DEV Community

Cover image for Puppetlabs Modules Roundup – June 2026
puppet profile image Jason St-Cyr
Jason St-Cyr for puppet

Posted on

Puppetlabs Modules Roundup – June 2026

#puppet

In June 2026 we saw the release of a new stdlib 10 that was mentioned in an earlier article along with numerous modules bumped to use the new stdlib 10. In total, 24 Puppetlabs modules were released to the Forge, ranging from a brand-new Windows security policy module to a large batch of third-party CVE fixes in Security Compliance Management. This roundup pulls the most important changes into one place.

Highlighted Updates

New Module: Windows Local Security Policy Management

The new security_policy module manages Windows local security policy using the Puppet Resource API, replacing manual secedit/Local Security Policy editor work.

  • Provides the security_option and user_right_assignment resource types, covering all 45 Windows Privilege Rights and the System Access settings.
  • Ships a well-known SID map with a PowerShell fallback for domain and custom accounts.

stdlib 10.x Compatibility Pass

A coordinated maintenance pass loosened the puppetlabs/stdlib dependency constraint across the module set to allow stdlib 10.x, clearing the way for downstream modules to pick up stdlib's latest release.

  • Affected modules: accounts, apache, apt, chocolatey, concat, docker, firewall, haproxy, inifile, lvm, motd, mysql, ntp, postgresql, wsus_client.

More modules will be released in July as we roll out the support for stdlib 10.x.

Puppet Core Alignment / Puppet 7 Support Dropped

Several modules completed their Puppet Core alignment pass this month, dropping Puppet 7 support in favor of Puppet 8 as Puppet 7 reaches end-of-life.

  • Affected modules: accounts, chocolatey, haproxy, java, motd, mysql, postgresql, stdlib.

A note that the change to drop Puppet 7 in postgresql was done in a patch release, instead of a major release. This has been corrected in postgresql 10.6.3 and the change will be done again in a major release of that module.

Security Compliance Management Patches ~40 CVEs

Security Compliance Management 3.8.0, shipped as both comply and complyadm, updates a long list of bundled third-party components — Gorm.io, Protobuf, several Netty codec libraries, react-router, and KeyCloak — to close out roughly 40 CVEs.

  • Also updates the bundled CIS-CAT Pro Assessor to v4.63.0, adding new STIG benchmarks for Amazon Linux 2023, Windows 11, Oracle Linux 9, and RHEL 10.

What Updates Happened to Puppetlabs Modules in June 2026?

The following is an alphabetical listing of modules which received updates in June 2026. If a module had multiple versions released, the updates are collected together, numbered with the "latest" version available.

accounts 9.0.0

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

This release drops Puppet 7 support (BREAKING) as part of the module's Puppet Core alignment work, and allows the stdlib dependency to move to 10.x.

  • (CAT-2352) Drop Puppet 7 support (BREAKING) — Puppet Core alignment #509 (LukasAud)
  • (MODULES-11840) Allow puppetlabs/stdlib 10.x #513 (imaqsood)

apache 13.2.0

📅 Latest release: 2026-06-28 (🌐 View on the Forge)

Adds RHEL 10 support, restores the ModSecurity engine on RHEL 10 via EPEL, and allows both stdlib and concat to move to their 10.x releases.

apt 11.3.2

📅 Latest release: 2026-06-26 (🌐 View on the Forge)

A small release that only bumps the stdlib dependency to allow 10.x.

aws_inventory 0.8.0

📅 Latest release: 2026-06-17 (🌐 View on the Forge)

This release allows the ruby_task_helper dependency to move to 1.x.

chocolatey 9.0.0

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

Completes its Puppet Core alignment pass, improves package prefetch caching with case-insensitive matching, and allows stdlib 10.x.

  • (CAT-2369) Puppet Core update #378 (LukasAud)
  • (MODULES-11769) Cache prefetch results and match packages case-insensitively #388 (skyamgarp)
  • (MODULES-11840) Allow puppetlabs/stdlib 10.x #387 (imaqsood)

comply 3.8.0

📅 Latest release: 2026-06-12 (🌐 View on the Forge)

Security Compliance Management 3.8.0 addresses roughly 40 CVEs across bundled third-party components, alongside operational fixes and licensing improvements.

  • Increased the CIS-CAT Pro Assessor license expiry time to a full year.
  • Added a license_path parameter to update the CIS-CAT Pro Assessor license without upgrading SCM.
  • Added an assessor_scan_timeout option to control the task timeout for Windows 2022 domain controllers.
  • Added a background scan sweeper to detect and cancel scans stuck in the "running" state.
  • Fixed a race condition where timed-out PE job status polls could leave scans permanently stuck.
  • Updated Gorm.io, Protobuf, multiple Netty codec libraries, react-router, and KeyCloak to address roughly 40 CVEs.

