DEV Community

Cover image for Puppetlabs Modules Roundup – October 2026
puppet profile image Jason St-Cyr
Jason St-Cyr for puppet

Posted on AI-assisted

Puppetlabs Modules Roundup – October 2026

#puppet

October 2026 brought 31 Puppetlabs module releases, a quieter month after September's sprawling Puppet Core 9 rollout. That rollout continued this month, with more of the catalog still to come in future months, alongside a batch of dependency-ceiling bumps and two unrelated security fixes worth a closer look. This roundup pulls the most important changes into one place.

Highlighted Updates

Puppet Core 9 Rollout Continues for the Core Resource-API Modules

October continues the Puppet Core 9 compatibility push that dominated September's roundup, this time landing in the _core family of modules (augeas_core, cron_core, etc.) and also puppet_authorization, hocon, puppet_status_check, and facts. Thirteen modules in all picked up Puppet Core 9 support this past month, with more of the catalog expected to follow over the coming months.

  • Affected modules: augeas_core, cron_core, facts, hocon, host_core, mount_core, puppet_authorization, puppet_status_check, selinux_core, sshkeys_core, yumrepo_core, zfs_core, zone_core.

Dependency Ceilings Raised for puppet/archive, puppet/kmod, and puppet/systemd

Several modules widened their upper dependency bounds to allow newer companion-module releases, clearing the way for puppet/archive 9.x, puppet/kmod 5.1.x, and puppet/systemd 11.x without changing their own behavior.

  • Affected modules: tomcat, apache, kubernetes, java, postgresql.

Puppet 7 Support Dropped in 12 Modules This Month

As part of the Puppet Core 9 push, twelve modules dropped Puppet 7 support outright this month. Nine of those (the entire _core family) moved their Puppet floor straight from 6 to 8, while hocon, puppet_authorization, and puppet_status_check moved from 7 to 8. puppet_authorization 2.0.0 is also a major-version release, which required node_encrypt 4.1.0 to widen its dependency bound to allow it. If any of these modules are in your environment, confirm your Puppet version before upgrading.

  • Affected modules: augeas_core, cron_core, hocon, host_core, mount_core, puppet_authorization, puppet_status_check, selinux_core, sshkeys_core, yumrepo_core, zfs_core, zone_core.

Security Fixes in apt and postgresql

Two unrelated fixes this month close off real security gaps rather than routine CVE patching.

  • apt: Version 11.4.1 rejects and escapes shell characters in apt::ppa names, closing a shell-injection vector in PPA name handling.
  • postgresql: Version 10.8.0 stops the default_privileges type from revealing sensitive data in Puppet's catalog and report output.

What Updates Happened to Puppetlabs Modules in October 2026?

The following is an alphabetical listing of modules which received updates in October 2026. If a module had multiple versions released, the updates are collected together, numbered with the "latest" version available.

apache 13.5.0

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

This release raised the puppet/archive dependency ceiling to allow 9.x and refactored how apache::vhost configures ModSecurity, alongside acceptance-test fixes for SLES 12 and lbmethods.

  • (MODULES-11996) Allow puppet/archive 9.x #2657 (imaqsood)
  • feat(apache::vhost): refactor ModSecurity configuration handling #2627 (bovy89)
  • (MODULES-11990) Fix SLES 12 mod_security apache start failures in acceptance #2659 (imaqsood)
  • (MODULES-11979) Enable and correct spec files for lbmethods #2653 (imaqsood)
  • Remove mod_log_forensic from apache::default_mods (#2573) #2601 (stdietrich)

apt 11.4.1

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

This release closed a shell-injection vector by rejecting and escaping shell characters in apt::ppa names.

  • Reject shell characters in apt::ppa names and escape the name #1320 (bwitt)

audit_policy 1.2.2

📅 Latest release: 2026-10-09 (🌐 View on the Forge)

This release fixed broken links in the README by inlining the examples directly.

  • Fix broken links in README by inlining examples #33 (SugatD)

augeas_core 2.1.0

📅 Latest release: 2026-10-01 (🌐 View on the Forge)

This release added Puppet Core 9 support.

cd4pe_jobs 1.7.6

📅 Latest release: 2026-10-19 (🌐 View on the Forge)

This release fixed job-payload failures on Puppet Core 9 agents (Ruby 4.0) by having run_cd4pe_job.rb explicitly require fileutils, which was previously loaded implicitly.

  • run_cd4pe_job.rb now explicitly requires fileutils. Previously it relied on FileUtils being loaded implicitly, which is no longer the case with the Ruby bundled in Puppet Core 9 agents (Ruby 4.0). On those agents, jobs failed while unpacking the job payload with uninitialized constant GZipHelper::FileUtils.

cd4peadm 5.19.0

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

A few highlights from this release:

  • Updated the look-and-feel of, and made performance improvements to, the root console settings pages and deployment and Impact Analysis details pages in each workspace.
  • Updated the CD backend base image from Debian Bookworm to Debian Trixie.
  • The public puppetlabs/puppetlabs-cd4pe_deployments repository is now a mirror of an internal fork and remains a reference for custom deployments. File bug reports and feature requests as GitHub issues; fixes are made upstream and then mirrored to the public repository.

Check the official release notes for cd4peadm 5.19.0 for the full details.

chocolatey 9.1.1

📅 Latest release: 2026-10-12 (🌐 View on the Forge)

This release added support for runner metaparameters in chocolatey tasks.

