: Direct Alipay API (lower fees, more setup)
import AlipaySdk from "alipay-sdk"

const alipaySdk = new AlipaySdk({
  appId: process.env.ALIPAY_APP_ID,
  privateKey: process.env.ALIPAY_PRIVATE_KEY,
})

const result = await alipaySdk.exec("alipay.trade.create", {
  bizContent: {
    out_trade_no: orderId,
    total_amount: "199.00",
    subject: "TanStack Ship - Pro Plan",
    product_code: "FAST_INSTANT_TRADE_PAY",
  },
})

Chinese Social Login

// src/lib/auth/china.ts
// WeChat OAuth

// Step 1: Redirect user to WeChat authorization
export function getWeChatAuthUrl(redirectUri: string): string {
  const params = new URLSearchParams({
    appid: process.env.WECHAT_APP_ID,
    redirect_uri: redirectUri,
    response_type: "code",
    scope: "snsapi_login",
    state: crypto.randomUUID(),
  })
  return `https://open.weixin.qq.com/connect/qrconnect?${params}`
}

// Step 2: Exchange code for access token
export async function getWeChatToken(code: string) {
  const response = await fetch(
    `https://api.weixin.qq.com/sns/oauth2/access_token?` +
    new URLSearchParams({
      appid: process.env.WECHAT_APP_ID,
      secret: process.env.WECHAT_APP_SECRET,
      code,
      grant_type: "authorization_code",
    })
  )
  return response.json() as Promise<{
    access_token: string
    openid: string
    unionid: string
  }>
}

Chinese Content Delivery Considerations

Censored keywords: Your content will be scanned. Common SaaS-blocked terms include sensitive political topics, VPN references, and cryptocurrency mentions
WeChat ecosystem: WeChat Mini Programs, WeChat Pay, and WeChat Official Accounts are essential for B2C SaaS
Email deliverability: QQ Mail and 163.com are the dominant email providers — ensure your SPF, DKIM, and DMARC are configured for Chinese domains
Domain blocking: Some domains are blocked without clear reason. Register a .cn domain as backup

Market 3: US Market Preparation

The US market is the most straightforward but still requires specific attention:

Tax Compliance: Sales Tax by State

// src/lib/tax/us-sales-tax.ts
// Simplified sales tax calculation (use a service like TaxJar for production)

const STATE_TAX_RATES: Record<string, number> = {
  "CA": 0.0725,  // California base rate
  "NY": 0.04,    // New York state (county/city adds more)
  "TX": 0.0625,  // Texas
  "WA": 0.065,   // Washington
  // ... 45+ more states
}

export function calculateSalesTax(
  amount: number,
  state: string
): { taxRate: number; taxAmount: number; total: number } {
  const taxRate = STATE_TAX_RATES[state.toUpperCase()] ?? 0
  const taxAmount = Math.round(amount * taxRate * 100) / 100
  return { taxRate, taxAmount, total: amount + taxAmount }
}

Key considerations:

Economic nexus: If you sell >$100K or 200+ transactions in a state, you must collect sales tax
Use a service like TaxJar, Stripe Tax, or Anrok for automated calculation
Display prices excluding tax (unlike Europe)

US Privacy Compliance (CCPA)

// src/lib/ccpa.ts
// CCPA opt-out mechanism
export async function handleCcpOptOut(userId: string) {
  await env.DB.prepare(
    `INSERT INTO privacy_opt_outs (user_id, regulation, opted_out_at)
     VALUES (?, 'CCPA', unixepoch())`
  ).bind(userId).run()
}

// Do not sell my personal information endpoint
export const optOutOfSale = createServerFn({ method: "POST" }).handler(
  async (_, { request }) => {
    const userId = await getUserId(request)
    await handleCcpOptOut(userId)
    return { success: true }
  }
)

Architectural Pattern: Regional Deployment with Edge Workers

For SaaS products targeting all three markets simultaneously, use a regional deployment architecture:

