DEV Community

Cover image for Puppetlabs Modules Roundup - July 2026
puppet profile image Jason St-Cyr
Jason St-Cyr for puppet

Posted on

Puppetlabs Modules Roundup - July 2026

#puppet

July 2026 brought 17 Puppetlabs module releases, headlined by a fairly large Continuous Delivery release. cd4peadm 5.16.0 added external PostgreSQL database support and a configurable image pull policy, and closes 11 CVEs, alongside a breaking change to commit status contexts. More modules dropped Puppet 7 support, some others picked up stdlib 10, and Windows Server 2025 support started rolling out into the modules. This roundup pulls the most important changes into one place.

Highlighted Updates

Continuous Delivery Adds External Databases, Configurable Image Pull Policies, and Closes 11 CVEs

cd4peadm 5.16.0 is the biggest release of the month. It adds support for pointing Continuous Delivery at an externally managed PostgreSQL database. That could be a self-managed instance, Amazon RDS for PostgreSQL, or Amazon Aurora. This externally managed db can be used instead of the database CD manages internally, giving operators control over durability, backups, and high availability. It also adds a configurable image_pull_policy option for job templates (Always/IfNotPresent/Never) and removes the docker.io fallback when using Podman; the matching cd4pe_jobs 1.7.4 release adds the same task parameter and fallback removal, so upgrade both together.

  • BREAKING: Commit status contexts now include the pipeline name (cd-pe/<pipelineName>/stage-<N> instead of cd-pe/stage-<N>). Review any branch protection rules or required status checks that reference the old format.
  • This release also closed 11 CVEs across opentelemetry, NGINX, jetty, jackson, log4j, postgresql, golang.org/x/sys, and react-router.

Puppet 7 Support Dropped

Five modules dropped Puppet 7 support in major version bumps:

  • haproxy, iis, mount_iso, scheduled_task, sslcertificate.

There were all released as major version bumps to ensure that users still working on upgrading from Puppet 7 can stay pinned on the previous major version releases.

In related news, postgresql 10.6.3 restored the Puppet 7 support that 10.6.2 broke in a previous release; see its entry below.

stdlib 10.x Rollout Continues

Following June's stdlib 10.x rollout, four more modules now allow the puppetlabs-stdlib dependency to move to 10.x: haproxy, mount_iso, puppet_authorization, and sslcertificate. haproxy also widens its concat constraint to 10.x.

  • Affected modules: haproxy, mount_iso, puppet_authorization, sslcertificate.

Windows Server 2025 Support Added

Three Windows-focused modules added support for Windows Server 2025 this month: scheduled_task, windows_env, and windows_eventlog. These now all run acceptance testing against the 2025 version of the OS, in addition to other supported Windows versions.

What Updates Happened to Puppetlabs Modules in July 2026?

The following is an alphabetical listing of modules which received updates in July 2026. If a module had multiple versions released, the updates are collected together, numbered with the "latest" version available.

apache 13.3.0

📅 Latest release: 2026-07-23 (🌐 View on the Forge)

Added OWASP CRS v4 support on modern Enterprise Linux (EL10) while preserving existing EL7/8/9 behaviour.

  • (MODULES-11857) Scaffold OWASP CRS v4 support on EL10 via crs_source enum #2637 (SugatD)

cd4pe_jobs 1.7.4

📅 Latest release: 2026-07-28 (🌐 View on the Forge)

Adds the same configurable image_pull_policy task parameter and Podman fallback removal shipping in cd4peadm 5.16.0 — upgrade both together to get matching behavior.

  • A new optional image_pull_policy task parameter controls whether the container image is pulled before a job runs: Always (the default, and the previous behavior) pulls on every run; IfNotPresent pulls only when the image is absent from the local runtime; Never skips the pull entirely and relies on the locally present image. Presence is checked with docker image inspect / podman image exists. Omitting the parameter keeps the existing pull-every-run behavior.
  • The module no longer retries a failed image pull against docker.io. Image names are now pulled exactly as given. If you rely on unqualified image names (e.g. nginx, myuser/myimage) on a Podman host, add docker.io to unqualified-search-registries in registries.conf, or use a fully-qualified name.

cd4peadm 5.16.0

📅 Latest release: 2026-07-29 (🌐 View on the Forge)

The changes this month added external PostgreSQL database support, a configurable image pull policy, source control token management improvements, and closed 11 CVEs. There is also a breaking change to commit status contexts — see below (and the linked release notes).

