Installation diagnostics

zack@Life0fPi:~$ echo "===== OMV VERSION ====="

Show the installed OpenMediaVault version.

dpkg-query -W -f='${Package} ${Version}\n' openmediavault echo echo "===== OMV SERVICES ====="

Check whether OMV's main management service is running.

systemctl is-active openmediavault-engined

Check whether nginx, which provides the OMV web interface, is running.

systemctl is-active nginx echo echo "===== PACKAGE STATE ====="

Check whether OMV installation left any Debian packages incomplete.

sudo dpkg --audit

Show the package-check result.

echo "dpkg audit exit code: $?"
 ===== OMV VERSION ===== openmediavault 8.5.8-1 ===== OMV SERVICES ===== active active ===== PACKAGE STATE ===== [sudo] password for zack:  dpkg audit exit code: 0
 zack@Life0fPi:~$  zack@Life0fPi:~$ echo "===== SSD TRIM SUPPORT ====="

Show whether connected storage devices advertise discard/TRIM support.

A non-zero DISC-MAX indicates that discard/TRIM is supported.

lsblk -D echo echo "===== FSTRIM TIMER ====="

Check whether Debian's periodic SSD TRIM timer is enabled

and show when it last/next runs.

systemctl status fstrim.timer --no-pager ===== SSD TRIM SUPPORT ===== NAME   DISC-ALN DISC-GRAN DISC-MAX DISC-ZERO sda           0        0B       0B         0 ├─sda1        0        0B       0B         0 └─sda2        0        0B       0B         0 ===== FSTRIM TIMER ===== ● fstrim.timer - Discard unused filesystem blocks once a week      Loaded: loaded (/usr/lib/systemd/system/fstrim.timer; enabled; preset: enabled)      Active: active (waiting) since Mon 2026-09-14 01:06:15 CEST; 18h ago  Invocation: abb4f318c3f045558f80ddf19d19bebe     Trigger: Mon 2026-09-21 01:11:55 CEST; 6 days left    Triggers: ● fstrim.service        Docs: man:fstrim Sep 14 01:06:15 Life0fPi systemd[1]: Started fstrim.timer - Discard unused filesystem blocks o… week. Hint: Some lines were ellipsized, use -l to show in full. zack@Life0fPi:~$ echo echo "===== OMV FLASHMEMORY PLUGIN ====="

Check whether the OMV Flash Memory plugin is installed.

dpkg-query -W -f='${Package} ${Version} ${Status}\n'
    openmediavault-flashmemory 2>/dev/null
    || echo "Flashmemory plugin: not installed" ===== OMV FLASHMEMORY PLUGIN ===== openmediavault-flashmemory  unknown ok not-installed zack@Life0fPi:~$ echo "===== OMV / CURRENT BOOT ERRORS ====="

Show kernel and system errors from the current boot.

Kept separate because this can generate a lot of output.

sudo journalctl -b 0 -p 3 --no-pager ===== OMV / CURRENT BOOT ERRORS ===== Sep 14 01:06:14 Life0fPi kernel: rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 3-.... } 6 jiffies s: 45 root: 0x8/. Sep 14 01:06:14 Life0fPi kernel: rcu: blocking rcu_node structures (internal RCU debug): Sep 14 01:06:14 Life0fPi kernel: rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 2-.... } 7 jiffies s: 49 root: 0x4/. Sep 14 01:06:14 Life0fPi kernel: rcu: blocking rcu_node structures (internal RCU debug): Sep 14 01:06:14 Life0fPi kernel: OF: resolver: node label 'clk_rp1_xosc' not found in live devicetree symbols table Sep 14 01:06:14 Life0fPi kernel: rp1_pci 0002:01:00.0: probe with driver rp1_pci failed with error -22 Sep 14 01:06:14 Life0fPi kernel: rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 1-.... } 6 jiffies s: 57 root: 0x2/. Sep 14 01:06:14 Life0fPi kernel: rcu: blocking rcu_node structures (internal RCU debug): Sep 14 01:06:14 Life0fPi kernel: rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 3-.... } 6 jiffies s: 61 root: 0x8/. Sep 14 01:06:14 Life0fPi kernel: rcu: blocking rcu_node structures (internal RCU debug): Sep 14 01:06:14 Life0fPi kernel: rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 1-.... } 7 jiffies s: 65 root: 0x2/. Sep 14 01:06:14 Life0fPi kernel: rcu: blocking rcu_node structures (internal RCU debug): Sep 14 01:06:14 Life0fPi systemd-modules-load[341]: Failed to find module 'softdog' Sep 14 01:06:14 Life0fPi systemd-udevd[372]: /usr/lib/udev/rules.d/60-i2c-aliases.rules:8 Unknown group 'i2c', ignoring. Sep 14 01:06:14 Life0fPi systemd-udevd[372]: /usr/lib/udev/rules.d/60-piolib.rules:1 Unknown group 'gpio', ignoring. Sep 14 01:06:14 Life0fPi systemd-udevd[372]: /usr/lib/udev/rules.d/90-alsa-restore.rules:18 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 01:06:14 Life0fPi systemd-udevd[372]: /usr/lib/udev/rules.d/90-alsa-restore.rules:22 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 01:06:14 Life0fPi systemd-udevd[372]: /etc/udev/rules.d/99-com.rules:2 Unknown group 'i2c', ignoring. Sep 14 01:06:14 Life0fPi systemd-udevd[372]: /etc/udev/rules.d/99-com.rules:3 Unknown group 'spi', ignoring. Sep 14 01:06:14 Life0fPi systemd-udevd[372]: /etc/udev/rules.d/99-com.rules:4 Unknown group 'gpio', ignoring. Sep 14 01:06:14 Life0fPi systemd-udevd[372]: /etc/udev/rules.d/99-com.rules:7 Unknown group 'gpio', ignoring. Sep 14 16:11:27 Life0fPi openmediavault-webgui[2545]: Authorized login from 192.168.1.200 [username=admin, user-agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15] Sep 14 16:22:54 Life0fPi openmediavault-webgui[4273]: Unauthorized login attempt from 192.168.1.200 [username=admin, user-agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15] Sep 14 16:23:02 Life0fPi openmediavault-webgui[4273]: Unauthorized login attempt from 192.168.1.200 [username=admin, user-agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15] Sep 14 16:23:08 Life0fPi openmediavault-webgui[4273]: Authorized login from 192.168.1.200 [username=admin, user-agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15] Sep 14 18:53:16 Life0fPi openmediavault-webgui[8450]: Authorized login from 192.168.1.200 [username=admin, user-agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15] Sep 14 18:53:46 Life0fPi omv-engined[8777]: PHP Fatal error: Uncaught Error: Call to undefined method OMV\System\Process::setRequireOutput() in /usr/share/php/openmediavault/system/net/dns.inc:68 Sep 14 18:53:46 Life0fPi omv-engined[8777]: Stack trace: Sep 14 18:53:46 Life0fPi omv-engined[8777]: #0 /usr/share/openmediavault/engined/rpc/system.inc(431): OMV\System\Net\Dns::getFqdn() Sep 14 18:53:46 Life0fPi omv-engined[8777]: #1 [internal function]: Engined\Rpc\System->getInformation() Sep 14 18:53:46 Life0fPi omv-engined[8777]: #2 /usr/share/php/openmediavault/rpc/serviceabstract.inc(124): call_user_func_array() Sep 14 18:53:46 Life0fPi omv-engined[8777]: #3 /usr/share/php/openmediavault/rpc/rpc.inc(98): OMV\Rpc\ServiceAbstract->callMethod() Sep 14 18:53:46 Life0fPi omv-engined[8777]: #4 /usr/sbin/omv-engined(546): OMV\Rpc\Rpc::call() Sep 14 18:53:46 Life0fPi omv-engined[8777]: #5 {main} Sep 14 18:53:46 Life0fPi omv-engined[8777]:   thrown in /usr/share/php/openmediavault/system/net/dns.inc on line 68 Sep 14 18:53:51 Life0fPi omv-engined[8788]: PHP Fatal error: Uncaught Error: Call to undefined method OMV\System\Process::setRequireOutput() in /usr/share/php/openmediavault/system/net/dns.inc:68 Sep 14 18:53:51 Life0fPi omv-engined[8788]: Stack trace: Sep 14 18:53:51 Life0fPi omv-engined[8788]: #0 /usr/share/openmediavault/engined/rpc/system.inc(431): OMV\System\Net\Dns::getFqdn() Sep 14 18:53:51 Life0fPi omv-engined[8788]: #1 [internal function]: Engined\Rpc\System->getInformation() Sep 14 18:53:51 Life0fPi omv-engined[8788]: #2 /usr/share/php/openmediavault/rpc/serviceabstract.inc(124): call_user_func_array() Sep 14 18:53:51 Life0fPi omv-engined[8788]: #3 /usr/share/php/openmediavault/rpc/rpc.inc(98): OMV\Rpc\ServiceAbstract->callMethod() Sep 14 18:53:51 Life0fPi omv-engined[8788]: #4 /usr/sbin/omv-engined(546): OMV\Rpc\Rpc::call() Sep 14 18:53:51 Life0fPi omv-engined[8788]: #5 {main} Sep 14 18:53:51 Life0fPi omv-engined[8788]:   thrown in /usr/share/php/openmediavault/system/net/dns.inc on line 68 Sep 14 18:53:56 Life0fPi omv-engined[8799]: PHP Fatal error: Uncaught Error: Call to undefined method OMV\System\Process::setRequireOutput() in /usr/share/php/openmediavault/system/net/dns.inc:68 Sep 14 18:53:56 Life0fPi omv-engined[8799]: Stack trace: Sep 14 18:53:56 Life0fPi omv-engined[8799]: #0 /usr/share/openmediavault/engined/rpc/system.inc(431): OMV\System\Net\Dns::getFqdn() Sep 14 18:53:56 Life0fPi omv-engined[8799]: #1 [internal function]: Engined\Rpc\System->getInformation() Sep 14 18:53:56 Life0fPi omv-engined[8799]: #2 /usr/share/php/openmediavault/rpc/serviceabstract.inc(124): call_user_func_array() Sep 14 18:53:56 Life0fPi omv-engined[8799]: #3 /usr/share/php/openmediavault/rpc/rpc.inc(98): OMV\Rpc\ServiceAbstract->callMethod() Sep 14 18:53:56 Life0fPi omv-engined[8799]: #4 /usr/sbin/omv-engined(546): OMV\Rpc\Rpc::call() Sep 14 18:53:56 Life0fPi omv-engined[8799]: #5 {main} Sep 14 18:53:56 Life0fPi omv-engined[8799]:   thrown in /usr/share/php/openmediavault/system/net/dns.inc on line 68 Sep 14 18:54:01 Life0fPi omv-engined[9051]: PHP Fatal error: Uncaught Error: Call to undefined method OMV\System\Process::setRequireOutput() in /usr/share/php/openmediavault/system/net/dns.inc:68 Sep 14 18:54:01 Life0fPi omv-engined[9051]: Stack trace: Sep 14 18:54:01 Life0fPi omv-engined[9051]: #0 /usr/share/openmediavault/engined/rpc/system.inc(431): OMV\System\Net\Dns::getFqdn() Sep 14 18:54:01 Life0fPi omv-engined[9051]: #1 [internal function]: Engined\Rpc\System->getInformation() Sep 14 18:54:01 Life0fPi omv-engined[9051]: #2 /usr/share/php/openmediavault/rpc/serviceabstract.inc(124): call_user_func_array() Sep 14 18:54:01 Life0fPi omv-engined[9051]: #3 /usr/share/php/openmediavault/rpc/rpc.inc(98): OMV\Rpc\ServiceAbstract->callMethod() Sep 14 18:54:01 Life0fPi omv-engined[9051]: #4 /usr/sbin/omv-engined(546): OMV\Rpc\Rpc::call() Sep 14 18:54:01 Life0fPi omv-engined[9051]: #5 {main} Sep 14 18:54:01 Life0fPi omv-engined[9051]:   thrown in /usr/share/php/openmediavault/system/net/dns.inc on line 68 Sep 14 18:54:06 Life0fPi omv-engined[9232]: PHP Fatal error: Uncaught Error: Call to undefined method OMV\System\Process::setRequireOutput() in /usr/share/php/openmediavault/system/net/dns.inc:68 Sep 14 18:54:06 Life0fPi omv-engined[9232]: Stack trace: Sep 14 18:54:06 Life0fPi omv-engined[9232]: #0 /usr/share/openmediavault/engined/rpc/system.inc(431): OMV\System\Net\Dns::getFqdn() Sep 14 18:54:06 Life0fPi omv-engined[9232]: #1 [internal function]: Engined\Rpc\System->getInformation() Sep 14 18:54:06 Life0fPi omv-engined[9232]: #2 /usr/share/php/openmediavault/rpc/serviceabstract.inc(124): call_user_func_array() Sep 14 18:54:06 Life0fPi omv-engined[9232]: #3 /usr/share/php/openmediavault/rpc/rpc.inc(98): OMV\Rpc\ServiceAbstract->callMethod() Sep 14 18:54:06 Life0fPi omv-engined[9232]: #4 /usr/sbin/omv-engined(546): OMV\Rpc\Rpc::call() Sep 14 18:54:06 Life0fPi omv-engined[9232]: #5 {main} Sep 14 18:54:06 Life0fPi omv-engined[9232]:   thrown in /usr/share/php/openmediavault/system/net/dns.inc on line 68 Sep 14 18:56:54 Life0fPi systemd-udevd[372]: /usr/lib/udev/rules.d/60-i2c-aliases.rules:8 Unknown group 'i2c', ignoring. Sep 14 18:56:54 Life0fPi systemd-udevd[372]: /usr/lib/udev/rules.d/60-piolib.rules:1 Unknown group 'gpio', ignoring. Sep 14 18:56:54 Life0fPi systemd-udevd[372]: /usr/lib/udev/rules.d/90-alsa-restore.rules:18 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 18:56:54 Life0fPi systemd-udevd[372]: /usr/lib/udev/rules.d/90-alsa-restore.rules:22 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 18:56:54 Life0fPi systemd-udevd[372]: /etc/udev/rules.d/99-com.rules:2 Unknown group 'i2c', ignoring. Sep 14 18:56:54 Life0fPi systemd-udevd[372]: /etc/udev/rules.d/99-com.rules:3 Unknown group 'spi', ignoring. Sep 14 18:56:54 Life0fPi systemd-udevd[372]: /etc/udev/rules.d/99-com.rules:4 Unknown group 'gpio', ignoring. Sep 14 18:56:54 Life0fPi systemd-udevd[372]: /etc/udev/rules.d/99-com.rules:7 Unknown group 'gpio', ignoring. zack@Life0fPi:~$