┌─────────────────────────────────────────────────┐
│                  Cloudflare                      │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────┐ │
│  │  US Worker   │  │  EU Worker   │  │ CN Edge  │ │
│  │  us-east     │  │  eu-west     │  │ (CF CN)  │ │
│  └──────┬───────┘  └──────┬───────┘  └────┬─────┘ │
│         │                 │               │        │
│  ┌──────▼───────┐  ┌──────▼───────┐  ┌────▼─────┐ │
│  │  US D1 DB    │  │  EU D1 DB    │  │ CN D1 DB │ │
│  │  (Virginia)  │  │ (Frankfurt)  │  │ (Beijing) │ │
│  └──────────────┘  └──────────────┘  └──────────┘ │
│         │                 │               │        │
│  ┌──────▼───────┐  ┌──────▼───────┐              │
│  │  US R2       │  │  EU R2       │              │
│  └──────────────┘  └──────────────┘              │
└─────────────────────────────────────────────────┘

// src/middleware/geo-router.ts
// Edge middleware that routes to the correct regional deployment

export const geoRouter = createServerFn({ method: "GET" }).handler(
  async (_, { request }) => {
    const country = request.cf?.country ?? "US"

    if (["CN", "HK", "MO"].includes(country)) {
      return env.CN_DB
    }

    if (EU_COUNTRIES.has(country)) {
      return env.EU_DB
    }

    return env.US_DB
  }
)

Multi-Currency Pricing Database Schema

CREATE TABLE price_tiers (
  id TEXT PRIMARY KEY,
  product_id TEXT NOT NULL REFERENCES products(id),
  region TEXT NOT NULL CHECK (region IN ('US', 'EU', 'CN', 'ROW', 'GLOBAL')),
  currency TEXT NOT NULL,
  unit_amount INTEGER NOT NULL,  -- In smallest currency unit (cents, fen, etc.)
  interval TEXT NOT NULL CHECK (interval IN ('month', 'year')),
  tax_behavior TEXT NOT NULL DEFAULT 'exclusive' CHECK (tax_behavior IN ('inclusive', 'exclusive')),
  is_active INTEGER NOT NULL DEFAULT 1,
  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
  updated_at INTEGER NOT NULL DEFAULT (unixepoch()),
  UNIQUE(product_id, region, interval)
);

CREATE INDEX idx_price_tiers_region ON price_tiers(region);

// src/lib/pricing/regional.ts
export async function getRegionalPrice(
  productId: string,
  region: "US" | "EU" | "CN" | "ROW",
  interval: "month" | "year"
) {
  const price = await env.DB.prepare(
    `SELECT unit_amount, currency, tax_behavior
     FROM price_tiers
     WHERE product_id = ? AND region = ? AND interval = ? AND is_active = 1
     ORDER BY created_at DESC
     LIMIT 1`
  )
    .bind(productId, region, interval)
    .first()
  return price
}

Globalization Readiness Checklist

Before launching in a new market, verify each item:

[ ] Content is fully translated (not just UI, but transactional emails, docs, error pages)
[ ] Date/time/number formatting uses Intl.* APIs (never hardcoded)
[ ] Currency symbols and formats match local expectations (€29,99 vs ¥199 vs $29.99)
[ ] Regional payment methods are integrated and tested with sandbox credentials
[ ] Tax calculation is automated per region (VAT, sales tax, consumption tax)
[ ] Data residency requirements are met (GDPR EU, PIPL China, CCPA California)
[ ] Privacy policy covers all applicable regulations (separate versions per region)
[ ] CDN/edge routing directs users to the nearest regional deployment
[ ] Email deliverability is configured for regional providers (QQ, 163, GMX, Gmail)
[ ] Social login options include region-specific providers (WeChat, LINE, LinkedIn)
[ ] Terms of Service are localized and legally reviewed per jurisdiction
[ ] Customer support channels cover regional time zones (email, chat, phone)
[ ] Pricing is localized to market expectations (not just currency conversion)
[ ] ICP license is obtained for China (allow 4-8 weeks processing time)
[ ] Cookie consent mechanism is GDPR-compliant (granular, documented)