  • Added support for external databases. You can now point Continuous Delivery at a PostgreSQL instance you operate yourself, Amazon RDS for PostgreSQL, Amazon Aurora (PostgreSQL-compatible), or a self-managed PostgreSQL server, instead of the database CD manages for you. This gives you control over durability, backups, and high availability. You can configure external mode on a fresh install or migrate an existing managed install.
  • Added a feature to Continuous Delivery job templates so you can set an image pull policy per job (Always, IfNotPresent, or Never). In an air-gapped environment, for example, setting the policy to Never stops Continuous Delivery's attempts to reach out to the internet for the image.
  • Updated the Source Control settings page to show when a configured Personal Access Token (PAT) expires on each connected GitHub, GitHub Enterprise, and GitLab integration card. Tokens that have already expired or will expire within 30 days are clearly flagged so you can renew them before they cause failures.
  • BREAKING: Commit status contexts now include the pipeline name (cd-pe/<pipelineName>/stage-<N> instead of cd-pe/stage-<N>), which prevents collisions when multiple pipelines report status for the same commit. Review any branch protection rules or required status checks that reference the old format.
  • 11 CVEs addressed, including opentelemetry, NGINX, jetty, jackson, log4j, postgresql, golang.org/x/sys, and react-router.

Check the official release notes for cd4peadm 5.16.0 for the full details.

comply 3.8.1

📅 Latest release: 2026-07-03 (🌐 View on the Forge)

A Security Compliance Management maintenance release that did not have any new CVE fixes this time and was mostly operational and licensing improvements.

  • Increased the CIS-CAT Pro Assessor license expiry time; licenses are now good for a full year.
  • Added a license_path parameter to update the CIS-CAT Pro Assessor license without upgrading SCM.
  • Added an assessor_scan_timeout option to control the task timeout for Windows 2022 domain controllers.
  • Added a background scan sweeper that detects and cancels scans stuck in a "running" state.
  • Increased the default Max graphql requests limit to 300 requests per window; use the complyadm::configure Bolt plan to customize.

Check the official release notes for comply 3.8.1 for the full details.

haproxy 9.1.0

📅 Latest release: 2026-07-28 (🌐 View on the Forge)

Two releases this month: 9.0.0 dropped Puppet 7 support (BREAKING) and added cache resource support, while 9.1.0 removed a sensitive-data workaround and allows both stdlib and concat to move to their 10.x releases.

Includes monthly releases: 9.1.0 (2026-07-28), 9.0.0 (2026-07-20).

  • Eliminate Workaround for Sensitive Data; raises minimum puppetlabs/concat requirement to 7.4.0 #607 (cocker-cc)
  • Add support for running programs #604 (deric)
  • Pass install_options to package installer #603 (deric)
  • examples: disable default stats listener #640 (bastelfreak)
  • make picking haproxy::globals::sort_options_alphabetic work #573 (trefzer)
  • Remove Puppet 7 support (BREAKING); the module now requires puppet >= 8.0.0 < 9.0.0 #631 (gavindidrichsen)
  • Add support for cache resource, extra backend options, and docs #626 (matejzero)
  • (MODULES-11840) Allow puppetlabs/stdlib 10.x #642 (imaqsood)
  • Allow puppetlabs/concat 10.x #641 (bastelfreak)
  • dependency: create mapfile before configfile #572 (trefzer)

iis 11.0.0

📅 Latest release: 2026-07-01 (🌐 View on the Forge)

Dropped Puppet 7 support (BREAKING) as part of ongoing modernization efforts, and marked the iis_application_pool password parameter as sensitive so it no longer leaks into Puppet reports.

  • (CAT-2374) Puppet Core update (BREAKING) — drops Puppet 7 support #414 (LukasAud)
  • (MODULES-11595) Mark iis_application_pool password as sensitive to stop report leak #418 (imaqsood)

mount_iso 5.0.0

📅 Latest release: 2026-07-22 (🌐 View on the Forge)

Dropped Puppet 7 support (BREAKING) and allowed the stdlib dependency to move to 10.x.

  • (CAT-2380) Update for Puppet Core / Drop Support for Puppet 7 (BREAKING) #58 (david22swan)
  • (MODULES-11840) Allow puppetlabs/stdlib 10.x #59 (imaqsood)

mysql 17.1.0

📅 Latest release: 2026-07-02 (🌐 View on the Forge)

This month was a small update but important as RHEL 10 support was added.

node_encrypt 3.2.0

📅 Latest release: 2026-07-22 (🌐 View on the Forge)

Adds Ubuntu 24 and Debian 12 support, and upgrades rexml to address a CVE.

peadm 3.38.1

📅 Latest release: 2026-07-08 (🌐 View on the Forge)

Restores public-schema privileges on PostgreSQL 15+ in restore.pp, fixing a bug that could affect PE restores on newer PostgreSQL versions.

postgresql 10.6.3

📅 Latest release: 2026-07-07 (🌐 View on the Forge)

Restores Puppet 7 support that was unintentionally dropped in the 10.6.2 patch release last month.