REBOOT DIAGNOSTIC FAILED BUT LOOK AT NEXT REBOOT(JUST REBOOTED) ===== OMV / PREVIOUS BOOT ERRORS ===== [sudo] password for zack:  Sep 14 00:26:48 Life0fPi kernel: rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 0-.... } 7 jiffies s: 49 root: 0x1/. Sep 14 00:26:48 Life0fPi kernel: rcu: blocking rcu_node structures (internal RCU debug): Sep 14 00:26:48 Life0fPi kernel: OF: resolver: node label 'clk_rp1_xosc' not found in live devicetree symbols table Sep 14 00:26:48 Life0fPi kernel: rp1_pci 0002:01:00.0: probe with driver rp1_pci failed with error -22 Sep 14 00:26:48 Life0fPi kernel: rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 3-.... } 6 jiffies s: 53 root: 0x8/. Sep 14 00:26:48 Life0fPi kernel: rcu: blocking rcu_node structures (internal RCU debug): Sep 14 00:26:48 Life0fPi kernel: rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 2-.... } 7 jiffies s: 57 root: 0x4/. Sep 14 00:26:48 Life0fPi kernel: rcu: blocking rcu_node structures (internal RCU debug): Sep 14 00:26:48 Life0fPi kernel: rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 3-.... } 6 jiffies s: 61 root: 0x8/. Sep 14 00:26:48 Life0fPi kernel: rcu: blocking rcu_node structures (internal RCU debug): Sep 14 00:26:48 Life0fPi kernel: rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 0-.... } 6 jiffies s: 69 root: 0x1/. Sep 14 00:26:48 Life0fPi kernel: rcu: blocking rcu_node structures (internal RCU debug): Sep 14 00:26:49 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-i2c-aliases.rules:8 Unknown group 'i2c', ignoring. Sep 14 00:26:49 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-piolib.rules:1 Unknown group 'gpio', ignoring. Sep 14 00:26:49 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:18 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:26:49 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:22 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:26:49 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:2 Unknown group 'i2c', ignoring. Sep 14 00:26:49 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:3 Unknown group 'spi', ignoring. Sep 14 00:26:49 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:4 Unknown group 'gpio', ignoring. Sep 14 00:26:49 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:7 Unknown group 'gpio', ignoring. Sep 14 00:26:48 Life0fPi systemd-tmpfiles[663]: Setting file flags is only supported on regular files and directories, cannot set on '/var/log/journal'. Sep 14 00:29:04 Life0fPi smartd[5270]: In the system's table of devices NO devices found to scan Sep 14 00:29:04 Life0fPi smartd[5270]: Unable to monitor any SMART enabled devices. Exiting. Sep 14 00:29:04 Life0fPi smartd[5270]: smartd is exiting (exit status 17) Sep 14 00:29:04 Life0fPi systemd[1]: Failed to start smartmontools.service - Self Monitoring and Reporting Technology (SMART) Daemon. Sep 14 00:29:21 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-i2c-aliases.rules:8 Unknown group 'i2c', ignoring. Sep 14 00:29:21 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-piolib.rules:1 Unknown group 'gpio', ignoring. Sep 14 00:29:21 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:18 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:29:21 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:22 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:29:21 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:2 Unknown group 'i2c', ignoring. Sep 14 00:29:21 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:3 Unknown group 'spi', ignoring. Sep 14 00:29:21 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:4 Unknown group 'gpio', ignoring. Sep 14 00:29:21 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:7 Unknown group 'gpio', ignoring. Sep 14 00:29:27 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-i2c-aliases.rules:8 Unknown group 'i2c', ignoring. Sep 14 00:29:27 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-piolib.rules:1 Unknown group 'gpio', ignoring. Sep 14 00:29:27 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:18 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:29:27 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:22 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:29:27 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:2 Unknown group 'i2c', ignoring. Sep 14 00:29:27 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:3 Unknown group 'spi', ignoring. Sep 14 00:29:27 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:4 Unknown group 'gpio', ignoring. Sep 14 00:29:27 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:7 Unknown group 'gpio', ignoring. Sep 14 00:29:27 Life0fPi blkmapd[12814]: open pipe file /run/rpc_pipefs/nfs/blocklayout failed: No such file or directory Sep 14 00:29:36 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-i2c-aliases.rules:8 Unknown group 'i2c', ignoring. Sep 14 00:29:36 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-piolib.rules:1 Unknown group 'gpio', ignoring. Sep 14 00:29:36 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:18 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:29:36 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:22 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:29:36 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:2 Unknown group 'i2c', ignoring. Sep 14 00:29:36 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:3 Unknown group 'spi', ignoring. Sep 14 00:29:36 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:4 Unknown group 'gpio', ignoring. Sep 14 00:29:36 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:7 Unknown group 'gpio', ignoring. Sep 14 00:29:43 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-i2c-aliases.rules:8 Unknown group 'i2c', ignoring. Sep 14 00:29:43 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-piolib.rules:1 Unknown group 'gpio', ignoring. Sep 14 00:29:43 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:18 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:29:43 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:22 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:29:43 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:2 Unknown group 'i2c', ignoring. Sep 14 00:29:43 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:3 Unknown group 'spi', ignoring. Sep 14 00:29:43 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:4 Unknown group 'gpio', ignoring. Sep 14 00:29:43 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:7 Unknown group 'gpio', ignoring. Sep 14 00:29:47 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-i2c-aliases.rules:8 Unknown group 'i2c', ignoring. Sep 14 00:29:47 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-piolib.rules:1 Unknown group 'gpio', ignoring. Sep 14 00:29:47 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:18 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:29:47 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:22 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:29:47 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:2 Unknown group 'i2c', ignoring. Sep 14 00:29:47 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:3 Unknown group 'spi', ignoring. Sep 14 00:29:47 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:4 Unknown group 'gpio', ignoring. Sep 14 00:29:47 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:7 Unknown group 'gpio', ignoring. Sep 14 00:31:22 Life0fPi blkmapd[12814]: exit on signal(15) Sep 14 00:31:43 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-i2c-aliases.rules:8 Unknown group 'i2c', ignoring. Sep 14 00:31:43 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-piolib.rules:1 Unknown group 'gpio', ignoring. Sep 14 00:31:43 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:18 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:31:43 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:22 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:31:43 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:2 Unknown group 'i2c', ignoring. Sep 14 00:31:43 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:3 Unknown group 'spi', ignoring. Sep 14 00:31:43 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:4 Unknown group 'gpio', ignoring. Sep 14 00:31:43 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:7 Unknown group 'gpio', ignoring. Sep 14 00:31:48 Life0fPi monit[2679]: 'omv-engined' process is not running Sep 14 00:31:57 Life0fPi systemd-modules-load[21270]: Failed to find module 'softdog' zack@Life0fPi:~$

Second reboot diagnostics look here
===== OMV / PREVIOUS BOOT ERRORS ===== [sudo] password for zack:  Sep 14 00:26:48 Life0fPi kernel: rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 0-.... } 7 jiffies s: 49 root: 0x1/. Sep 14 00:26:48 Life0fPi kernel: rcu: blocking rcu_node structures (internal RCU debug): Sep 14 00:26:48 Life0fPi kernel: OF: resolver: node label 'clk_rp1_xosc' not found in live devicetree symbols table Sep 14 00:26:48 Life0fPi kernel: rp1_pci 0002:01:00.0: probe with driver rp1_pci failed with error -22 Sep 14 00:26:48 Life0fPi kernel: rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 3-.... } 6 jiffies s: 53 root: 0x8/. Sep 14 00:26:48 Life0fPi kernel: rcu: blocking rcu_node structures (internal RCU debug): Sep 14 00:26:48 Life0fPi kernel: rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 2-.... } 7 jiffies s: 57 root: 0x4/. Sep 14 00:26:48 Life0fPi kernel: rcu: blocking rcu_node structures (internal RCU debug): Sep 14 00:26:48 Life0fPi kernel: rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 3-.... } 6 jiffies s: 61 root: 0x8/. Sep 14 00:26:48 Life0fPi kernel: rcu: blocking rcu_node structures (internal RCU debug): Sep 14 00:26:48 Life0fPi kernel: rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 0-.... } 6 jiffies s: 69 root: 0x1/. Sep 14 00:26:48 Life0fPi kernel: rcu: blocking rcu_node structures (internal RCU debug): Sep 14 00:26:49 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-i2c-aliases.rules:8 Unknown group 'i2c', ignoring. Sep 14 00:26:49 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-piolib.rules:1 Unknown group 'gpio', ignoring. Sep 14 00:26:49 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:18 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:26:49 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:22 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:26:49 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:2 Unknown group 'i2c', ignoring. Sep 14 00:26:49 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:3 Unknown group 'spi', ignoring. Sep 14 00:26:49 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:4 Unknown group 'gpio', ignoring. Sep 14 00:26:49 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:7 Unknown group 'gpio', ignoring. Sep 14 00:26:48 Life0fPi systemd-tmpfiles[663]: Setting file flags is only supported on regular files and directories, cannot set on '/var/log/journal'. Sep 14 00:29:04 Life0fPi smartd[5270]: In the system's table of devices NO devices found to scan Sep 14 00:29:04 Life0fPi smartd[5270]: Unable to monitor any SMART enabled devices. Exiting. Sep 14 00:29:04 Life0fPi smartd[5270]: smartd is exiting (exit status 17) Sep 14 00:29:04 Life0fPi systemd[1]: Failed to start smartmontools.service - Self Monitoring and Reporting Technology (SMART) Daemon. Sep 14 00:29:21 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-i2c-aliases.rules:8 Unknown group 'i2c', ignoring. Sep 14 00:29:21 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-piolib.rules:1 Unknown group 'gpio', ignoring. Sep 14 00:29:21 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:18 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:29:21 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:22 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:29:21 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:2 Unknown group 'i2c', ignoring. Sep 14 00:29:21 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:3 Unknown group 'spi', ignoring. Sep 14 00:29:21 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:4 Unknown group 'gpio', ignoring. Sep 14 00:29:21 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:7 Unknown group 'gpio', ignoring. Sep 14 00:29:27 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-i2c-aliases.rules:8 Unknown group 'i2c', ignoring. Sep 14 00:29:27 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-piolib.rules:1 Unknown group 'gpio', ignoring. Sep 14 00:29:27 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:18 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:29:27 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:22 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:29:27 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:2 Unknown group 'i2c', ignoring. Sep 14 00:29:27 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:3 Unknown group 'spi', ignoring. Sep 14 00:29:27 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:4 Unknown group 'gpio', ignoring. Sep 14 00:29:27 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:7 Unknown group 'gpio', ignoring. Sep 14 00:29:27 Life0fPi blkmapd[12814]: open pipe file /run/rpc_pipefs/nfs/blocklayout failed: No such file or directory Sep 14 00:29:36 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-i2c-aliases.rules:8 Unknown group 'i2c', ignoring. Sep 14 00:29:36 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-piolib.rules:1 Unknown group 'gpio', ignoring. Sep 14 00:29:36 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:18 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:29:36 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:22 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:29:36 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:2 Unknown group 'i2c', ignoring. Sep 14 00:29:36 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:3 Unknown group 'spi', ignoring. Sep 14 00:29:36 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:4 Unknown group 'gpio', ignoring. Sep 14 00:29:36 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:7 Unknown group 'gpio', ignoring. Sep 14 00:29:43 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-i2c-aliases.rules:8 Unknown group 'i2c', ignoring. Sep 14 00:29:43 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-piolib.rules:1 Unknown group 'gpio', ignoring. Sep 14 00:29:43 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:18 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:29:43 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:22 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:29:43 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:2 Unknown group 'i2c', ignoring. Sep 14 00:29:43 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:3 Unknown group 'spi', ignoring. Sep 14 00:29:43 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:4 Unknown group 'gpio', ignoring. Sep 14 00:29:43 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:7 Unknown group 'gpio', ignoring. Sep 14 00:29:47 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-i2c-aliases.rules:8 Unknown group 'i2c', ignoring. Sep 14 00:29:47 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-piolib.rules:1 Unknown group 'gpio', ignoring. Sep 14 00:29:47 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:18 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:29:47 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:22 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:29:47 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:2 Unknown group 'i2c', ignoring. Sep 14 00:29:47 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:3 Unknown group 'spi', ignoring. Sep 14 00:29:47 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:4 Unknown group 'gpio', ignoring. Sep 14 00:29:47 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:7 Unknown group 'gpio', ignoring. Sep 14 00:31:22 Life0fPi blkmapd[12814]: exit on signal(15) Sep 14 00:31:43 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-i2c-aliases.rules:8 Unknown group 'i2c', ignoring. Sep 14 00:31:43 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/60-piolib.rules:1 Unknown group 'gpio', ignoring. Sep 14 00:31:43 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:18 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:31:43 Life0fPi systemd-udevd[345]: /usr/lib/udev/rules.d/90-alsa-restore.rules:22 GOTO="alsa_restore_std" has no matching label, ignoring. Sep 14 00:31:43 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:2 Unknown group 'i2c', ignoring. Sep 14 00:31:43 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:3 Unknown group 'spi', ignoring. Sep 14 00:31:43 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:4 Unknown group 'gpio', ignoring. Sep 14 00:31:43 Life0fPi systemd-udevd[345]: /etc/udev/rules.d/99-com.rules:7 Unknown group 'gpio', ignoring. Sep 14 00:31:48 Life0fPi monit[2679]: 'omv-engined' process is not running Sep 14 00:31:57 Life0fPi systemd-modules-load[21270]: Failed to find module 'softdog' zack@Life0fPi:~$