Conclusion

Globalizing a SaaS product is a multi-dimensional challenge that touches every part of your stack — from database sharding and edge deployment to payment processing and legal compliance. The key takeaways:

Build globalization into your architecture from day one — retrofitting regional routing, multi-currency pricing, and data residency onto a monolithic system is prohibitively expensive
Each market has a dominant constraint: GDPR (data privacy) in Europe, ICP/GFW (infrastructure) in China, and sales tax nexus (tax complexity) in the US
Payments are the hardest part — you need at least 3 payment providers (Stripe, Alipay/WeChat, SEPA) to cover all three markets
Edge deployment is your friend — Cloudflare Workers' regional routing makes data residency compliance much simpler than traditional VPS-based architectures
Test with real users in each market — localization bugs (wrong date formats, truncated text in Chinese characters, missing RTL support) only surface with native users

The companies that win at globalization are not the ones with the most features — they are the ones that make every user feel like the product was built for their market.

Related Resources

RHEL 10 support now available in Puppet SCE for Linux

Jason St-Cyr — Thu, 18 Jun 2026 16:16:41 +0000

Version 2.7.0 of Security Compliance Enforcement (SCE) for Linux is now available for download from the Forge!

Support for the RHEL 10 family

This release adds Red Hat Enterprise Linux (RHEL) 10 CIS benchmarks (v1.0.1, Server Levels 1 and 2). Teams adopting RHEL 10 or a compatible platform can bring those systems into compliance using the same trusted standards already in place across earlier RHEL versions.

Other improvements

Some other issues were also addressed, including logging issues with the rsyslog configuration file and intrusion detection on RHEL 9.

For all the details, make sure to read the full release notes

SCE Module on Puppet Forge

Security Compliance Management 3.8.0 Is Now Available

Jason St-Cyr — Tue, 16 Jun 2026 13:31:38 +0000

Security Compliance Management (SCM) 3.8.0 is here, with updates focused on keeping compliance scans running reliably with less manual intervention and an important license update.

This release introduces automatic cleanup for stuck scans, improved control over scan behavior with configurable timeouts, extended CIS-CAT® Pro Assessor license support, and updated benchmark content. It also includes important security fixes across core components.

⚠️ We recommend upgrading to SCM 3.8.0 before June 21, 2026 to avoid disruption, as the CIS-CAT Pro Assessor license included in SCM 3.7.1 expires on that date.

What’s changing in SCM 3.8.0

CIS-CAT Pro Assessor licensing and version

SCM 3.8.0 now contains CIS-CAT Pro Assessor v4.63.0
The bundled CIS-CAT® Pro Assessor license is now valid for one year
- The license shipped with SCM 3.8.0 is valid until June 2027
- The license included in SCM 3.7.1 expires on June 21, 2026

You can now also update the license without upgrading SCM:

New license_path parameter
- Allows updating the CIS-CAT Pro Assessor license independently
- Documentation: https://help.puppet.com/scm/current/Content/UserGuide/SCM/update_assessor_license.htm

Scan management, configuration, and reliability

Added a background scan sweeper to detect and cancel scans stuck in a "running" state
Fixed a race condition where timed-out Puppet Enterprise job status polls could leave scans permanently stuck
New assessor_scan_timeout option controls task timeout for Windows Server 2022 domain controllers (Note: this isn't set by default)
Increased default Max GraphQL requests limit to 300 requests

Benchmark coverage updates

New benchmarks added for Amazon Linux 2023 STIG, Microsoft Windows 11 STIG, Oracle Linux 9 STIG, RHEL 10 STIG, and SUSE 16
Updated benchmarks for: Amazon Linux 2, macOS, Debian, Windows, and Ubuntu (see the release notes for specific benchmark updates)
Removed benchmarks for:
- Azure Compute Windows Server 2019 v1.0.1
- Azure Compute Windows Server 2022 v1.0.0

Security fixes

This release includes updates to address 40 vulnerabilities across several components. The following components were updated to address the vulnerabilities:

Gorm.io
Keycloak
netty-codec
netty-codec-http
netty-codec-http2
netty-codec-haproxy
netty-handler
Protobuf
react-router

Refer to the full release notes for the complete list of CVEs.

