The latest releases of Puppet Core 9 and Puppet Core 8 are now available! Both releases contain the same types of changes, with minor differences in versions of components that were updated. The new Debian 12 ARM V7L is the only new addition this release while the focus of the changes are on security updates and a pair of compatibility fixes that address issues some users may have encountered in production environments.
If you're currently running Puppet Core 8.x or 9.x, this is a straightforward update worth planning for.
What Changed in Puppet Core 9.1.0 and Puppet Core 8.22.0
- New agent platform: Debian 12 ARM V7L added as a supported agent platform.
-
Security updates: Several bundled components received updates to address recently disclosed vulnerabilities: OpenSSL, curl, libxml2, RubyGems, Ruby's
resolvgem. - Compatibility fix for
hiera-eyamland Bouncy Castle - JSON dependency constraints updated to
>=2.0, <4to prevent compatibility issues with latest JSON releases.
Together these updates address more than a dozen published CVEs. If you track vulnerabilities internally, review the release notes for the complete CVE listing associated with your Puppet version.
Notes for Puppet 8 vs Puppet 9 Users
The customer-facing changes are effectively the same in both releases. There are a couple of implementation differences:
- Puppet Core 8.22.0 updates OpenSSL 3.0.x, whereas 9.1.0 updates to OpenSSL 3.5.x
- Puppet Core 8.22.0 ships hiera-eyaml 4.3.0, whereas Puppet Core 9.1.0 ships hiera-eyaml 5.0.1
The fixes and outcomes delivered by these updates are equivalent across both release tracks.
Full Release Notes
Before upgrading, make sure to review the release notes for your release track:
This update is a small one operationally but an important one from a security and maintenance perspective. Make sure to drop any questions you have about the release either here or in the Puppet community slack.
Top comments (0)