Installation data in omv

Reading package lists... Building dependency tree... Reading state information... Calculating upgrade... The following packages will be upgraded: openmediavault openmediavault-salt salt-common salt-minion 4 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. Need to get 37.3 MB of archives. After this operation, 20.4 MB of additional disk space will be used. Get:1 http://packages.openmediavault.org/public synchrony/main arm64 salt-minion arm64 3008.1 [142 kB] Get:2 http://packages.openmediavault.org/public synchrony/main arm64 salt-common arm64 3008.1 [26.0 MB] Get:3 http://packages.openmediavault.org/public synchrony/main arm64 openmediavault-salt arm64 8.1.0 [2884 kB] Get:4 http://packages.openmediavault.org/public synchrony/main arm64 openmediavault all 8.5.8-1 [8228 kB] apt-listchanges: Reading changelogs... apt-listchanges: Changelogs --------------------------- openmediavault (8.5.8-1) stable; urgency=medium * Update i18n files. * Fix typo in media query for system theme detection. * Several improvements. Many thanks to Stanley Chan and Zorta Zenith for the tips. * Issue #2263: Add a per-share/homes macOS compatibility option to SMB. * Issue #2265: smartmontools no longer requires -d cciss,N for non-RAID hpsa devices. -- Volker Theile [email protected] Wed, 02 Sep 2026 21:25:22 +0200 openmediavault (8.5.7-1) stable; urgency=medium * Update i18n files. * Improve PHP session garbage collection process. * Issue #2258: Display tags in filesystem dashboard widgets. -- Volker Theile [email protected] Sun, 16 Aug 2026 13:11:04 +0200 openmediavault (8.5.6-1) stable; urgency=medium * Provide functionality required by the MD plugin. -- Volker Theile [email protected] Mon, 03 Aug 2026 18:04:48 +0200 openmediavault (8.5.5-2) stable; urgency=medium * Update i18n files. * Modify the sharename data model format validator according to the MS-FSCC share name specification. * Modify the devicefile data model format validator to support additional characters in device file paths. -- Volker Theile [email protected] Thu, 23 Jul 2026 19:13:38 +0200 openmediavault (8.5.4-2) stable; urgency=medium * Update i18n files. * Various improvements. -- Volker Theile [email protected] Fri, 17 Jul 2026 13:32:33 +0200 openmediavault (8.5.3-1) stable; urgency=medium * Fix regression in shared folder creation page. * Do not overwrite the permissions for a shared folder after editing an existing. * Improve the handling of special characters in a netplan WiFi configuration. -- Volker Theile [email protected] Thu, 16 Jul 2026 19:52:49 +0200 openmediavault (8.5.2-1) stable; urgency=medium * Update i18n files. * Issue #2106: Do not offer non-empty storage devices as file system candidates. Thanks to John O'Callaghan for the contribution. -- Volker Theile [email protected] Thu, 09 Jul 2026 07:18:18 +0200 openmediavault (8.5.1-1) stable; urgency=medium * Improve the validation of RPC requests related to the management of users, groups and shared folders. -- Volker Theile [email protected] Sun, 05 Jul 2026 09:52:01 +0200 openmediavault (8.5.0-3) stable; urgency=medium * Issue #2235: Add a 2-step authentication plugin framework for the UI. Note, if you are using the API to log into the system, the response of the Session::login RPC has been changed. * Hardening the UI auto-logout feature. * Move Samba recycle VFS object to the end of the list. -- Volker Theile [email protected] Tue, 16 Jun 2026 21:00:39 +0200 openmediavault (8.4.0-3) stable; urgency=medium * Set Avahi to listen on VLAN interfaces as well. * Upgrade to SaltStack 3008. -- Volker Theile [email protected] Thu, 11 Jun 2026 07:19:21 +0200 openmediavault (8.3.1-3) stable; urgency=medium * Update i18n files. * Improve Avahi IPv4/IPv6 mode detection and publish flags. * Improve storage and filesystem performance in the PHP backend by introducing TTL-based caches. * Restart monit if reloading fails during configuration deployment. -- Volker Theile [email protected] Wed, 27 May 2026 20:33:05 +0200 openmediavault (8.3.0-1) stable; urgency=medium * Refactor storage device processing in the PHP backend code. * Relocate MD related scripts to the corresponding plugin. * Add a new option to omv-firstaid to refresh APT package lists and clean caches. -- Volker Theile [email protected] Sat, 23 May 2026 20:21:20 +0200 openmediavault (8.2.14-3) stable; urgency=medium * Add the environment variables OMV_POSTFIX_MAIN_SMTP_TLS_SERVERNAME and OMV_POSTFIX_MAIN_SMTP_TLS_POLICY_MAPS to customize the postfix configuration. * Many improvements in the code base. -- Volker Theile [email protected] Thu, 14 May 2026 21:14:27 +0200 openmediavault (8.2.13-1) stable; urgency=medium * Hardening omv-env tool. * Fix a bug related to searching on datatable pages. * Improve setting ACL permission on shared folders. * Fix the nginx configuration of the Workbench. -- Volker Theile [email protected] Fri, 08 May 2026 17:48:59 +0200 openmediavault (8.2.12-1) stable; urgency=medium * Issue #2196: Fix login cookies for usernames that contain dots. Due to this change, you may receive another email notification the next time you log in to the Workbench. -- Volker Theile [email protected] Wed, 06 May 2026 23:18:59 +0200 openmediavault (8.2.11-1) stable; urgency=medium * Several improvements. -- Volker Theile [email protected] Mon, 27 Apr 2026 20:03:54 +0200 openmediavault (8.2.10-1) stable; urgency=medium * Issue #2184: Use the standard keyring for the Debian package repositories. -- Volker Theile [email protected] Sat, 25 Apr 2026 20:26:21 +0200 openmediavault (8.2.9-1) stable; urgency=medium * Replace Debian httpredir service. * Issue #2175: Fix regression in smartctl parser. -- Volker Theile [email protected] Fri, 24 Apr 2026 10:10:36 +0200 openmediavault (8.2.8-1) stable; urgency=medium * Add RPCs to manage environment variables. -- Volker Theile [email protected] Fri, 17 Apr 2026 20:08:13 +0200 openmediavault (8.2.7-1) stable; urgency=medium * Update i18n files. * Issue #2176: Increase mDNS/Zeroconf compatibility for MacOS. -- Volker Theile [email protected] Wed, 15 Apr 2026 19:04:56 +0200 openmediavault (8.2.6-1) stable; urgency=medium * Issue #2175: Get more SMART information from SAS drives. -- Volker Theile [email protected] Tue, 14 Apr 2026 17:52:47 +0200 openmediavault (8.2.5-1) stable; urgency=medium * Improve detection of hard drive serial numbers. -- Volker Theile [email protected] Sat, 11 Apr 2026 20:15:21 +0200 openmediavault (8.2.4-1) stable; urgency=medium * Issue #2169: Make sure device symlinks point to the canonical device file. -- Volker Theile [email protected] Fri, 10 Apr 2026 15:34:13 +0200 openmediavault (8.2.3-2) stable; urgency=medium * Issue #2160: Reduce the number of SMART alerts caused by offline uncorrectable sectors. -- Volker Theile [email protected] Tue, 07 Apr 2026 06:17:24 +0200 openmediavault (8.2.2-1) stable; urgency=medium * Improve validation in data models. -- Volker Theile [email protected] Sun, 05 Apr 2026 00:36:21 +0200 openmediavault (8.2.1-1) stable; urgency=medium * Set link local addresses for both Ethernet and WiFi network interfaces by default when using DHCP to ensure that the system is reachable even if no other IP address can be obtained. * Issue #2160: Add change-based monitoring for key SMART attributes (Reallocated Sectors, Current Pending Sectors, and Offline Uncorrectable) to reduce repeated alerts for unchanged disk issues while still notifying about relevant health degradations. -- Volker Theile [email protected] Fri, 03 Apr 2026 09:00:37 +0200 openmediavault (8.2.0-1) stable; urgency=medium * Update i18n files. * Several improvements. * Rename the environment variable OMV_SSHD_CHALLENGERESPONSEAUTHENTICATION to OMV_SSHD_KBDINTERACTIVEAUTHENTICATION. * Issue #2158: Configure APT update check frequency. -- Volker Theile [email protected] Sun, 29 Mar 2026 20:28:51 +0200 openmediavault (8.1.5-1) stable; urgency=medium * Improve dark mode theme. -- Volker Theile [email protected] Sat, 28 Mar 2026 16:30:19 +0100 openmediavault (8.1.4-1) stable; urgency=medium * Issue #2149: Fix bug in JSON schema validation. -- Volker Theile [email protected] Thu, 26 Mar 2026 20:05:43 +0100 openmediavault (8.1.3-1) stable; urgency=medium * Issue #2143: Fix rendering unicode characters in the UI. * Issue #2146: Add Vietnamese (vi_VN) language to UI. -- Volker Theile [email protected] Sun, 08 Mar 2026 10:28:36 +0100 openmediavault (8.1.2-1) stable; urgency=medium * Several UI improvements. * Adapt nginx configuration to new http2 directive. * Relocate System | Workbench page to System | Workbench | Settings. -- Volker Theile [email protected] Thu, 05 Mar 2026 06:38:50 +0100 openmediavault-salt (8.1.0) stable; urgency=medium * Upgrade to SaltStack 3008. -- Volker Theile [email protected] Sat, 13 Jun 2026 19:28:12 +0200 salt (3008.1) stable; urgency=medium # Changed * Changed salt.returners.redis_return to enumerate the Redis keyspace #69037 * with SCAN instead of the blocking KEYS pattern command in both #69037 * get_jids and clean_old_jobs. KEYS walks the entire keyspace #69037 * synchronously and stalls the Redis server for the duration; on a #69037 * master with hundreds of thousands of jobs this can block all clients #69037 * of that Redis instance for seconds. SCAN is incremental and #69037 * non-blocking. Order of returned keys is no longer guaranteed (the #69037 * returner does not rely on order); operators with custom scripts that #69037 * read ret:* or load:* directly may see them in a different order. #69037 # Fixed * Fixed win_pkg functions ignoring the saltenv setting in minion configuration. All public functions (refresh_db, genrepo, install, remove, list_pkgs, latest_version, upgrade_available, list_upgrades, list_available, version, get_repo_data, get_package_info) now fall back to __opts__["saltenv"] when saltenv is not passed explicitly, instead of always defaulting to base. #38551 * Added encoding parameter to file.replace execution module and state to support UTF-16, UTF-32, and other multi-byte encoded files that would otherwise be incorrectly treated as binary. #52793 * Improved documentation for the runas and password parameters in cmd.run, cmd.script, and all salt.modules.cmdmod execution functions on Windows. The docs now accurately describe when a password is required: only when the salt-minion is not running as SYSTEM or as an elevated Administrator. Removed the inaccurate claim that the target user account must be in the Administrators group. Also changed cmd.script to log a warning instead of hard-failing when runas is used without a password on Windows, since a password is not always required. #57951 * Fixed SSL: DECRYPTION_FAILED_OR_BAD_RECORD_MAC errors in the VMware cloud driver by reconnecting when a cached vCenter service instance is found to be stale or corrupted (for example when inherited across a fork by salt-cloud's parallel provider queries). #61983 * Fixed event signature verification failing under minion_sign_messages. The minion was signing the return load before salt.channel.client.AsyncReqChannel._package_load attached transport metadata (nonce, ts, tok, id), so the bytes the master re-serialized to verify did not match what was signed and every signed return was dropped. Signing is now performed inside _package_load after the metadata is attached, against the same bytes the master verifies. #68181 * Fixed two distinct bugs in the salt.engines.redis_sentinel engine that #69031 * together prevented it from being usable. start() no longer raises #69031 * AttributeError: 'dict_values' object has no attribute 'pop' on Python 3 #69031 * (the dict.values() result is now wrapped in list(...)). Listener and #69031 * start() now accept an optional password argument and forward it to #69031 * the redis client, allowing the engine to authenticate against a Sentinel #69031 * that requires AUTH; the default of None keeps existing configurations #69031 * working unchanged. #69031 * Fixed salt.returners.redis_return silently ignoring the documented #69032 * redis.password configuration option. The returner now reads #69032 * redis.password from config (in both regular and proxy modes) and #69032 * forwards it to both the single-server redis.StrictRedis and the #69032 * StrictRedisCluster constructors. Operators with auth-protected Redis #69032 * no longer lose every job return to a hidden NOAUTH Authentication [#69032](https://github.com/saltstack/salt/issues/69032) * required failure; deployments without a password are unaffected. #69032 * Fixed three closely-related bugs in salt.cache.redis_cache that #69033 * together broke hierarchical-bank semantics: #69033 * _build_bank_hier now registers each child bank name in both the #69033 * parent's $BANK_ set (consumed by flush() tree traversal) and the #69033 * parent's $BANKEYS_ set (consumed by list_()); _get_banks_to_remove #69033 * now decodes the bytes returned by smembers and skips the "." #69033 * placeholder, so recursive flush() of a parent bank actually descends #69033 * into sub-banks instead of corrupting the path; and flush(bank) of a #69033 * sub-bank now removes the flushed bank's own reference from its #69033 * parent's index sets so list_(parent) no longer reports it as #69033 * present. Together these fixes restore cache.list("minions"), #69033 * salt-run manage.present and salt-run manage.up for masters #69033 * configured with cache: redis. #69033 * Fixed salt.tokens.rediscluster being unable to retrieve any eauth #69035 * token. The cluster client was created with decode_responses=True, #69035 * which caused redis_client.get() to return str and broke #69035 * salt.payload.loads (msgpack rejects str); it also caused #69035 * redis_client.keys() to return str and broke #69035 * [k.decode("utf8") for k in ...] (str has no .decode). Both #69035 * errors were swallowed by broad except Exception handlers, so eauth #69035 * appeared to silently reject every token. decode_responses=True is #69035 * removed; values now round-trip as bytes through msgpack as the rest #69035 * of the module already expected. #69035 * Fixed salt.returners.redis_return leaking <minion>:<fun> last-jid #69038 * pointer keys indefinitely. The pointer was written with pipeline.set #69038 * and no ex= TTL, so any (minion, fun) pair that stopped running stuck #69038 * in Redis forever -- O(minions × distinct funcs) keys accumulating over #69038 * the lifetime of the master. The pointer now expires on the same TTL #69038 * as the rest of the returner data (keep_jobs_seconds). Operators with #69038 * external scripts reading these keys directly may observe them #69038 * expiring; the documentation never promised they would not. #69038 * Fixed salt.returners.redis_return.get_fun always returning an #69039 * empty dict. The function read return data from a <minion>:<jid> #69039 * key that no other code in the module ever wrote -- a leftover from #69039 * an older storage schema. It now reads from the canonical #69039 * ret:<jid> hash via HGET ret:<jid> <minion>, matching the #69039 * storage layout that returner actually produces and the read #69039 * pattern that get_jid already uses. #69039 * cmd.run and friends no longer include the env and stdin arguments in the CommandExecutionError raised when the underlying subprocess fails to start (typically ENOENT / binary not found). Both fields routinely carry credentials passed in by the caller (env={"DB_PASSWORD": "..."