  • (MODULES-11957) Accept runner metaparameters in chocolatey tasks #399 (imaqsood)

cron_core 2.1.0

📅 Latest release: 2026-10-01 (🌐 View on the Forge)

This release added Puppet Core 9 support.

facts 1.8.1

📅 Latest release: 2026-10-01 (🌐 View on the Forge)

This release added Puppet Core 9 compatibility and reverted a recent change to fact output for SuSE and AlmaLinux.

hocon 3.0.0

📅 Latest release: 2026-10-21 (🌐 View on the Forge)

This release updated the module for Puppet Core 9 and PDK 4.0, dropping Puppet 7 support in the process.

  • (maint) update module for Puppet 9 and PDK 4.0 #126 (zaben903)

host_core 2.1.0

📅 Latest release: 2026-10-01 (🌐 View on the Forge)

This release added Puppet Core 9 support.

inifile 6.6.0

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

This release added a new ini_section type for managing whole INI sections as a single resource.

java 12.2.0

📅 Latest release: 2026-10-19 (🌐 View on the Forge)

This release raised the puppet/archive dependency ceiling to allow 9.x, added Ubuntu 26.04 support, and fixed containment of java::config.

Includes monthly releases: 12.2.0 (2026-10-19), 12.1.1 (2026-10-16).

kubernetes 8.3.0

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

This release raised the dependency ceilings for puppet/kmod (5.1.x) and puppet/archive (9.x).

mount_core 2.1.0

📅 Latest release: 2026-10-01 (🌐 View on the Forge)

This release added Puppet Core 9 support.

mysql 17.4.0

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

This release added Ubuntu 24.04 support and fixed a Ruby 2.7-incompatible hash shorthand in the mysql provider that broke on older Puppet agents.

node_encrypt 4.1.0

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

This release widened the puppetlabs/puppet_authorization dependency bound to allow 2.x, following that module's Puppet Core 9 update.

  • (MODULES-12063) Allow puppetlabs/puppet_authorization 2.x #130 (imaqsood)

ntp 11.2.1

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

This release derived the SLES 15 legacy-module check from facts and added a guard around the exec resource.

  • (MODULES-11973) Derive SLES 15 legacy module from facts and guard the exec #755 (imaqsood)

postgresql 10.8.0

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

This release raised the puppet/systemd dependency ceiling to allow 11.x, fixed role-name quoting in the default_privileges type, and stopped that type from revealing sensitive data (see Security fixes above).

puppet_authorization 2.0.0

📅 Latest release: 2026-10-21 (🌐 View on the Forge)

This release updated the module for Puppet Core 9, dropping Puppet 7 support in the process.

puppet_metrics_collector 8.3.0

📅 Latest release: 2026-10-09 (🌐 View on the Forge)

This release added collection of the code-version count-cap-binding counter.

puppet_status_check 0.10.0

📅 Latest release: 2026-10-21 (🌐 View on the Forge)

This release added Puppet Core 9 support and hardened the status-check facts.

  • (MODULES-12038) Add Puppet 9 support and harden status-check facts #16 (zaben903)

reboot 6.1.0

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

This release added Windows Server 2025 support.

  • (MODULES-11888) Add Windows Server 2025 support #380 (imaqsood)

sce_windows 2.3.0

📅 Latest release: 2026-10-07 (🌐 View on the Forge)

A few highlights from this release:

  • Puppet-maintained modules. Puppet maintains the new modules, allowing features and fixes to be delivered independently of DSC module releases.
  • Per-setting reporting. Because each CIS control maps to its own resource in the Puppet catalog, Puppet agent reports now show changes to individual settings instead of grouping multiple settings within a DSC resource.

Check the official release notes for sce_windows 2.3.0 for the full details.

selinux_core 2.1.0

📅 Latest release: 2026-10-01 (🌐 View on the Forge)

This release added Puppet Core 9 support.

sshkeys_core 3.1.0

📅 Latest release: 2026-10-01 (🌐 View on the Forge)

This release added Puppet Core 9 support.

stdlib 10.1.1

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

This release removed a Ruby 3.1-only hash shorthand so the module keeps working under the Ruby 2.7 runtime bundled with older Puppet agents.

tomcat 8.2.0

📅 Latest release: 2026-10-27 (🌐 View on the Forge)

This release raised the puppet/archive dependency ceiling to allow 9.x.

yumrepo_core 3.1.0

📅 Latest release: 2026-10-01 (🌐 View on the Forge)

This release added Puppet Core 9 support.

zfs_core 2.1.0

📅 Latest release: 2026-10-01 (🌐 View on the Forge)

This release added Puppet Core 9 support.

zone_core 2.1.0

📅 Latest release: 2026-10-01 (🌐 View on the Forge)

This release added Puppet Core 9 support.

Until Next Time!

That wraps up the October 2026 roundup. If puppet_authorization or hocon intersect with your environment, take a look before upgrading since both dropped Puppet 7 support outright, and the apt and postgresql fixes are worth applying regardless of whether you track every release closely.

Feedback on the series is always useful, especially if there are module families or release-note patterns that deserve more attention in future editions.

More updates coming next month when the November 2026 releases land.

🤖 AI Disclosure

This roundup is produced by a mostly-automated pipeline, with some AI sprinkled in for orchestration and enrichment (or 'Combobulating' and 'Finagling'), followed by a human review (that would be me) before publishing.

The automation is an open-source project with deterministic python scripts to crawl the Forge and determine which puppetlabs modules were released during a specific month (and catching when a module gets more than one release in a month). By combining a template, automation scripts, and some AI orchestration the content all gets pulled together for a structured markdown document. I then jump in to double-check the content and update any wording that seems repetitive or irrelevant (and sometimes I need to add some extra context that isn't in the changelog notes).

Top comments (0)