Upgrade guidance

To avoid scan interruptions, upgrade to SCM 3.8.0 before June 21, 2026. This ensures continued use of the CIS-CAT Pro Assessor, access to updated benchmark content, improved security posture, and improvements in scan processing.

Learn more

Full release notes: https://help.puppet.com/scm/current/Content/UserGuide/SCM/Release_notes/release_notes.htm#SecurityComplianceManagement380

If you have questions or need assistance upgrading, reach out to Puppet Support.

🤖 AI Disclosure

This article was written and reviewed by the author, with the help of AI to assist in pulling together the details from multiple sources and general brand voice alignment.

How did I do that? For this particular article, I provided Microsoft 365 Copilot with the original release notes, my previous release announcement for 3.7.0, our company brand voice guidelines, and the official product release announcement that went out to customers. The LLM can then pull together the list of things that were updated and create a skeleton of an article. I then rewrite the content as needed to meet with my own tone of voice and get rid of the over-list-based approach that LLMs often take. It's also important to actually check back against the original release notes because sometimes the LLM will change certain words or remove words that change the meaning of what was in the release. I hope this helps if you are also writing with LLMs!

Selenium vs Puppeteer vs Playwright: Complete Guide for Web Scraping, Testing & AI Automation

IPFoxy — Tue, 16 Jun 2026 12:23:25 +0000

In 2026, browser automation has evolved far beyond traditional QA testing and web scraping. With the rise of LLM-powered AI Agents, automation frameworks have become the foundation for autonomous web browsing, task execution, and large-scale AI workflows.

This guide compares Selenium, Puppeteer, and Playwright across architecture, performance, scalability, AI automation compatibility, and proxy integration.

I. Introduction to the Three Automation Frameworks

**
1. Selenium: The Most Established Browser Automation Framework

Selenium was introduced in 2004 and remains the industry standard for browser automation. With Selenium 5.0, the framework has undergone a major architectural upgrade.

Key Features:
• Supports Chrome, Firefox, Edge, Safari, and other major browsers.
• Supports Java, Python, C#, JavaScript, and more.
• Large ecosystem and strong enterprise adoption.

Best For:
Automated testing, enterprise workflows, and projects requiring broad browser compatibility.

2. Playwright

Playwright was open-sourced by Microsoft in 2020 and has become the fastest-growing browser automation framework.

Key Features:
• Native support for Chromium, Firefox, and WebKit.
• Built-in Auto-Wait mechanism.
• Browser Context support for large-scale concurrency.

Best For:
Web scraping, AI Agent automation, eCommerce data collection, social media automation, and large-scale browser operations.

3. Puppeteer: Google's Native Chrome Automation Tool

Released by the Chrome team in 2017, Puppeteer popularized the Chrome DevTools Protocol (CDP).

Key Features:
• Simple and intuitive API.
• Fast execution speed.
• Popular in web scraping and browser automation.

Best For:
Chrome/Chromium automation, web scraping, screenshots, and PDF generation.

II. Real-World Performance Comparison

1. Startup Speed
In raw tests launching a headless browser, Puppeteer and Playwright achieve cold startup speeds of 100-300 milliseconds because they connect directly to the underlying binary protocols via WebSockets. Selenium, however, typically takes 1-2 seconds due to the need to initialize the corresponding Driver process and handle layered HTTP handshakes.

2. Concurrency

Selenium launches a new browser process for each isolated environment, resulting in significant memory usage.

Playwright uses BrowserContext, allowing dozens of fully isolated environments to run within a single browser process while reducing resource consumption by over 70%.