}, password piped via stdin), and the error message ends up in master/minion logs and in event-bus return data visible to the API caller. #69075 * * Relenv 0.22.14 #69129 * - Update python 3.14 to 3.14.6 #69129 * - Update sqlite to 3.53.2.0 #69129 * - Update openssl to 3.5.7 #69129 * Fix pillar masking leaking ********** into rendered pillar and state values. MaskedDict / MaskedList __repr__ / __str__ now consult the salt.utils.secret.mask_pillar ContextVar, so {{ pillar['list_or_dict_value'] }} interpolations on the minion return plain values inside a render bracket. Hoist the mask_pillar=False bracket from render_pillar to compile_pillar so ext_pillar handlers and the rest of the master-side pillar build also run unmasked. #69160 * Fixed Windows MSI self-upgrade via pkg.install failing with error 1603. The old product's DeleteConfig_DECAC custom action was unconditionally deleting ROOTDIR\var during RemoveExistingProducts, destroying the MSI that pkg.install had cached to ROOTDIR\var\cache before launching the upgrade. Users who had REMOVE_CONFIG=1 persisted in the registry (from checking "On uninstall" at install time) hit a worse variant where the entire ROOTDIR was deleted. The fix checks UPGRADINGPRODUCTCODE — set by Windows Installer whenever an uninstall is triggered by a major upgrade — and skips all ROOTDIR deletion during upgrades, matching the behaviour of the NSIS installer which has always preserved ROOTDIR during upgrades. #69219 * Fixed TypeError: string indices must be integers in the minion when the master returns a bare string error response (e.g. "bad load", "Some exception handling minion payload") for a pillar request. The minion now raises a clean AuthenticationError instead of crashing, allowing the caller to retry or fail gracefully. #69228 * pkg.list_patches in yumpkg.py parses tdnf output on Photon OS #69229 * Restore Python dependencies in the PyPI sdist by including requirements/*.in and requirements/**/*.lock in MANIFEST.in. After the requirements .txt → .in rename, the sdist no longer shipped the files that setup.py reads to populate install_requires, so pip install salt produced an installation with no dependencies. #69244 * Fix salt-cloud failing to start with AttributeError: module 'salt' has no attribute 'minion' by importing salt.minion in salt.cloud. #69281 * Ensure multiple masters have their own job/state queues #69308 * Fixed minion state queue replacing the master-assigned JID on queued state runs, so returns now come back tagged with the JID the master actually published. #69386 * Made the salt user's home directory and the relenv extras-<py-ver> directory configurable in the Linux packaging. The DEB preinst scripts now source /etc/default/salt-setup (and /etc/sysconfig/salt-minion-setup for cross-distro parity with RPM) before applying the SALT_HOME/SALT_USER/SALT_GROUP/SALT_NAME defaults, mirroring the long-standing RPM behavior. A new SALT_EXTRAS_DIR override is honored by both stacks so the extras tree can be relocated outside /opt/saltstack/salt and its ownership is correctly restored on upgrade. #69402 # Added * Added dsc_resource execution module and state module for invoking individual #43718 * PowerShell DSC resources directly via Invoke-DscResource, without compiling #43718 * a MOF file or involving the Local Configuration Manager. The #43718 * dsc_resource.managed state provides idiomatic Salt state management for any #43718 * installed DSC resource module. #43718 * fix etcdv3 module authentification when using etcd3-py lib #69202 -- Salt Project Packaging [email protected] Thu, 11 Jun 2026 11:55:12 +0000 salt (3008.0) stable; urgency=medium # Removed * Remove commuity extensions from Salt codebase #65970 * Remove deprecated module search path priority (features.enable_deprecated_module_search_path_priority) #66025 * Remove the orchestration key from salt.runner and salt.wheel return data. #66151 * Removed linode-python package dependency for retired Linode API v3 #68871 * Removed legacy salt.transport.ipc module and unused PushChannel / PullChannel factories; local events use ipc_publish_client / ipc_publish_server (TCP transport). #69001 # Deprecated * Deprecated the use of egrep in favor of grep -E #65608 # Changed * Make sure every auth event has the 'act' key set #56200 * Ansiblegate discover_playbooks was changed to find playbooks as either *.yml or *.yaml files #66048 * re-work the aptpkg module to remove system libraries that onedir and virtualenvs do not have access. Streamline testing, and code use to needed libraries only. #66056 * Made gpg modules respect user's GNUPGHOME if set in shell environment #66313 * Made gpg.present attempt to refresh keys if they are expired #66314 * Made x509_v2 the default x509 modules. Until they are removed in the next major release, you can still revert to the old modules by setting features: {x509_v2: false} in the configuration #66384 * Included Salt extensions in Salt-SSH thin archive #66559 * Add support for additional options in several mac_brew_pkg methods #66611 * Make test_pip and test_fileserver tests compatible with venv execution #66703 * Do not use ssl.PROTOCOL_TLS which has been #66767 * deprecated in #66767 * Python 3.10 will be removed in the future. #66767 * Remove warning when running slsutil.renderer on non-SLS files #67067 * PillarCache: reimplement using salt.cache #68030 * fix minion data cache organization/move pillar and grains to dedicated cache banks #68030 * salt.cache: allow cache.store() to set expires per key #68030 * Provide token storage using the salt.cache interface #68039 * Update packaged python from 3.10 to 3.11 #68148 * Added ceph to the specialFSes to match on name for set_fstab #68207 * Removed networkx module dependency by adding MultiDiGraph implementation to salt.utils.requisite to avoid extra dependencies. #68748 * Expanded Thorium documentation with concrete examples and added unit coverage for the documented Thorium workflows. #68857 * Add stub 3008.0 release notes (and template) so tools docs man and CI prepare-release can resolve the current-release doc target. Exclude doc/topics/proposals/*.md from Sphinx so stand-alone proposal files do not fail strict man builds. #68964 # Fixed * Fixed recursive prereq requisites to report recursive requisite error. #8210 * Fixed erroneous recursive requisite error when a prereq is used in combination with onchanges_any. #47154 * Fixed an infinite loop in requisite_any when a requisite state was not found. #50436 * Refactoring the redis code obsoletes this issue as return values are either decoded directly or passed to salt.payload for parsing. #54734 * Fixed OSError: The operation completed successfully raised by CreateProcessWithTokenW on Windows when the underlying advapi32 call fails. The error code is now read from ctypes.get_last_error() (the ctypes-saved slot) instead of win32api.GetLastError() (the live Windows slot, which may be reset to 0 before it is read). #57848 * Fixed dependency resolution to not be quadratic. #59123 * Fix regex cache exception during sort in sweep function #59437 * Fixed requisites by parallel states on parallel states being evaluated synchronously (blocking state execution for other parallel states) #59959 * Fix bug when specifying template_source using net.load_template #60515 * During the redis refactor the documentation was updated to reference the Redis Cluster pip package. #60899, #66193 * firewalld: normalize new rich rules before comparing to old ones #61235 * Fix regression that prevented salt-minion from running interval-based jobs on startup by default. #61964 * Fixed performance when state_aggregate is enabled. #62439 * Fixed LGPO get_policy_info incorrectly returning a "multiple policies" error when duplicate ADMX policy definitions (e.g. TerminalServer.admx and TerminalServer-Server.admx) resolve to the same full path. #62732 * Fixed issue with salt-ssh hanging due to non-exposed host key acceptance prompt #62782 * Repaired zypper repositories being reconfigured without changes #63402 * Fix calculation of SLS context vars when trailing dots on targetted state #63411 * Catch StrictUndefined in salt jinja custom filters. #64915 * Put default optimization_order to LazyLoader to prevent possible fails on testing #65266 * Fixed aggregation to correctly honor requisites. #65304 * Fixed some instances of deprecated datetime.datetime.utcnow() #65604 * Introduce pruning option in file.keyvalue #65631 * fix 65703 by using OrderedDict instead of a index that breaks. . #65703 * Simplify timezone.compare_zone to primarily rely get_zone() #65719 * Handle regular expressions which do not not use grouping #65722 * fix consul.acl_create rule creation #65788 * Fix salt-cloud get_cloud_config_value for list objects #65789 * Prevent exceptions with fileserver.update when called via state #65819 * Fix granting of privileges on Postgres functions #65839 * Made Salt Cloud Hetzner module detect image architecture from instance type #65888 * Optimize async calls with using async wrapped method in thread only if io loop is already running #65983 * salt.auth.pam: fallback to use running Python in case /usr/bin/python3 is not found #66035 * Fix file.is_link hangs on paths that are hung mounts #66096 * Fix file.managed and file.serialize default tmp_dir to relative path #66098 * Make win_timezone recognize Qyzylorda timezone #66176 * Remove firing useless events with JID as a tag #66279 * Made gpg modules create GNUPGHOME if it does not exist #66312 * Fixed an issue where conflicting top level keys in the static grains file #66445 * (usually /etc/salt/grains) would break all grains states, and prevent static #66445 * grains from being loaded. #66445 * Fixed beacon delete not calling the beacon's close function, causing resource #66449 * leaks (e.g. inotify file descriptors) and CPU spin after deleting beacons at #66449 * runtime via beacons.delete. Also fixed inotify file descriptor leak during #66449 * beacon refresh when the Beacon instance is replaced. #66449 * Fixed a regression where setting ipv6: true in the minion configuration #66603 * caused the minion to fail to start on Windows. Three IPC socket paths in the #66603 * TCP transport hardcoded AF_INET or 127.0.0.1 regardless of the IPv6 #66603 * setting: the IPC publish server/client addresses in salt.transport.base, #66603 * the TCPPuller server socket, and the _TCPPubServerPublisher client #66603 * socket. On Windows, mixing an AF_INET6 socket with the IPv4 loopback #66603 * address (or vice-versa) is rejected by the OS. All three paths now use #66603 * ::1 with AF_INET6 when ipv6: true is set, and 127.0.0.1 #66603 * with AF_INET otherwise. #66603 * Make "status.diskusage" more robust and prevent crashes when stats cannot be obtained #66646 * Use --cachedir parameter for setting extension_modules with salt-call. #66742 * Don't schedule __master_alive jobs if master_alive_interval is not specified #66757 * Make x509 module compatible with cryptography module newer than 43.0.0 #66818 * Fixed Python 3.13 compatibility regarding urllib.parse module #66898 * make salt.channel.server.handle_message codepath more defensive #66909 * Fix the installation of pip modules with special characters in the module name #66988 * Repaired mount.fstab_present always returning pending changes #67065 * dictupdate.update: throw a TypeError when trying to merge a list with a mapping when merge_lists=True. #67092 * Remove usage of spwd #67119 * Fixed order chunks not handling a state with both require and order first or last #67120 * Fixed pkg.install in test mode would not detect FreeBSD packages installed by their origin name #67126 * Fix virtual grains for VMs running on Nutanix AHV #67180 * The redis refactor fixed the incorrect handling of the cache.list function. #67250 * Fixed creating relative directory symlinks on Windows, ensured listing targets of symlinks in file_roots always produces POSIX-style paths #67766 * Avoid loading salt.utils.crypt module instead of crypt if it's missing in Python as it was deprecated and removed in Python 3.13. #67797 * Fixed docstring error in salt/modules/file.py that misnamed an option "user" when it should have been "owner". #67911 * salt.key: check_minion_cache performance optimization #68030 * when a file is managed, and the same file is cleaned, an incorrect message is displayed saying "removed: Removed due to clean" when the file isn't actually removed. Now the correct message is returned. #68052 * log_beacon - remove verbose minion log output #68055 * Fix that the state saltmod.state can be used on a masterless minion with salt-ssh like saltmod.function currently does. #68116 * Fixed ssh_known_hosts.present failure when ssh host keys changed #68132 * grains.disks: fix exception with incompatible output of Get-PhysicalDisk #68184 * Made osfinger report major&minor version for NixOS #68230 * Fix tests failing on AlmaLinux 10 and other clones #68246 * Speedup wheel key.finger call by removing redundant processing calls. #68251 * Fixed cp.cache_file when using Tornado > 6.4 #68328 * Stop mutating locals, which is unsupported in Py >=3.13 #68445 * Add blockdev state module back in to core #68465 * #68465 * Adds the blockdev state module back into the core Salt repo as it is critical functionality that shouldn't have been pulled out in the module migration #68465 * Adds mdadm and lvm grains modules back in to core. #68470 * #68470 * Restores the modules that had been removed as part of the community module #68470 * migration. They are core bits of functionality and the associated execution and #68470 * states modules had not been removed. #68470 * Fixed grains.list_present state to correctly handle multiple calls within the same state run. #68520 * Fixed salt.utils.platform to properly handle __salt_system_encoding__ when synced as an extension module. #68520 * Improved network.traceroute parsing to be more robust across different traceroute versions. #68520 * Added retry logic to saltutil.wheel integration test to improve reliability in CI. #68520 * Improved architecture detection in salt-ssh to better support ARM64 platforms. #68520 * Fixed salt-ssh extension module syncing to avoid accidentally bundling core Salt modules and to correctly load wrapper modules. #68520 * Ensured salt-ssh relenv tests skip gracefully if the relenv tarball is unavailable in the test environment. #68520 * Fixed mine.get runner to correctly handle master's ID when ACLs are enabled. #68520 * Fixed win_useradd.get_user_sid to correctly handle non-string input. #68520 * Improved reliability of state.running integration test for salt-ssh. #68520 * Fixed high CPU usage in minion asynchronous authentication loop when masters are unreachable. #68520 * Added support for running Salt tools using python -m tools. #68520 * Adds alias state module back in to core. #68574 * #68574 * Restores the module that had been removed as part of the #68574 * community module migration. The associated execution module #68574 * had not been migrated. #68574 * Fixed mongodb tops module authentication to be compatible with pymongo v4+ by passing credentials directly to MongoClient instead of using the deprecated authenticate() method #68659 * Improved the rejected authentication warning message to include the minion ID, #68671 * making it easier for administrators to identify which minions need upgrading. #68671 * This PR fixes a bug where corrupted grains cache files cause unhandled #68678 * SaltDeserializationError exceptions, resulting in CRITICAL errors. #68678 * The fix adds proper exception handling to gracefully recover from corrupted #68678 * cache by regenerating grains. #68678 * Fix ansible.playbooks extra_vars quoting to prevent passing broken variables to ansible-playbook. #68787 * Make x86_64_v2 to be handled properly with salt.modules.yumpkg module as a possible package architecture. #68789 * Make salt-ssh work without issues using domain\user notation for remote user with SSH. #68790 * Fixed source package builds (DEB/RPM) failing with LookupError: hatchling is already being built by adding hatchling to the --only-binary allow-list so pip uses its universal wheel instead of attempting a circular source build. #68858 * Use a 30 second salt CLI timeout in the reauth scenario tests so Windows CI does not time out on test.ping after master/minion restart (default was often 5s). #68924 * Fix logging in potentially dead process in reap_stray_processes fixture #68927 * Fix dynamic version discovery on a new release branch before the first v<major>* tag exists: git describe still anchored on the previous line (e.g. v3007.13) is lifted to the unreleased codename baseline (e.g. 3008.0) while keeping the commit offset and SHA. #68964 * Remove deprecations. #68985 * - salt/auth/pki.py (removed) #68985 * - salt/features.py (removed) #68985 * - salt/modules/nxos.py (modified) #68985 * debpkg include 0/1 as valid options when parsing bool values in deb822 #68996 * Drain cancelled tasks on PublishClient close so the TCP transport no longer prints [ERROR ] Task was destroyed but it is pending! at the end of every salt command. #68998 * Upgrade packaged python to 3.14 #69014 * LoadAuth.get_tok now distinguishes between corrupt token blobs (removed from the store) and transient backend errors such as Redis connection drops or NFS hangs (token kept, request treated as not-authenticated). Previously a single backend hiccup could log every authenticated user out by deleting valid tokens. #69073 * Fix pip install -e salt #69101 * * Relenv 0.22.11 #69129 * - Update python 3.14 to 3.14.5 #69129 * - Update sqlite to 3.53.1.0 (CVE-2025-70873) #69129 * - Update expat to 2.8.1 (CVE-2026-41080 and CVE-2026-45186) #69129 * Fix master crash when presence_events: True is set on Python 3.14 by skipping the shared secrets dict during iter_transport_opts deepcopy. #69146 * Fixed lgpo_reg.value_absent failing when the Registry.pol entry was already absent but the registry value still existed. lgpo_reg.delete_value was returning early before reaching the registry cleanup code, causing the state to see no changes and report failure. The registry value is now removed regardless of whether the pol entry was present. #69203 * Fixed !!binary YAML tag failing with "Incorrect padding" when base64 padding characters are omitted. Salt's YAML loader now tolerates unpadded base64 values, restoring behavior that worked on Salt 3006 (Python 3.10). #69207 * Fixed the yaml Jinja filter returning NULL when applied to Pillar #69218 * lists or dicts. Pillar containers are wrapped in MaskedDict / #69218 * MaskedList for repr redaction; representers are now registered so the #69218 * YAML dumper serializes them as their underlying list / dict. #69218 # Added * Added proxy option to gitfs, git_pillar and winrepo for specifying a proxy server used to connect to git repositories #30990 * Added shadow.verify_password to salt.modules.win_shadow, which #41347 * validates a Windows user's password via LogonUser with #41347 * LOGON32_LOGON_NETWORK (Microsoft's recommended approach per #41347 * KB180548 <https://support.microsoft.com/en-us/help/180548>_) without #41347 * creating an interactive session. If the check causes an account lockout, #41347 * the account is automatically unlocked. Updated user.present on Windows #41347 * to use shadow.verify_password so the password is only changed when it #41347 * differs from the current value, matching the idempotent behaviour on other #41347 * platforms. #41347 * Added support for limiting the number of parallel states executing at the same time via state_max_parallel #49301 * Added metalink to mod_repo in yumpkg and documented in pkgrepo state #58931 * Add 'show_changes' arg for file.append and file.prepend states to hide output #59329 * Added ssl and verify_ssl arguments to mongodb module and states. #59927 * Added two new options, win_delay_start and win_install_dir, to pass to #61318 * the Windows installer in salt-cloud #61318 * Add context aware change handling for file state module #63328 * Added the ability to access already compiled pillar data during the pillar rendering process via the __pillar__ global in templates and matchers. #64043 * Allow salt-call arguments --file-root, --pillar-root and --states-dir to be specified multiple times #64486 * Adds documentation notes to clarify that Salt's file module only supports numeric mode specifications and does not support symbolic modes. #64624 * Added management of SSH keys and certificates #65197 * Add option (auth_events_autosign_grains) to add autosign_grains to auth events #65426 * Added use_os_truststore configuration option (default False) that instructs Salt to use the native operating system certificate store (Windows Certificate Store, macOS Keychain, or Linux system trust) for SSL/TLS verification instead of the bundled certifi CA bundle. Requires the truststore package (Python 3.10+). Also adds the ca_truststore grain that reports which store is active (certifi or os). #65439 * Enable "KeepAlive" probes for Salt SSH executions #65488 * Add ability to show diff for new files in file.managed #65546 * Added Virtuozzo Linux to Redhat os_family #65600 * Pillar dunder is now available in extension modules during pillar render. #65724 * Added x509_v2 SSH wrapper module. In addition to the regular calls, it provides a function for statefully managing remote certificates, even when access to the event bus is required #65728 * Introduce fibre_channel_host grain #65750 * Make salt-run jobs.master return runner jobs that are currently running on a master. #66007 * Added file and plaintext sources to gpg.present, allowed to skip keyserver queries #66173 * added pkg.which to aptpkg, for finding which package installed a file. #66201 * Allow pre-connection scripts to be run on host before any ssh commands #66210 * Added port, tls, username and password to the smtp configuration of the highstate returner. #66251 * Improve macOS defaults support #66466 * Added support for specifying different signature verification backends in file.managed/archive.extracted #66527 * Added an asymmetric execution module for signing/verifying data using raw asymmetric algorithms #66528 * Added support in service Beacon for only fire matching configured running state #66809 * Add --relenv Option to salt-ssh for Using a Onedir Bundled Salt+Python #66877 * Add support for state.sls_exists when using salt-ssh #66894 * Add detection for OS grains when running in AlmaLinux Kitten #66991 * Added a merge option to file.recurse, which merges subpaths from all existing sources before managing the directory. Handy when using different saltenvs or the TOFS pattern. #67072 * Add _auth calls to the master stats #67746 * Added possibility to load data from multiple inventories with ansible.targets. #67776 * Detect openEuler as RedHat family OS. #67796 * refactored server-side PKI to support cache interface #67799 * optimization: check_compound_minions: defer pki_minions fetch #67799 * refactor: push salt.utils.minions bits into salt.key / optimize matching #67799 * Add deb822 apt source format support to aptpkg module #67956 * Add subsystem filter to "udev.exportdb" execution module function #68047 * Implement SL Micro 6.2 detection to fill the grains with proper values. #68247 * Added booleans argument to selinux.booleans #68323 * Added mod_aggregate to selinux to combine boolean #68323 * Added some type hints to selinux module and made some minor changes to improve readability and performance slightly #68323 * Add support for minion_id in log formats #68410 * #68410 * Adds support for including %(minion_id)s in log formats. Where id is available log messages on the master will have that data added to allow easier correlation of messages to minions. #68410 * Added feature parity for relenv and thin dir with salt-ssh. All salt-ssh tests pass with both thin dir and relenv. #68531 * Added tunable worker pools: partition the master's MWorkers into named pools #68532 * and route specific commands (for example _auth) to dedicated pools so a #68532 * slow workload cannot starve time-critical traffic. Controlled by the new #68532 * worker_pools and worker_pools_enabled master settings; see the "Tunable #68532 * Worker Pools" topic guide for details. Existing worker_threads #68532 * configurations remain fully backward compatible. #68532 * Added TLS encryption optimization via disable_aes_with_tls config option that eliminates redundant AES encryption when TLS with mutual authentication is active, improving performance while maintaining security through certificate identity verification. #68536 * utils.dictdiffer: support diffing of dicts in lists #68726 * Add support for nix package manager. #68752 * Added a centralized, declarative system for managing Salt's optional dependencies and their version-specific requirements in salt/utils/versions.py. #68894 * Pillar data is now wrapped in SafeDict/SafeList with Pydantic SecretStr/SecretBytes for safer logging and output; optional state no_log and automatic redaction of pillar literals in state returns and minion job logs. #68907 * Added a fast memory-mapped cache backend (salt.cache.mmap_cache): #68936 * an O(1) hash-table store with a segmented heap, durable and multi-process #68936 * safe, usable as a drop-in for localfs via the cache master setting. #68936 * A specialised variant (salt.cache.mmap_key) replaces linear pki_dir #68936 * scans for the master's minion-key store; select it with #68936 * keys.cache_driver: mmap_key. Migrate existing data with #68936 * salt-run cache.migrate and salt-run pki.migrate_to_mmap. #68936 * Batch mode now uses a single JID for the entire batch run instead of generating #68941 * a separate JID per batch iteration. This enables unified job tracking via #68941 * salt-run jobs.lookup_jid and consistent --show-jid output across all #68941 * batch slices. The job cache merges minion lists from each iteration so that #68941 * get_load returns the complete set of targeted minions. #68941 * Added OpenTelemetry distributed-tracing support across all Salt #68999 * inter-process hops (network and IPC). When tracing.enabled is true in the #68999 * master/minion config, salt emits W3C-TraceContext-propagated spans via an #68999 * OTLP exporter, covering the CLI, channel layer, master workers, minion #68999 * command execution, event bus, reactor, syndic forwarding, salt-ssh, and #68999 * salt-api. Trace context travels inside the AES-encrypted Salt envelope so #68999 * it remains opaque on the wire. Tracing is opt-in and a complete no-op when #68999 * disabled. #68999 * Added a per-job start_event opt-in (CLI flag --start-event) that asks #69019 * targeted minions to fire a salt/job/<jid>/start/<minion_id> event the #69019 * moment they accept the published job, before the function runs. The payload #69019 * mirrors the master's salt/job/<jid>/new event minus the function #69019 * arguments, letting orchestrators confirm reachability without waiting for #69019 * the full return. #69019 * Added state.graph and state.graph_highstate execution modules and runners to generate a DOT representation of the state dependency graph. #69091 * Migrate Salt documentation to the PyData Sphinx theme. This update modernizes the documentation UI, improves navigation with a persistent sidebar tree, and fixes issues with embedded video playback. #69185 * Added OpenTelemetry metrics support alongside the existing tracing #69200 * integration. When metrics.enabled is true in the master/minion #69200 * config, salt daemons emit counters (salt.jobs.published, #69200 * salt.jobs.completed, salt.auth.attempts, salt.events.fired, #69200 * salt.returners.calls), histograms (salt.job.duration, #69200 * salt.minion.exec.duration), and observable gauges #69200 * (salt.master.connected_minions.count, #69200 * salt.master.workers.queue.depth, salt.process.open_fds) via #69200 * OTLP push or a Prometheus pull endpoint. Metrics are opt-in and a #69200 * complete no-op when disabled. See doc/topics/metrics/index.rst #69200 * for the full configuration surface and instrument inventory. #69200 * Restore the pillarstack ext_pillar module (salt.pillar.stack) that was #69201 * removed when community extensions were purged. The module is reinstated as a #69201 * core ext_pillar so existing PillarStack-based pillar trees continue to work on #69201 * 3008.x. #69201 * Added lgpo_reg.get_rsop_value to query the Resultant Set of Policy (RSoP) for a registry key/value and detect whether it is managed by a Domain Group Policy Object. The lgpo_reg module functions set_value, disable_value, and delete_value now log a warning when a Domain GPO is detected for the target value. The lgpo_reg state functions value_present, value_disabled, and value_absent append the same warning to the state comment so it is visible in state output. #69205 -- Salt Project Packaging [email protected] Wed, 27 May 2026 10:08:12 +0000 salt (3008.0~rc4) stable; urgency=medium # Removed * Remove commuity extensions from Salt codebase #65970 * Remove deprecated module search path priority (features.enable_deprecated_module_search_path_priority) #66025 * Remove the orchestration key from salt.runner and salt.wheel return data. #66151 * Removed linode-python package dependency for retired Linode API v3 #68871 * Removed legacy salt.transport.ipc module and unused PushChannel / PullChannel factories; local events use ipc_publish_client / ipc_publish_server (TCP transport). #69001 # Deprecated * Deprecated the use of egrep in favor of grep -E #65608 # Changed * Make sure every auth event has the 'act' key set #56200 * Ansiblegate discover_playbooks was changed to find playbooks as either *.yml or *.yaml files #66048 * re-work the aptpkg module to remove system libraries that onedir and virtualenvs do not have access. Streamline testing, and code use to needed libraries only. #66056 * Made gpg modules respect user's GNUPGHOME if set in shell environment #66313 * Made gpg.present attempt to refresh keys if they are expired #66314 * Made x509_v2 the default x509 modules. Until they are removed in the next major release, you can still revert to the old modules by setting features: {x509_v2: false} in the configuration #66384 * Included Salt extensions in Salt-SSH thin archive #66559 * Add support for additional options in several mac_brew_pkg methods #66611 * Make test_pip and test_fileserver tests compatible with venv execution #66703 * Do not use ssl.PROTOCOL_TLS which has been #66767 * deprecated in #66767 * Python 3.10 will be removed in the future. #66767 * Remove warning when running slsutil.renderer on non-SLS files #67067 * PillarCache: reimplement using salt.cache #68030 * fix minion data cache organization/move pillar and grains to dedicated cache banks #68030 * salt.cache: allow cache.store() to set expires per key #68030 * Provide token storage using the salt.cache interface #68039 * Update packaged python from 3.10 to 3.11 #68148 * Added ceph to the specialFSes to match on name for set_fstab #68207 * Removed networkx module dependency by adding MultiDiGraph implementation to salt.utils.requisite to avoid extra dependencies. #68748 * Expanded Thorium documentation with concrete examples and added unit coverage for the documented Thorium workflows. #68857 * Add stub 3008.0 release notes (and template) so tools docs man and CI prepare-release can resolve the current-release doc target. Exclude doc/topics/proposals/*.md from Sphinx so stand-alone proposal files do not fail strict man builds. #68964 # Fixed * Fixed recursive prereq requisites to report recursive requisite error. #8210 * Fixed erroneous recursive requisite error when a prereq is used in combination with onchanges_any. #47154 * Fixed an infinite loop in requisite_any when a requisite state was not found. #50436 * Fixed dependency resolution to not be quadratic. #59123 * Fix regex cache exception during sort in sweep function #59437 * Fixed requisites by parallel states on parallel states being evaluated synchronously (blocking state execution for other parallel states) #59959 * Fix bug when specifying template_source using net.load_template #60515 * firewalld: normalize new rich rules before comparing to old ones #61235 * Fix regression that prevented salt-minion from running interval-based jobs on startup by default. #61964 * Fixed performance when state_aggregate is enabled. #62439 * Fixed issue with salt-ssh hanging due to non-exposed host key acceptance prompt #62782 * Repaired zypper repositories being reconfigured without changes #63402 * Fix calculation of SLS context vars when trailing dots on targetted state #63411 * Put default optimization_order to LazyLoader to prevent possible fails on testing #65266 * Fixed aggregation to correctly honor requisites. #65304 * Fixed some instances of deprecated datetime.datetime.utcnow() #65604 * Introduce pruning option in file.keyvalue #65631 * fix 65703 by using OrderedDict instead of a index that breaks. . #65703 * Simplify timezone.compare_zone to primarily rely get_zone() #65719 * Handle regular expressions which do not not use grouping #65722 * fix consul.acl_create rule creation #65788 * Fix salt-cloud get_cloud_config_value for list objects #65789 * Prevent exceptions with fileserver.update when called via state #65819 * Fix granting of privileges on Postgres functions #65839 * Made Salt Cloud Hetzner module detect image architecture from instance type #65888 * Optimize async calls with using async wrapped method in thread only if io loop is already running #65983 * salt.auth.pam: fallback to use running Python in case /usr/bin/python3 is not found #66035 * Fix file.is_link hangs on paths that are hung mounts #66096 * Fix file.managed and file.serialize default tmp_dir to relative path #66098 * Make win_timezone recognize Qyzylorda timezone #66176 * Remove firing useless events with JID as a tag #66279 * Made gpg modules create GNUPGHOME if it does not exist #66312 * Fixed an issue where conflicting top level keys in the static grains file #66445 * (usually /etc/salt/grains) would break all grains states, and prevent static #66445 * grains from being loaded. #66445 * Fixed beacon delete not calling the beacon's close function, causing resource #66449 * leaks (e.g. inotify file descriptors) and CPU spin after deleting beacons at #66449 * runtime via beacons.delete. Also fixed inotify file descriptor leak during #66449 * beacon refresh when the Beacon instance is replaced. #66449 * Make "status.diskusage" more robust and prevent crashes when stats cannot be obtained #66646 * Use --cachedir parameter for setting extension_modules with salt-call. #66742 * Don't schedule __master_alive jobs if master_alive_interval is not specified #66757 * Make x509 module compatible with cryptography module newer than 43.0.0 #66818 * Fixed Python 3.13 compatibility regarding urllib.parse module #66898 * make salt.channel.server.handle_message codepath more defensive #66909 * Fix the installation of pip modules with special characters in the module name #66988 * Repaired mount.fstab_present always returning pending changes #67065 * dictupdate.update: throw a TypeError when trying to merge a list with a mapping when merge_lists=True. #67092 * Remove usage of spwd #67119 * Fixed order chunks not handling a state with both require and order first or last #67120 * Fixed pkg.install in test mode would not detect FreeBSD packages installed by their origin name #67126 * Fix virtual grains for VMs running on Nutanix AHV #67180 * Fixed creating relative directory symlinks on Windows, ensured listing targets of symlinks in file_roots always produces POSIX-style paths #67766 * Avoid loading salt.utils.crypt module instead of crypt if it's missing in Python as it was deprecated and removed in Python 3.13. #67797 * Fixed docstring error in salt/modules/file.py that misnamed an option "user" when it should have been "owner". #67911 * salt.key: check_minion_cache performance optimization #68030 * when a file is managed, and the same file is cleaned, an incorrect message is displayed saying "removed: Removed due to clean" when the file isn't actually removed. Now the correct message is returned. #68052 * log_beacon - remove verbose minion log output #68055 * Fix that the state saltmod.state can be used on a masterless minion with salt-ssh like saltmod.function currently does. #68116 * Fixed ssh_known_hosts.present failure when ssh host keys changed #68132 * grains.disks: fix exception with incompatible output of Get-PhysicalDisk #68184 * Made osfinger report major&minor version for NixOS #68230 * Fix tests failing on AlmaLinux 10 and other clones #68246 * Speedup wheel key.finger call by removing redundant processing calls. #68251 * Fixed cp.cache_file when using Tornado > 6.4 #68328 * Fixed multiline powershell -Command { } blocks failing with "Missing closing #68397 * '}'" when used in a cmd.run state on Windows. Salt now collapses embedded #68397 * newlines and re-encodes the script block as -EncodedCommand, ensuring correct #68397 * execution and suppressing CLIXML noise from stderr. #68397 * Stop mutating locals, which is unsupported in Py >=3.13 #68445 * Add blockdev state module back in to core #68465 * #68465 * Adds the blockdev state module back into the core Salt repo as it is critical functionality that shouldn't have been pulled out in the module migration #68465 * Adds mdadm and lvm grains modules back in to core. #68470 * #68470 * Restores the modules that had been removed as part of the community module #68470 * migration. They are core bits of functionality and the associated execution and #68470 * states modules had not been removed. #68470 * Fixed grains.list_present state to correctly handle multiple calls within the same state run. #68520 * Fixed salt.utils.platform to properly handle __salt_system_encoding__ when synced as an extension module. #68520 * Improved network.traceroute parsing to be more robust across different traceroute versions. #68520 * Added retry logic to saltutil.wheel integration test to improve reliability in CI. #68520 * Improved architecture detection in salt-ssh to better support ARM64 platforms. #68520 * Fixed salt-ssh extension module syncing to avoid accidentally bundling core Salt modules and to correctly load wrapper modules. #68520 * Ensured salt-ssh relenv tests skip gracefully if the relenv tarball is unavailable in the test environment. #68520 * Fixed mine.get runner to correctly