Check the official release notes for comply 3.8.0 for the full details.

complyadm 3.8.0

📅 Latest release: 2026-06-12 (🌐 View on the Forge)

Ships the same Security Compliance Management 3.8.0 update as comply, covering the same ~40 CVE remediations and operational fixes.

  • Increased the CIS-CAT Pro Assessor license expiry time to a full year.
  • Added a license_path parameter to update the CIS-CAT Pro Assessor license without upgrading SCM.
  • Added an assessor_scan_timeout option to control the task timeout for Windows 2022 domain controllers.
  • Added a background scan sweeper to detect and cancel scans stuck in the "running" state.
  • Fixed a race condition where timed-out PE job status polls could leave scans permanently stuck.
  • Updated Gorm.io, Protobuf, multiple Netty codec libraries, react-router, and KeyCloak to address roughly 40 CVEs.

Check the official release notes for complyadm 3.8.0 for the full details.

concat 10.0.1

📅 Latest release: 2026-06-25 (🌐 View on the Forge)

This targeted release was part of the wave of bumps for the stdlib dependency to allow 10.x.

  • (MODULES-11840) Allow puppetlabs/stdlib 10.x #837 (imaqsood)

docker 10.4.1

📅 Latest release: 2026-06-28 (🌐 View on the Forge)

Removes the upper version limit on the puppetlabs/apt dependency, fixes compose up argument ordering, and allows stdlib 10.x.

edgeops 1.1.0

📅 Latest release: 2026-06-25 (🌐 View on the Forge)

Adds host key fingerprint verification for Bolt 5.1.0+ targets, along with a batch of NETCONF/SSH hardening fixes.

  • (PE-43703) Verify host key fingerprints supplied as host-key-fingerprint in the target hash; takes precedence over host-key-check and requires Bolt 5.1.0+. #38 (owenbeckles)
  • (PE-42584) Correctly handle host key verification parameter #23 (Ziaunys)
  • (PE-43619) Clean up SSH on timeout and always raise instead of returning partial data #33 (Ziaunys)
  • (PE-43614) Add mutex synchronization for RPC message ID allocation #29 (Ziaunys)
  • (PE-43652) Rename netconf_lock task to netconf_check_lock #35 (Ziaunys)

firewall 8.5.0

📅 Latest release: 2026-06-25 (🌐 View on the Forge)

Two releases this month: 8.4.0 added CONNMARK-based policy routing support and several bugfixes, while 8.5.0 allows stdlib 10.x, drops iptables-services from EL9+ package defaults, and fixes several ipset and chain-detection edge cases.

Includes monthly releases: 8.5.0 (2026-06-25), 8.4.0 (2026-06-10).

  • (MODULES-11840) Allow puppetlabs/stdlib 10.x #1288 (imaqsood)
  • (#1254) Remove iptables-services from EL9+ package defaults #1296 (david22swan)
  • (feat) Add restore_mark, nfmask, ctmask support for CONNMARK-based policy routing #1291 (david22swan)
  • (bugfix) Fix ipset idempotency: single-element array not in sync with String equivalent #1286 (david22swan)
  • (bugfix) Fix log_level idempotency when explicitly setting the iptables default value #1284 (david22swan)

haproxy 8.2.1

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

Completes the module's Puppet 8 upgrade work, drops Puppet 7 support, and allows stdlib 10.x.

inifile 6.4.1

📅 Latest release: 2026-06-25 (🌐 View on the Forge)

A small release to allow stdlib 10.x.

  • (MODULES-11840) Allow puppetlabs/stdlib 10.x #570 (imaqsood)

java 12.0.0

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

Adds CentOS 9 and Debian 13 support, allows stdlib 10.x, and adds support for downloading from a login/password-protected URL.

lvm 4.0.2

📅 Latest release: 2026-06-28 (🌐 View on the Forge)

This lvm release bumps the stdlib dependency to allow 10.x.

  • (MODULES-11840) Allow puppetlabs/stdlib 10.x #384 (imaqsood)

motd 8.0.0

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

Adds Bolt 5.0 support, and allows stdlib 10.x.

mysql 17.0.0

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

Fixes the RHEL/CentOS Stream 10 version check, and allows stdlib 10.x.

ntp 11.1.1

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

A small release that only bumps the stdlib dependency to allow 10.x.

  • (MODULES-11840) Allow puppetlabs/stdlib 10.x #742 (imaqsood)

peadm 3.38.0

📅 Latest release: 2026-06-30 (🌐 View on the Forge)

Adds support for installing and upgrading to Puppet Enterprise 2023.8.10 and 2025.11.0, along with a cloud_database_host parameter for cloud-DB-backed installs.