3. Stability

Modern React and Vue applications render content asynchronously. Selenium often requires manual waits, while Playwright automatically performs Actionability Checks before interacting with elements, improving reliability significantly.
**

Compatibility** If your enterprise requires testing specific rendering issues on Safari within a physical Mac environment, or if your development team relies strictly on Java/C#, Selenium’s multi-language support and deep-rooted history make it irreplaceable.

5. AI Agent Compatibility

In 2026, AI Agent + Browser Automation has become one of the hottest directions. Projects like Claude Code, OpenAI Agent, and OpenManus all prioritize Playwright by default for three key reasons:

Native MCP Protocol Support: Playwright can output the page’s Accessibility Tree directly to the LLM, eliminating the need to parse raw DOM text.
Highly Efficient Token Usage: Compared to traditional DOM serialization, Playwright's optimized approach reduces token consumption for long sessions by 3 to 4 times.
Execution Stability: Playwright’s auto-wait and auto-retry mechanisms drastically lower the failure rates of complex agent actions.

III. Proxy Integration and Anti-Detection Capabilities

For modern web scraping, accessing a page is only the beginning. Websites commonly evaluate:

• IP Reputation
• Request Frequency
• Browser Fingerprints
• Geographic Consistency

Residential Proxies provide a more authentic browsing environment than datacenter IPs and help reduce blocking risks.
IPFoxy offers residential proxies covering 200+ countries, static ISP proxies, mobile 4G/5G proxies, and supports both HTTP(S) and SOCKS5 protocols. It integrates seamlessly with Selenium, Puppeteer, and Playwright to significantly lower blocking risks for long-running scraper projects.

Here is how to configure an IPFoxy proxy across the three frameworks:
Selenium Proxy Configuration (Python)

from selenium import webdriver
from selenium.webdriver.chrome.options import Options

chrome_options = Options()
# Configure IPFoxy proxy address (with user/pass authentication)
# Static ISP or rotating residential proxies are recommended for the lowest fraud scores
proxy_server = "http://username:password@proxy.ipfoxy.com:port"
chrome_options.add_argument(f'--proxy-server={proxy_server}')

# Launch driver
driver = webdriver.Chrome(options=chrome_options)
driver.get("https://ipinfo.io")  # Verify the IP has switched to a clean residential IP from IPFoxy
print(driver.title)
driver.quit()

Puppeteer Proxy Configuration (JavaScript)

const puppeteer = require('puppeteer');
const proxy = 'http://user:pass@ipfoxy-proxy:port';

const browser = await puppeteer.launch({
  args: [`--proxy-server=${proxy}`]
});
const page = await browser.newPage();
await page.goto('https://example.com');

Playwright Proxy Configuration (Python)

from playwright.sync_api import sync_playwright

with sync_playwright() as p:
    browser = p.chromium.launch(
        proxy={
            "server": "http://ipfoxy-proxy:port",
            "username": "user",
            "password": "pass"
        }
    )
    page = browser.new_page()
page.goto("https://example.com")

IV. Which Framework Should You Choose in 2026?

Your technical choice should align directly with your business pain points and engineering stack:
Choose Playwright if:
• You are building a new web scraping, data collection, or AI Agent project.
• You need high concurrency and efficient resource usage.
• You work primarily with Python or TypeScript.

Choose Puppeteer if:
• You are a Node.js-focused developer.
• Your project only targets Chrome/Chromium.
• You require direct access to advanced CDP capabilities.

Choose Selenium if:
• Your organization relies heavily on Java or C#.
• You already have large-scale Selenium Grid infrastructure.
• Cross-browser testing is a top priority.

V. Conclusion

Selenium, Puppeteer, and Playwright are all excellent browser automation frameworks, but they serve different needs.

For web scraping, AI Agents, multi-account automation, and large-scale data collection, Playwright is often the most future-proof choice. Combined with high-quality residential proxies, it can significantly improve scraping success rates and long-term stability.