handle master's ID when ACLs are enabled. #68520 * Fixed win_useradd.get_user_sid to correctly handle non-string input. #68520 * Improved reliability of state.running integration test for salt-ssh. #68520 * Fixed high CPU usage in minion asynchronous authentication loop when masters are unreachable. #68520 * Added support for running Salt tools using python -m tools. #68520 * Adds alias state module back in to core. #68574 * #68574 * Restores the module that had been removed as part of the #68574 * community module migration. The associated execution module #68574 * had not been migrated. #68574 * Fixed mongodb tops module authentication to be compatible with pymongo v4+ by passing credentials directly to MongoClient instead of using the deprecated authenticate() method #68659 * Improved the rejected authentication warning message to include the minion ID, #68671 * making it easier for administrators to identify which minions need upgrading. #68671 * This PR fixes a bug where corrupted grains cache files cause unhandled #68678 * SaltDeserializationError exceptions, resulting in CRITICAL errors. #68678 * The fix adds proper exception handling to gracefully recover from corrupted #68678 * cache by regenerating grains. #68678 * Fix ansible.playbooks extra_vars quoting to prevent passing broken variables to ansible-playbook. #68787 * Make x86_64_v2 to be handled properly with salt.modules.yumpkg module as a possible package architecture. #68789 * Make salt-ssh work without issues using domain\user notation for remote user with SSH. #68790 * Fixed source package builds (DEB/RPM) failing with LookupError: hatchling is already being built by adding hatchling to the --only-binary allow-list so pip uses its universal wheel instead of attempting a circular source build. #68858 * Use a 30 second salt CLI timeout in the reauth scenario tests so Windows CI does not time out on test.ping after master/minion restart (default was often 5s). #68924 * Fix logging in potentially dead process in reap_stray_processes fixture #68927 * Fixed a regression in win_pkg where msiexec install flags containing #68950 * Windows-style quoting (e.g. MYPROPERTY="C:\some file.txt") were #68950 * mangled into "MYPROPERTY=C:\some file.txt" causing msiexec to hang. #68950 * Restored the pre-regression behaviour where shlex_split is not applied #68950 * to command strings on Windows, preserving Windows-style argument quoting #68950 * when the command is passed directly to CreateProcess. #68950 * Fix dynamic version discovery on a new release branch before the first v<major>* tag exists: git describe still anchored on the previous line (e.g. v3007.13) is lifted to the unreleased codename baseline (e.g. 3008.0) while keeping the commit offset and SHA. #68964 * Remove deprecations. #68985 * - salt/auth/pki.py (removed) #68985 * - salt/features.py (removed) #68985 * - salt/modules/nxos.py (modified) #68985 * Upgrade packaged python to 3.14 #69014 * Fix pip install -e salt #69101 * * Relenv 0.22.11 #69129 * - Update python 3.14 to 3.14.5 #69129 * - Update sqlite to 3.53.1.0 (CVE-2025-70873) #69129 * - Update expat to 2.8.1 (CVE-2026-41080 and CVE-2026-45186) #69129 * Fix master crash when presence_events: True is set on Python 3.14 by skipping the shared secrets dict during iter_transport_opts deepcopy. #69146 # Added * Added proxy option to gitfs, git_pillar and winrepo for specifying a proxy server used to connect to git repositories #30990 * Added shadow.verify_password to salt.modules.win_shadow, which #41347 * validates a Windows user's password via LogonUser with #41347 * LOGON32_LOGON_NETWORK (Microsoft's recommended approach per #41347 * KB180548 <https://support.microsoft.com/en-us/help/180548>) without #41347 * creating an interactive session. If the check causes an account lockout, #41347 * the account is automatically unlocked. Updated user.present on Windows #41347 * to use shadow.verify_password so the password is only changed when it #41347 * differs from the current value, matching the idempotent behaviour on other #41347 * platforms. #41347 * Added support for limiting the number of parallel states executing at the same time via state_max_parallel #49301 * Added metalink to mod_repo in yumpkg and documented in pkgrepo state #58931 * Added ssl and verify_ssl arguments to mongodb module and states. #59927 * Added two new options, win_delay_start and win_install_dir, to pass to #61318 * the Windows installer in salt-cloud #61318 * Add context aware change handling for file state module #63328 * Added the ability to access already compiled pillar data during the pillar rendering process via the __pillar__ global in templates and matchers. #64043 * Allow salt-call arguments --file-root, --pillar-root and --states-dir to be specified multiple times #64486 * Adds documentation notes to clarify that Salt's file module only supports numeric mode specifications and does not support symbolic modes. #64624 * Added management of SSH keys and certificates #65197 * Add option (auth_events_autosign_grains) to add autosign_grains to auth events #65426 * Enable "KeepAlive" probes for Salt SSH executions #65488 * Add ability to show diff for new files in file.managed #65546 * Added Virtuozzo Linux to Redhat os_family #65600 * Pillar dunder is now available in extension modules during pillar render. #65724 * Added x509_v2 SSH wrapper module. In addition to the regular calls, it provides a function for statefully managing remote certificates, even when access to the event bus is required #65728 * Introduce fibre_channel_host grain #65750 * Make salt-run jobs.master return runner jobs that are currently running on a master. #66007 * Added file and plaintext sources to gpg.present, allowed to skip keyserver queries #66173 * added pkg.which to aptpkg, for finding which package installed a file. #66201 * Allow pre-connection scripts to be run on host before any ssh commands #66210 * Added port, tls, username and password to the smtp configuration of the highstate returner. #66251 * Improve macOS defaults support #66466 * Added support for specifying different signature verification backends in file.managed/archive.extracted #66527 * Added an asymmetric execution module for signing/verifying data using raw asymmetric algorithms #66528 * Added support in service Beacon for only fire matching configured running state #66809 * Add --relenv Option to salt-ssh for Using a Onedir Bundled Salt+Python #66877 * Add support for state.sls_exists when using salt-ssh #66894 * Add detection for OS grains when running in AlmaLinux Kitten #66991 * Added a merge option to file.recurse, which merges subpaths from all existing sources before managing the directory. Handy when using different saltenvs or the TOFS pattern. #67072 * Add _auth calls to the master stats #67746 * Added possibility to load data from multiple inventories with ansible.targets. #67776 * Detect openEuler as RedHat family OS. #67796 * refactored server-side PKI to support cache interface #67799 * optimization: check_compound_minions: defer _pki_minions fetch #67799 * refactor: push salt.utils.minions bits into salt.key / optimize matching #67799 * Add deb822 apt source format support to aptpkg module #67956 * Add subsystem filter to "udev.exportdb" execution module function #68047 * Implement SL Micro 6.2 detection to fill the grains with proper values. #68247 * Added booleans argument to selinux.booleans #68323 * Added mod_aggregate to selinux to combine boolean #68323 * Added some type hints to selinux module and made some minor changes to improve readability and performance slightly #68323 * Add support for minion_id in log formats #68410 * #68410 * Adds support for including %(minion_id)s in log formats. Where id is available log messages on the master will have that data added to allow easier correlation of messages to minions. #68410 * Added feature parity for relenv and thin dir with salt-ssh. All salt-ssh tests pass with both thin dir and relenv. #68531 * Added tunable worker pools: partition the master's MWorkers into named pools #68532 * and route specific commands (for example _auth) to dedicated pools so a #68532 * slow workload cannot starve time-critical traffic. Controlled by the new #68532 * worker_pools and worker_pools_enabled master settings; see the "Tunable #68532 * Worker Pools" topic guide for details. Existing worker_threads #68532 * configurations remain fully backward compatible. #68532 * Added TLS encryption optimization via disable_aes_with_tls config option that eliminates redundant AES encryption when TLS with mutual authentication is active, improving performance while maintaining security through certificate identity verification. #68536 * utils.dictdiffer: support diffing of dicts in lists #68726 * Add support for nix package manager. #68752 * Added a centralized, declarative system for managing Salt's optional dependencies and their version-specific requirements in salt/utils/versions.py. #68894 * Pillar data is now wrapped in SafeDict/SafeList with Pydantic SecretStr/SecretBytes for safer logging and output; optional state no_log and automatic redaction of pillar literals in state returns and minion job logs. #68907 * Added a fast memory-mapped cache backend (salt.cache.mmap_cache): #68936 * an O(1) hash-table store with a segmented heap, durable and multi-process #68936 * safe, usable as a drop-in for localfs via the cache master setting. #68936 * A specialised variant (salt.cache.mmap_key) replaces linear pki_dir #68936 * scans for the master's minion-key store; select it with #68936 * keys.cache_driver: mmap_key. Migrate existing data with #68936 * salt-run cache.migrate and salt-run pki.migrate_to_mmap. #68936 * Batch mode now uses a single JID for the entire batch run instead of generating #68941 * a separate JID per batch iteration. This enables unified job tracking via #68941 * salt-run jobs.lookup_jid and consistent --show-jid output across all #68941 * batch slices. The job cache merges minion lists from each iteration so that #68941 * get_load returns the complete set of targeted minions. #68941 * Added a per-job start_event opt-in (CLI flag --start-event) that asks #69019 * targeted minions to fire a salt/job/<jid>/start/<minion_id> event the #69019 * moment they accept the published job, before the function runs. The payload #69019 * mirrors the master's salt/job/<jid>/new event minus the function #69019 * arguments, letting orchestrators confirm reachability without waiting for #69019 * the full return. #69019 * Added state.graph and state.graph_highstate execution modules and runners to generate a DOT representation of the state dependency graph. #69091 -- Salt Project Packaging [email protected] Fri, 15 May 2026 11:27:33 +0000 salt (3008.0~rc3) stable; urgency=medium # Removed * Remove commuity extensions from Salt codebase #65970 * Remove deprecated module search path priority (features.enable_deprecated_module_search_path_priority) #66025 * Remove the orchestration key from salt.runner and salt.wheel return data. #66151 * Removed linode-python package dependency for retired Linode API v3 #68871 * Removed legacy salt.transport.ipc module and unused PushChannel / PullChannel factories; local events use ipc_publish_client / ipc_publish_server (TCP transport). #69001 # Deprecated * Deprecated the use of egrep in favor of grep -E #65608 # Changed * Make sure every auth event has the 'act' key set #56200 * Ansiblegate discover_playbooks was changed to find playbooks as either *.yml or *.yaml files #66048 * re-work the aptpkg module to remove system libraries that onedir and virtualenvs do not have access. Streamline testing, and code use to needed libraries only. #66056 * Made gpg modules respect user's GNUPGHOME if set in shell environment #66313 * Made gpg.present attempt to refresh keys if they are expired #66314 * Made x509_v2 the default x509 modules. Until they are removed in the next major release, you can still revert to the old modules by setting features: {x509_v2: false} in the configuration #66384 * Included Salt extensions in Salt-SSH thin archive #66559 * Add support for additional options in several mac_brew_pkg methods #66611 * Make test_pip and test_fileserver tests compatible with venv execution #66703 * Do not use ssl.PROTOCOL_TLS which has been #66767 * deprecated in #66767 * Python 3.10 will be removed in the future. #66767 * Remove warning when running slsutil.renderer on non-SLS files #67067 * PillarCache: reimplement using salt.cache #68030 * fix minion data cache organization/move pillar and grains to dedicated cache banks #68030 * salt.cache: allow cache.store() to set expires per key #68030 * Provide token storage using the salt.cache interface #68039 * Update packaged python from 3.10 to 3.11 #68148 * Added ceph to the specialFSes to match on name for set_fstab #68207 * Removed networkx module dependency by adding MultiDiGraph implementation to salt.utils.requisite to avoid extra dependencies. #68748 * Expanded Thorium documentation with concrete examples and added unit coverage for the documented Thorium workflows. #68857 * Add stub 3008.0 release notes (and template) so tools docs man and CI prepare-release can resolve the current-release doc target. Exclude doc/topics/proposals/*.md from Sphinx so stand-alone proposal files do not fail strict man builds. #68964 # Fixed * Fixed recursive prereq requisites to report recursive requisite error. #8210 * Fixed erroneous recursive requisite error when a prereq is used in combination with onchanges_any. #47154 * Fixed an infinite loop in requisite_any when a requisite state was not found. #50436 * Fixed dependency resolution to not be quadratic. #59123 * Fix regex cache exception during sort in sweep function #59437 * Fixed requisites by parallel states on parallel states being evaluated synchronously (blocking state execution for other parallel states) #59959 * Fix bug when specifying template_source using net.load_template #60515 * firewalld: normalize new rich rules before comparing to old ones #61235 * Fix regression that prevented salt-minion from running interval-based jobs on startup by default. #61964 * Fixed performance when state_aggregate is enabled. #62439 * Fixed issue with salt-ssh hanging due to non-exposed host key acceptance prompt #62782 * Repaired zypper repositories being reconfigured without changes #63402 * Fix calculation of SLS context vars when trailing dots on targetted state #63411 * Put default optimization_order to LazyLoader to prevent possible fails on testing #65266 * Fixed aggregation to correctly honor requisites. #65304 * Fixed some instances of deprecated datetime.datetime.utcnow() #65604 * Introduce pruning option in file.keyvalue #65631 * fix 65703 by using OrderedDict instead of a index that breaks. . #65703 * Simplify timezone.compare_zone to primarily rely get_zone() #65719 * Handle regular expressions which do not not use grouping #65722 * fix consul.acl_create rule creation #65788 * Fix salt-cloud get_cloud_config_value for list objects #65789 * Prevent exceptions with fileserver.update when called via state #65819 * Fix granting of privileges on Postgres functions #65839 * Made Salt Cloud Hetzner module detect image architecture from instance type #65888 * Optimize async calls with using async wrapped method in thread only if io loop is already running #65983 * salt.auth.pam: fallback to use running Python in case /usr/bin/python3 is not found #66035 * Fix file.is_link hangs on paths that are hung mounts #66096 * Fix file.managed and file.serialize default tmp_dir to relative path #66098 * Make win_timezone recognize Qyzylorda timezone #66176 * Remove firing useless events with JID as a tag #66279 * Made gpg modules create GNUPGHOME if it does not exist #66312 * Fixed an issue where conflicting top level keys in the static grains file #66445 * (usually /etc/salt/grains) would break all grains states, and prevent static #66445 * grains from being loaded. #66445 * Fixed beacon delete not calling the beacon's close function, causing resource #66449 * leaks (e.g. inotify file descriptors) and CPU spin after deleting beacons at #66449 * runtime via beacons.delete. Also fixed inotify file descriptor leak during #66449 * beacon refresh when the Beacon instance is replaced. #66449 * Make "status.diskusage" more robust and prevent crashes when stats cannot be obtained #66646 * Use --cachedir parameter for setting extension_modules with salt-call. #66742 * Don't schedule __master_alive jobs if master_alive_interval is not specified #66757 * Make x509 module compatible with cryptography module newer than 43.0.0 #66818 * Fixed Python 3.13 compatibility regarding urllib.parse module #66898 * make salt.channel.server.handle_message codepath more defensive #66909 * Fix the installation of pip modules with special characters in the module name #66988 * Repaired mount.fstab_present always returning pending changes #67065 * dictupdate.update: throw a TypeError when trying to merge a list with a mapping when merge_lists=True. #67092 * Remove usage of spwd #67119 * Fixed order chunks not handling a state with both require and order first or last #67120 * Fixed pkg.install in test mode would not detect FreeBSD packages installed by their origin name #67126 * Fix virtual grains for VMs running on Nutanix AHV #67180 * Fixed creating relative directory symlinks on Windows, ensured listing targets of symlinks in file_roots always produces POSIX-style paths #67766 * Avoid loading salt.utils.crypt module instead of crypt if it's missing in Python as it was deprecated and removed in Python 3.13. #67797 * Fixed docstring error in salt/modules/file.py that misnamed an option "user" when it should have been "owner". #67911 * salt.key: check_minion_cache performance optimization #68030 * when a file is managed, and the same file is cleaned, an incorrect message is displayed saying "removed: Removed due to clean" when the file isn't actually