  • Adding support for PE 2023.8.10 and 2025.11.0 #673 (CharithaDunuwille)
  • (PE-44022) Add cloud_database_host parameter for cloud-DB-backed installs #665 (mcdonaldseanp)
  • (PE-44247) Add peadm-path PG-major HA upgrade coverage for replica pe-puppetdb #666 (steveax)
  • (PE-44595) Don't emit empty dns_alt_names flag in subplans::install #672 (steveax)

postgresql 10.6.2

📅 Latest release: 2026-06-29 (🌐 View on the Forge)

Adds basic EL10 support, allows both stdlib and concat to move to their 10.x releases, and fixes a bug where postgresql_conf resources set to absent were handled incorrectly.

NOTE: This release also incorrectly removed Puppet 7 support as a breaking change in a patch release. This has since been rolled back in 10.6.3. Removing Puppet 7 support will happen in a future major release.

  • add EL10 basic support - align EL10 PGSQL 16 default package version #1650 (ikonia)
  • fix: ignore postgresql_conf resource value when set to absent #1657 (davidassigbi)
  • grant creation via hiera through server::grant.pp #1668 (ikonia)
  • (MODULES-11840) Allow puppetlabs/stdlib 10.x #1681 (imaqsood)
  • puppetlabs/concat: Allow 10.x #1669 (bastelfreak)

sce_linux 2.7.0

📅 Latest release: 2026-06-16 (🌐 View on the Forge)

Adds CIS Benchmark support for the RHEL 10 family, fixes an rsyslog configuration file that was unconditionally overwritten, and drops RHEL 7 now that it's end of life.

  • Support for RHEL 10, AlmaLinux 10, Oracle Linux 10, and Rocky Linux 10. Enforces the CIS Benchmark for RHEL 10 (v1.0.1, Server Levels 1 and 2) and CIS Benchmark v1.0.0 for AlmaLinux 10, Oracle Linux 10, and Rocky Linux 10.
  • rsyslog.conf file unconditionally overwritten. Previously overwritten on every Puppet run even when logging configuration was set to ignore, affecting RHEL 7/8/9 and derivatives. No action required from users.
  • Advanced Intrusion Detection Environment (AIDE) utility class. Fixed incorrect configuration options generated for AIDE 0.19.x on RHEL 9 that caused aide --init to fail.
  • RHEL 7. RHEL 7 is end of life and no longer supported.

Check the official release notes for sce_linux 2.7.0 for the full details.

security_policy 1.0.0

🌟 New Module: 2026-06-25 (🌐 View on the Forge)

Brand-new module for managing Windows local security policy. Provides the security_option and user_right_assignment resource types (Puppet Resource API), covering all 45 Windows Privilege Rights and System Access settings. Initial release contains:

  • security_option and user_right_assignment resource types for managing Windows local security policy settings via secedit.
  • security_policy class exposing 45 Optional[Array[String]] parameters (one per privilege right), matching the layout of the legacy dsc/securitypolicydsc module.
  • PuppetX::Sid module: a static well-known SID map covering the 19 standard SIDs, with a PowerShell fallback via Pwsh::Manager for domain and custom accounts.
  • YAML-driven setting metadata loader (PuppetX::SecurityPolicy.all_settings) instead of a hardcoded settings hash.
  • Puppet requirement pinned to >= 8.0.0 < 9.0.0.

stdlib 10.0.1

📅 Latest release: 2026-06-30 (🌐 View on the Forge)

Drops Puppet 7 support, adds CentOS 9 support, extends Sensitive value support to more functions, and fixes has_ip_address/has_ip_network.

wsus_client 6.3.1

📅 Latest release: 2026-06-25 (🌐 View on the Forge)

stdlib 10.x now allowed as part of the dependency range bump.

  • (MODULES-11840) Allow puppetlabs/stdlib 10.x #238 (imaqsood)

Until Next Time!

That wraps up the June 2026 roundup. If any of these modules intersect with your environment — especially the Security Compliance Management CVE fixes — the linked Forge pages and release notes are worth a closer look.

Feedback on the series is always useful, especially if there are module families or release-note patterns that deserve more attention in future editions.

More updates coming next month when the July 2026 releases land.

🤖 AI Disclosure

This roundup is produced by a mostly-automated pipeline, with some AI sprinkled in for orchestration and enrichment (or 'Combobulating' and 'Finagling'), followed by a human review (that would be me) before publishing.

The automation is an open-source project with deterministic python scripts to crawl the Forge and determine which puppetlabs modules were released during a specific month (and catching when a module gets more than one release in a month). By combining a template, automation scripts, and some AI orchestration the content all gets pulled together for a structured markdown document. I then jump in to double-check the content and update any wording that seems repetitive or irrelevant (and sometimes I need to add some extra context that isn't in the changelog notes).

Top comments (0)