NOTE: As flagged in June's roundup, the Puppet 7 removal in 10.6.2 shipped in a patch release rather than a major one. 10.6.3 restores Puppet 7 support; the removal will happen again, correctly, in a future major release.

  • (MODULES-11858) Restore Puppet 7 support broken by 10.6.2 #1686 (imaqsood)

puppet_authorization 1.0.1

📅 Latest release: 2026-07-21 (🌐 View on the Forge)

A maintenance release: allows both the stdlib and concat dependencies to move to 10.x, tweaks a CI workflow flag, and adds a LICENSE file.

sce_linux 2.8.0

📅 Latest release: 2026-07-28 (🌐 View on the Forge)

Updates CIS Benchmarks from v3.0.0 to v4.0.0 for RHEL 8, AlmaLinux 8, and Oracle Linux 8, with matching control updates for each, and fixes three bugs affecting benchmark enforcement.

  • Updated CIS Benchmarks. RHEL 8, AlmaLinux 8, and Oracle Linux 8 move from CIS Benchmark v3.0.0 to v4.0.0, with matching control updates for each operating system.
  • Updated dependency. SCE for Linux now supports puppetlabs-stdlib >= 9.2.0 < 11.0.0; avoid using earlier stdlib versions.
  • Fixed: the user-specified default_zone setting was not enforced for CIS control 3.4.1.2; it is now enforced correctly.
  • Fixed: aide --init failed on RHEL/AlmaLinux/Oracle Linux/Rocky Linux 8 hosts shipping AIDE 0.17.x, which renamed the database= directive to database_in=.
  • Fixed: CIS control 6.2.2.2 (journald log-forwarding) did not work as designed on RHEL/AlmaLinux/Oracle Linux/Rocky Linux 9 and 10; control 6.2.3.3 was also added.

Check the official release notes for sce_linux 2.8.0 for the full details.

scheduled_task 5.0.0

📅 Latest release: 2026-07-13 (🌐 View on the Forge)

Drops Puppet 7 support (BREAKING) and also adds Windows Server 2025 support.

  • (CAT-2391) Puppet Core upgrade (BREAKING) — drops Puppet 7 support #271 (LukasAud)
  • [MODULES-11616] Adding Windows 2025 support to module #275 (jst-cyr)
  • Update link to contributing documentation #273 (jst-cyr)

sslcertificate 6.0.0

📅 Latest release: 2026-07-22 (🌐 View on the Forge)

Drops Puppet 7 support (BREAKING) and allows the stdlib dependency to move to 10.x.

  • (CAT-2394) Puppet Core update (BREAKING) — drops Puppet 7 support #142 (LukasAud)
  • (MODULES-11840) Allow puppetlabs/stdlib 10.x #143 (imaqsood)

windows_env 6.1.0

📅 Latest release: 2026-07-21 (🌐 View on the Forge)

Adds Windows Server 2025 support.

  • (MODULES-11891) Add Windows Server 2025 support #115 (imaqsood)

windows_eventlog 5.1.0

📅 Latest release: 2026-07-22 (🌐 View on the Forge)

Adds Windows Server 2025 support.

  • (MODULES-11892) Add Windows Server 2025 support #98 (imaqsood)

Until Next Time!

That wraps up the July 2026 roundup. If any of these modules intersect with your environment. especially the cd4peadm breaking change to commit status contexts and the Puppet 7 removals, the linked Forge pages and release notes are worth a closer look before upgrading.

Feedback on the series is always useful, especially if there are module families or release-note patterns that deserve more attention in future editions!

More updates coming next month when the August 2026 releases land.

🤖 AI Disclosure

This roundup is produced by a mostly-automated pipeline, with some AI sprinkled in for orchestration and enrichment (or 'Combobulating' and 'Finagling'), followed by a human review (that would be me) before publishing.

The automation is an open-source project with deterministic python scripts to crawl the Forge and determine which puppetlabs modules were released during a specific month (and catching when a module gets more than one release in a month). By combining a template, automation scripts, and some AI orchestration the content all gets pulled together for a structured markdown document. I then jump in to double-check the content and update any wording that seems repetitive or irrelevant (and sometimes I need to add some extra context that isn't in the changelog notes).

Top comments (0)