removed. Now the correct message is returned. #68052 * log_beacon - remove verbose minion log output #68055 * Fix that the state saltmod.state can be used on a masterless minion with salt-ssh like saltmod.function currently does. #68116 * Fixed ssh_known_hosts.present failure when ssh host keys changed #68132 * grains.disks: fix exception with incompatible output of Get-PhysicalDisk #68184 * Made osfinger report major&minor version for NixOS #68230 * Fix tests failing on AlmaLinux 10 and other clones #68246 * Speedup wheel key.finger call by removing redundant processing calls. #68251 * Fixed cp.cache_file when using Tornado > 6.4 #68328 * Fixed multiline powershell -Command { } blocks failing with "Missing closing #68397 * '}'" when used in a cmd.run state on Windows. Salt now collapses embedded #68397 * newlines and re-encodes the script block as -EncodedCommand, ensuring correct #68397 * execution and suppressing CLIXML noise from stderr. #68397 * Stop mutating locals, which is unsupported in Py >=3.13 #68445 * Add blockdev state module back in to core #68465 * #68465 * Adds the blockdev state module back into the core Salt repo as it is critical functionality that shouldn't have been pulled out in the module migration #68465 * Adds mdadm and lvm grains modules back in to core. #68470 * #68470 * Restores the modules that had been removed as part of the community module #68470 * migration. They are core bits of functionality and the associated execution and #68470 * states modules had not been removed. #68470 * Fixed grains.list_present state to correctly handle multiple calls within the same state run. #68520 * Fixed salt.utils.platform to properly handle __salt_system_encoding__ when synced as an extension module. #68520 * Improved network.traceroute parsing to be more robust across different traceroute versions. #68520 * Added retry logic to saltutil.wheel integration test to improve reliability in CI. #68520 * Improved architecture detection in salt-ssh to better support ARM64 platforms. #68520 * Fixed salt-ssh extension module syncing to avoid accidentally bundling core Salt modules and to correctly load wrapper modules. #68520 * Ensured salt-ssh relenv tests skip gracefully if the relenv tarball is unavailable in the test environment. #68520 * Fixed mine.get runner to correctly handle master's ID when ACLs are enabled. #68520 * Fixed win_useradd.get_user_sid to correctly handle non-string input. #68520 * Improved reliability of state.running integration test for salt-ssh. #68520 * Fixed high CPU usage in minion asynchronous authentication loop when masters are unreachable. #68520 * Added support for running Salt tools using python -m tools. #68520 * Adds alias state module back in to core. #68574 * #68574 * Restores the module that had been removed as part of the #68574 * community module migration. The associated execution module #68574 * had not been migrated. #68574 * Fixed mongodb tops module authentication to be compatible with pymongo v4+ by passing credentials directly to MongoClient instead of using the deprecated authenticate() method #68659 * Improved the rejected authentication warning message to include the minion ID, #68671 * making it easier for administrators to identify which minions need upgrading. #68671 * This PR fixes a bug where corrupted grains cache files cause unhandled #68678 * SaltDeserializationError exceptions, resulting in CRITICAL errors. #68678 * The fix adds proper exception handling to gracefully recover from corrupted #68678 * cache by regenerating grains. #68678 * Fix ansible.playbooks extra_vars quoting to prevent passing broken variables to ansible-playbook. #68787 * Make x86_64_v2 to be handled properly with salt.modules.yumpkg module as a possible package architecture. #68789 * Make salt-ssh work without issues using domain\user notation for remote user with SSH. #68790 * Fixed source package builds (DEB/RPM) failing with LookupError: hatchling is already being built by adding hatchling to the --only-binary allow-list so pip uses its universal wheel instead of attempting a circular source build. #68858 * Use a 30 second salt CLI timeout in the reauth scenario tests so Windows CI does not time out on test.ping after master/minion restart (default was often 5s). #68924 * Fix logging in potentially dead process in reap_stray_processes fixture #68927 * Fixed a regression in win_pkg where msiexec install flags containing #68950 * Windows-style quoting (e.g. MYPROPERTY="C:\some file.txt") were #68950 * mangled into "MYPROPERTY=C:\some file.txt" causing msiexec to hang. #68950 * Restored the pre-regression behaviour where shlex_split is not applied #68950 * to command strings on Windows, preserving Windows-style argument quoting #68950 * when the command is passed directly to CreateProcess. #68950 * Fix dynamic version discovery on a new release branch before the first v<major>* tag exists: git describe still anchored on the previous line (e.g. v3007.13) is lifted to the unreleased codename baseline (e.g. 3008.0) while keeping the commit offset and SHA. #68964 * Remove deprecations. #68985 * - salt/auth/pki.py (removed) #68985 * - salt/features.py (removed) #68985 * - salt/modules/nxos.py (modified) #68985 * Upgrade packaged python to 3.14 #69014 * Fix pip install -e salt #69101 * * Relenv 0.22.11 #69129 * - Update python 3.14 to 3.14.5 #69129 * - Update sqlite to 3.53.1.0 (CVE-2025-70873) #69129 * - Update expat to 2.8.1 (CVE-2026-41080 and CVE-2026-45186) #69129 # Added * Added proxy option to gitfs, git_pillar and winrepo for specifying a proxy server used to connect to git repositories #30990 * Added support for limiting the number of parallel states executing at the same time via state_max_parallel #49301 * Added metalink to mod_repo in yumpkg and documented in pkgrepo state #58931 * Added ssl and verify_ssl arguments to mongodb module and states. #59927 * Added two new options, win_delay_start and win_install_dir, to pass to #61318 * the Windows installer in salt-cloud #61318 * Add context aware change handling for file state module #63328 * Added the ability to access already compiled pillar data during the pillar rendering process via the __pillar__ global in templates and matchers. #64043 * Allow salt-call arguments --file-root, --pillar-root and --states-dir to be specified multiple times #64486 * Adds documentation notes to clarify that Salt's file module only supports numeric mode specifications and does not support symbolic modes. #64624 * Added management of SSH keys and certificates #65197 * Add option (auth_events_autosign_grains) to add autosign_grains to auth events #65426 * Enable "KeepAlive" probes for Salt SSH executions #65488 * Add ability to show diff for new files in file.managed #65546 * Added Virtuozzo Linux to Redhat os_family #65600 * Pillar dunder is now available in extension modules during pillar render. #65724 * Added x509_v2 SSH wrapper module. In addition to the regular calls, it provides a function for statefully managing remote certificates, even when access to the event bus is required #65728 * Introduce fibre_channel_host grain #65750 * Make salt-run jobs.master return runner jobs that are currently running on a master. #66007 * Added file and plaintext sources to gpg.present, allowed to skip keyserver queries #66173 * added pkg.which to aptpkg, for finding which package installed a file. #66201 * Allow pre-connection scripts to be run on host before any ssh commands #66210 * Added port, tls, username and password to the smtp configuration of the highstate returner. #66251 * Improve macOS defaults support #66466 * Added support for specifying different signature verification backends in file.managed/archive.extracted #66527 * Added an asymmetric execution module for signing/verifying data using raw asymmetric algorithms #66528 * Added support in service Beacon for only fire matching configured running state #66809 * Add --relenv Option to salt-ssh for Using a Onedir Bundled Salt+Python #66877 * Add support for state.sls_exists when using salt-ssh #66894 * Add detection for OS grains when running in AlmaLinux Kitten #66991 * Added a merge option to file.recurse, which merges subpaths from all existing sources before managing the directory. Handy when using different saltenvs or the TOFS pattern. #67072 * Add _auth calls to the master stats #67746 * Added possibility to load data from multiple inventories with ansible.targets. #67776 * Detect openEuler as RedHat family OS. #67796 * refactored server-side PKI to support cache interface #67799 * optimization: check_compound_minions: defer _pki_minions fetch #67799 * refactor: push salt.utils.minions bits into salt.key / optimize matching #67799 * Add deb822 apt source format support to aptpkg module #67956 * Add subsystem filter to "udev.exportdb" execution module function #68047 * Implement SL Micro 6.2 detection to fill the grains with proper values. #68247 * Added booleans argument to selinux.booleans #68323 * Added mod_aggregate to selinux to combine boolean #68323 * Added some type hints to selinux module and made some minor changes to improve readability and performance slightly #68323 * Add support for minion_id in log formats #68410 * #68410 * Adds support for including %(minion_id)s in log formats. Where id is available log messages on the master will have that data added to allow easier correlation of messages to minions. #68410 * Added feature parity for relenv and thin dir with salt-ssh. All salt-ssh tests pass with both thin dir and relenv. #68531 * Added tunable worker pools: partition the master's MWorkers into named pools #68532 * and route specific commands (for example _auth) to dedicated pools so a #68532 * slow workload cannot starve time-critical traffic. Controlled by the new #68532 * worker_pools and worker_pools_enabled master settings; see the "Tunable #68532 * Worker Pools" topic guide for details. Existing worker_threads #68532 * configurations remain fully backward compatible. #68532 * Added TLS encryption optimization via disable_aes_with_tls config option that eliminates redundant AES encryption when TLS with mutual authentication is active, improving performance while maintaining security through certificate identity verification. #68536 * utils.dictdiffer: support diffing of dicts in lists #68726 * Add support for nix package manager. #68752 * Added a centralized, declarative system for managing Salt's optional dependencies and their version-specific requirements in salt/utils/versions.py. #68894 * Pillar data is now wrapped in SafeDict/SafeList with Pydantic SecretStr/SecretBytes for safer logging and output; optional state no_log and automatic redaction of pillar literals in state returns and minion job logs. #68907 * Added a fast memory-mapped cache backend (salt.cache.mmap_cache): #68936 * an O(1) hash-table store with a segmented heap, durable and multi-process #68936 * safe, usable as a drop-in for localfs via the cache master setting. #68936 * A specialised variant (salt.cache.mmap_key) replaces linear pki_dir #68936 * scans for the master's minion-key store; select it with #68936 * keys.cache_driver: mmap_key. Migrate existing data with #68936 * salt-run cache.migrate and salt-run pki.migrate_to_mmap. #68936 * Batch mode now uses a single JID for the entire batch run instead of generating #68941 * a separate JID per batch iteration. This enables unified job tracking via #68941 * salt-run jobs.lookup_jid and consistent --show-jid output across all #68941 * batch slices. The job cache merges minion lists from each iteration so that #68941 * get_load returns the complete set of targeted minions. #68941 * Added a per-job start_event opt-in (CLI flag --start-event) that asks #69019 * targeted minions to fire a salt/job/<jid>/start/<minion_id> event the #69019 * moment they accept the published job, before the function runs. The payload #69019 * mirrors the master's salt/job/<jid>/new event minus the function #69019 * arguments, letting orchestrators confirm reachability without waiting for #69019 * the full return. #69019 * Added state.graph and state.graph_highstate execution modules and runners to generate a DOT representation of the state dependency graph. #69091 -- Salt Project Packaging [email protected] Wed, 13 May 2026 10:33:51 +0000 salt (3008.0~rc2) stable; urgency=medium # Removed * Remove commuity extensions from Salt codebase #65970 * Remove deprecated module search path priority (features.enable_deprecated_module_search_path_priority) #66025 * Remove the orchestration key from salt.runner and salt.wheel return data. #66151 * Removed linode-python package dependency for retired Linode API v3 #68871 * Removed legacy salt.transport.ipc module and unused PushChannel / PullChannel factories; local events use ipc_publish_client / ipc_publish_server (TCP transport). #69001 # Deprecated * Deprecated the use of egrep in favor of grep -E #65608 # Changed * Make sure every auth event has the 'act' key set #56200 * Ansiblegate discover_playbooks was changed to find playbooks as either *.yml or *.yaml files #66048 * re-work the aptpkg module to remove system libraries that onedir and virtualenvs do not have access. Streamline testing, and code use to needed libraries only. #66056 * Made gpg modules respect user's GNUPGHOME if set in shell environment #66313 * Made gpg.present attempt to refresh keys if they are expired #66314 * Made x509_v2 the default x509 modules. Until they are removed in the next major release, you can still revert to the old modules by setting features: {x509_v2: false} in the configuration #66384 * Included Salt extensions in Salt-SSH thin archive #66559 * Add support for additional options in several mac_brew_pkg methods #66611 * Make test_pip and test_fileserver tests compatible with venv execution #66703 * Do not use ssl.PROTOCOL_TLS which has been #66767 * deprecated in #66767 * Python 3.10 will be removed in the future. #66767 * Remove warning when running slsutil.renderer on non-SLS files #67067 * PillarCache: reimplement using salt.cache #68030 * fix minion data cache organization/move pillar and grains to dedicated cache banks #68030 * salt.cache: allow cache.store() to set expires per key #68030 * Provide token storage using the salt.cache interface #68039 * Update packaged python from 3.10 to 3.11 #68148 * Added ceph to the specialFSes to match on name for set_fstab #68207 * Removed networkx module dependency by adding MultiDiGraph implementation to salt.utils.requisite to avoid extra dependencies. #68748 * Expanded Thorium documentation with concrete examples and added unit coverage for the documented Thorium workflows. #68857 * Add stub 3008.0 release notes (and template) so tools docs man and CI prepare-release can resolve the current-release doc target. Exclude doc/topics/proposals/*.md from Sphinx so stand-alone proposal files do not fail strict man builds. #68964 # Fixed * Fixed recursive prereq requisites to report recursive requisite error. #8210 * Fixed erroneous recursive requisite error when a prereq is used in combination with onchanges_any. #47154 * Fixed an infinite loop in requisite_any when a requisite state was not found. #50436 * Fixed dependency resolution to not be quadratic. #59123 * Fix regex cache exception during sort in sweep function #59437 * Fixed requisites by parallel states on parallel states being evaluated synchronously (blocking state execution for other parallel states) #59959 * Fix bug when specifying template_source using net.load_template #60515 * firewalld: normalize new rich rules before comparing to old ones #61235 * Fix regression that prevented salt-minion from running interval-based jobs on startup by default. #61964 * Fixed performance when state_aggregate is enabled. #62439 * Fixed issue with salt-ssh hanging due to non-exposed host key acceptance prompt #62782 * Repaired zypper repositories being reconfigured without changes #63402 * Fix calculation of SLS context vars when trailing dots on targetted state #63411 * Put default optimization_order to LazyLoader to prevent possible fails on testing #65266 * Fixed aggregation to correctly honor requisites. #65304 * Fixed some instances of deprecated datetime.datetime.utcnow() #65604 * Introduce pruning option in file.keyvalue #65631 * fix 65703 by using OrderedDict instead of a index that breaks. . #65703 * Simplify timezone.compare_zone to primarily rely get_zone() #65719 * Handle regular expressions which do not not use grouping #65722 * fix consul.acl_create rule creation #65788 * Fix salt-cloud get_cloud_config_value for list objects #65789 * Prevent exceptions with fileserver.update when called via state #65819 * Fix granting of privileges on Postgres functions #65839 * Made Salt Cloud Hetzner module detect image architecture from instance type #65888 * Optimize async calls with using async wrapped method in thread only if io loop is already running #65983 * salt.auth.pam: fallback to use running Python in case /usr/bin/python3 is not found #66035 * Fix file.is_link hangs on paths that are hung mounts #66096 * Fix file.managed and file.serialize default tmp_dir to relative path #66098 * Make win_timezone recognize Qyzylorda timezone #66176 * Remove firing useless events with JID as a tag #66279 * Made gpg modules create GNUPGHOME if it does not exist #66312 * Fixed an issue where conflicting top level keys in the static grains file #66445 * (usually /etc/salt/grains) would break all grains states, and prevent static #66445 * grains from being loaded. #66445 * Fixed beacon delete not calling the beacon's close function, causing resource #66449 * leaks (e.g. inotify file descriptors) and CPU spin after deleting beacons at #66449 * runtime via beacons.delete. Also fixed inotify file descriptor leak during #66449 * beacon refresh when the Beacon instance is replaced. #66449 * Make "status.diskusage" more robust and prevent crashes when stats cannot be obtained #66646 * Use --cachedir parameter for setting extension_modules with salt-call. #66742 * Don't schedule __master_alive jobs if master_alive_interval is not specified #66757 * Make x509 module compatible with cryptography module newer than 43.0.0 #66818 * Fixed Python 3.13 compatibility regarding urllib.parse module #66898 * make salt.channel.server.handle_message codepath more defensive #66909 * Fix the installation of pip modules with special characters in the module name #66988 * Repaired mount.fstab_present always returning pending changes #67065 * dictupdate.update: throw a TypeError when trying to merge a list with a mapping when merge_lists=True. #67092 * Remove usage of spwd #67119 * Fixed order chunks not handling a state with both require and order first or last #67120 * Fixed pkg.install in test mode would not detect FreeBSD packages installed by their origin name #67126 * Fix virtual grains for VMs running on Nutanix AHV #67180 * Fixed creating relative directory symlinks on Windows, ensured listing targets of symlinks in file_roots always produces POSIX-style paths #67766 * Avoid loading salt.utils.crypt module instead of crypt if it's missing in Python as it was deprecated and removed in Python 3.13. #67797 * Fixed docstring error in salt/modules/file.py that misnamed an option "user" when it should have been "owner". #67911 * salt.key: check_minion_cache performance optimization #68030 * when a file is managed, and the same file is cleaned, an incorrect message is displayed saying "removed: Removed due to clean" when the file isn't actually removed. Now the correct message is returned. #68052 * log_beacon - remove verbose minion log output #68055 * Fix that the state saltmod.state can be used on a masterless minion with salt-ssh like saltmod.function currently does. #68116 * Fixed ssh_known_hosts.present failure when ssh host keys changed #68132 * grains.disks: fix exception with incompatible output of Get-PhysicalDisk #68184 * Made osfinger report major&minor version for NixOS #68230 * Fix tests failing on AlmaLinux 10 and other clones #68246 * Speedup wheel key.finger call by removing redundant processing calls. #68251 * Fixed cp.cache_file when using Tornado > 6.4 #68328 * Fixed multiline powershell -Command { } blocks failing with "Missing closing #68397 * '}'" when used in a cmd.run state on Windows. Salt now collapses embedded #68397 * newlines and re-encodes the script block as -EncodedCommand, ensuring correct #68397 * execution and suppressing CLIXML noise from stderr. #68397 * Stop mutating locals, which is unsupported in Py >=3.13 #68445 * Add blockdev state module back in to core #68465 * #68465 * Adds the blockdev state module back into the core Salt repo as it is critical functionality that shouldn't have been pulled out in the module migration #68465 * Adds mdadm and lvm grains modules back in to core. #68470 * #68470 * Restores the modules that had been removed as part of the community module #68470 * migration. They are core bits of functionality and the associated execution and #68470 * states modules had not been removed. #68470 * Fixed grains.list_present state to correctly handle multiple calls within the same state run. #68520 * Fixed salt.utils.platform to properly handle __salt_system_encoding__ when synced as an extension module. #68520 * Improved network.traceroute parsing to be more robust across different traceroute versions. #68520 * Added retry logic to saltutil.wheel integration test to improve reliability in CI. #68520 * Improved architecture detection in salt-ssh to better support ARM64 platforms. #68520 * Fixed salt-ssh extension module syncing to avoid accidentally bundling core Salt modules and to correctly load wrapper modules. #68520 * Ensured salt-ssh relenv tests skip gracefully if the relenv tarball is unavailable in the test environment. #68520 * Fixed mine.get runner to correctly handle master's ID when ACLs are enabled. #68520 * Fixed win_useradd.get_user_sid to correctly handle non-string input. #68520 * Improved reliability of state.running integration test for salt-ssh. #68520 * Fixed high CPU usage in minion asynchronous authentication loop when masters are unreachable. #68520 * Added support for running Salt tools using python -m tools. #68520 * Adds alias state module back in to core. #68574 * #68574 * Restores the module that had been removed as part of the #68574 * community module migration. The associated execution module #68574 * had not been migrated. #68574 * Fixed mongodb tops module authentication to be compatible with pymongo v4+ by passing credentials directly to MongoClient instead of using the deprecated authenticate() method #68659 * Improved the rejected authentication warning message to include the minion ID, #68671 * making it easier for administrators to identify which minions need upgrading. #68671 * This PR fixes a bug where corrupted grains cache files cause unhandled #68678 * SaltDeserializationError exceptions, resulting in CRITICAL errors. #68678 * The fix adds proper exception handling to gracefully recover from corrupted #68678 * cache by regenerating grains. #68678 * Fix ansible.playbooks extra_vars quoting to prevent passing broken variables to ansible-playbook. #68787 * Make x86_64_v2 to be handled properly with salt.modules.yumpkg module as a possible package architecture. #68789 * Make salt-ssh work without issues using domain\user notation for remote user with SSH. #68790 * Fixed source package builds (DEB/RPM) failing with LookupError: hatchling is already being built by adding hatchling to the --only-binary allow-list so pip uses its universal wheel instead of attempting a circular source build. #68858 * Use a 30 second salt CLI timeout in the reauth scenario tests so Windows CI does not time out on test.ping after master/minion restart (default was often 5s). #68924 * Fix logging in potentially dead process in reap_stray_processes fixture #68927 * Fixed a regression in win_pkg where msiexec install flags containing #68950 * Windows-style quoting (e.g. MYPROPERTY="C:\some file.txt") were #68950 * mangled into "MYPROPERTY=C:\some file.txt" causing msiexec to hang. #68950 * Restored the pre-regression behaviour where shlex_split is not applied #68950 * to command strings on Windows, preserving Windows-style argument quoting #68950 * when the command is passed directly to CreateProcess. #68950 * Fix dynamic version discovery on a new release branch before the first v<major>* tag exists: git describe still anchored on the previous line (e.g. v3007.13) is lifted to the unreleased codename baseline (e.g. 3008.0) while keeping the commit offset and SHA. #68964 * Remove deprecations. #68985 * - salt/auth/pki.py (removed) #68985 * - salt/features.py (removed) #68985 * - salt/modules/nxos.py (modified) #68985 * Fixed on the 3008.x release line: Salt NetAPI rest_tornado header parsing without cgi.parse_header (removed in Python 3.13). Integration salt_minion / salt_sub_minion fixtures now call saltutil.sync_all with saltenv=base to avoid long master round-trips from top-file environment discovery during Windows CI. Salt factories use a 120 second daemon start timeout when ONEDIR_TESTRUN is set so Windows onedir runs match CI and avoid flaky minion start event waits. #69014 # Added * Added proxy option to gitfs, git_pillar and winrepo for specifying a proxy server used to connect to git repositories #30990 * Added support for limiting the number of parallel states executing at the same time via state_max_parallel #49301 * Added metalink to mod_repo in yumpkg and documented in pkgrepo state #58931 * Added ssl and verify_ssl arguments to mongodb module and states. #59927 * Added two new options, win_delay_start and win_install_dir, to pass to #61318 * the Windows installer in salt-cloud #61318 * Add context aware change handling for file state module #63328 * Added the ability to access already compiled pillar data during the pillar rendering process via the __pillar__ global in templates and matchers. #64043 * Allow salt-call arguments --file-root, --pillar-root and --states-dir to be specified multiple times #64486 * Adds documentation notes to clarify that Salt's file module only supports numeric mode specifications and does not support symbolic modes. #64624 * Added management of SSH keys and certificates #65197 * Add option (auth_events_autosign_grains) to add autosign_grains to auth events #65426 * Enable "KeepAlive" probes for Salt SSH executions #65488 * Add ability to show diff for new files in file.managed #65546 * Added Virtuozzo Linux to Redhat os_family #65600 * Pillar dunder is now available in extension modules during pillar render. #65724 * Added x509_v2 SSH wrapper module. In addition to the regular calls, it provides a function for statefully managing remote certificates, even when access to the event bus is required #65728 * Introduce fibre_channel_host grain #65750 * Make salt-run jobs.master return runner jobs that are currently running on a master. #66007 * Added file and plaintext sources to gpg.present, allowed to skip keyserver queries #66173 * added pkg.which to aptpkg, for finding which package installed a file. #66201 * Allow pre-connection scripts to be run on host before any ssh commands #66210 * Added port, tls, username and password to the smtp configuration of the highstate returner. #66251 * Improve macOS defaults support #66466 * Added support for specifying different signature verification backends in file.managed/archive.extracted #66527 * Added an asymmetric execution module for signing/verifying data using raw asymmetric algorithms #66528 * Added support in service Beacon for only fire matching configured running state #66809 * Add --relenv Option to salt-ssh for Using a Onedir Bundled Salt+Python #66877 * Add support for state.sls_exists when using salt-ssh #66894 * Add detection for OS grains when running in AlmaLinux Kitten #66991 * Added a merge option to file.recurse, which merges subpaths from all existing sources before managing the directory. Handy when using different saltenvs or the TOFS pattern. #67072 * Add _auth calls to the master stats #67746 * Added possibility to load data from multiple inventories with ansible.targets. #67776 * Detect openEuler as RedHat family OS. #67796 * refactored server-side PKI to support cache interface #67799 * optimization: check_compound_minions: defer _pki_minions fetch #67799 * refactor: push salt.utils.minions bits into salt.key / optimize matching #67799 * Add deb822 apt source format support to aptpkg module #67956 * Add subsystem filter to "udev.exportdb" execution module function #68047 * Implement SL Micro 6.2 detection to fill the grains with proper values. #68247 * Added booleans argument to selinux.booleans #68323 * Added mod_aggregate to selinux to combine boolean #68323 * Added some type hints to selinux module and made some minor changes to improve readability and performance slightly #68323 * Add support for minion_id in log formats #68410 * #68410 * Adds support for including %(minion_id)s in log formats. Where id is available log messages on the master will have that data added to allow easier correlation of messages to minions. #68410 * Added feature parity for relenv and thin dir with salt-ssh. All salt-ssh tests pass with both thin dir and relenv. #68531 * Added tunable worker pools: partition the master's MWorkers into named pools #68532 * and route specific commands (for example _auth) to dedicated pools so a #68532 * slow workload cannot starve time-critical traffic. Controlled by the new #68532 * worker_pools and worker_pools_enabled master settings; see the "Tunable #68532 * Worker Pools" topic guide for details. Existing worker_threads #68532 * configurations remain fully backward compatible. #68532 * Added TLS encryption optimization via disable_aes_with_tls config option that eliminates redundant AES encryption when TLS with mutual authentication is active, improving performance while maintaining security through certificate identity verification. #68536 * utils.dictdiffer: support diffing of dicts in lists #68726 * Add support for nix package manager. #68752 * Added a centralized, declarative system for managing Salt's optional dependencies and their version-specific requirements in salt/utils/versions.py. #68894 * Added a fast memory-mapped cache backend (salt.cache.mmap_cache): #68936 * an O(1) hash-table store with a segmented heap, durable and multi-process #68936 * safe, usable as a drop-in for localfs via the cache master setting. #68936 * The minion public-key index (salt.cache.mmap_key / #68936 * salt.utils.pki.PkiIndex) is built on it; it replaces linear pki_dir #68936 * scans for large fleets and is opt-in via pki_index_enabled. Migrate #68936 * existing keys with salt-run pki.migrate_to_mmap. #68936 * Batch mode now uses a single JID for the entire batch run instead of generating #68941 * a separate JID per batch iteration. This enables unified job tracking via #68941 * salt-run jobs.lookup_jid and consistent --show-jid output across all #68941 * batch slices. The job cache merges minion lists from each iteration so that #68941 * get_load returns the complete set of targeted minions. #68941 * Added a per-job start_event opt-in (CLI flag --start-event) that asks #69019 * targeted minions to fire a salt/job/<jid>/start/<minion_id> event the #69019 * moment they accept the published job, before the function runs. The payload #69019 * mirrors the master's salt/job/<jid>/new event minus the function #69019 * arguments, letting orchestrators confirm reachability without waiting for #69019 * the full return. #69019 -- Salt Project Packaging [email protected] Wed, 06 May 2026 17:42:55 +0000 salt (3008.0~rc1) stable; urgency=medium # Removed * Remove commuity extensions from Salt codebase #65970 * Remove deprecated module search path priority (features.enable_deprecated_module_search_path_priority) #66025 * Remove the orchestration key from salt.runner and salt.wheel return data. #66151 * Removed linode-python package dependency for retired Linode API v3 #68871 # Deprecated * Deprecated the use of egrep in favor of grep -E #65608 # Changed * Make sure every auth event has the 'act' key set #56200 * Ansiblegate discover_playbooks was changed to find playbooks as either *.yml or *.yaml files #66048 * re-work the aptpkg module to remove system libraries that onedir and virtualenvs do not have access. Streamline testing, and code use to needed libraries only. #66056 * Made gpg modules respect user's GNUPGHOME if set in shell environment #66313 * Made gpg.present attempt to refresh keys if they are expired #66314 * Made x509_v2 the default x509 modules. Until they are removed in the next major release, you can still revert to the old modules by setting features: {x509_v2: false} in the configuration #66384 * Included Salt extensions in Salt-SSH thin archive #66559 * Add support for additional options in several mac_brew_pkg methods #66611 * Make test_pip and test_fileserver tests compatible with venv execution #66703 * Do not use ssl.PROTOCOL_TLS which has been #66767 * deprecated in #66767 * Python 3.10 will be removed in the future. #66767 * Remove warning when running slsutil.renderer on non-SLS files #67067 * PillarCache: reimplement using salt.cache #68030 * fix minion data cache organization/move pillar and grains to dedicated cache banks #68030 * salt.cache: allow cache.store() to set expires per key #68030 * Provide token storage using the salt.cache interface #68039 * Update packaged python from 3.10 to 3.11 #68148 * Added ceph to the specialFSes to match on name for set_fstab #68207 * Removed networkx module dependency by adding MultiDiGraph implementation to salt.utils.requisite to avoid extra dependencies. #68748 * Expanded Thorium documentation with concrete examples and added unit coverage for the documented Thorium workflows. #68857 * Add stub 3008.0 release notes (and template) so tools docs man and CI prepare-release can resolve the current-release doc target. Exclude doc/topics/proposals/*.md from Sphinx so stand-alone proposal files do not fail strict man builds. #68964 # Fixed * Fixed recursive prereq requisites to report recursive requisite error. #8210 * Fixed erroneous recursive requisite error when a prereq is used in combination with onchanges_any. #47154 * Fixed an infinite loop in requisite_any when a requisite state was not found. #50436 * Fixed dependency resolution to not be quadratic. #59123 * Fix regex cache exception during sort in sweep function #59437 * Fixed requisites by parallel states on parallel states being evaluated synchronously (blocking state execution for other parallel states) #59959 * Fix bug when specifying template_source using net.load_template #60515 * firewalld: normalize new rich rules before comparing to old ones #61235 * Fix regression that prevented salt-minion from running interval-based jobs on startup by default. #61964 * Fixed performance when state_aggregate is enabled. #62439 * Fixed issue with salt-ssh hanging due to non-exposed host key acceptance prompt #62782 * Repaired zypper repositories being reconfigured without changes #63402 * Fix calculation of SLS context vars when trailing dots on targetted state #63411 * Put default optimization_order to LazyLoader to prevent possible fails on testing #65266 * Fixed aggregation to correctly honor requisites. #65304 * Fixed some instances of deprecated datetime.datetime.utcnow() #65604 * Introduce pruning option in file.keyvalue #65631 * fix 65703 by using OrderedDict instead of a index that breaks. . #65703 * Simplify timezone.compare_zone to primarily rely get_zone() #65719 * Handle regular expressions which do not not use grouping #65722 * fix consul.acl_create rule creation #65788 * Fix salt-cloud get_cloud_config_value for list objects #65789 * Prevent exceptions with fileserver.update when called via state #65819 * Fix granting of privileges on Postgres functions #65839 * Made Salt Cloud Hetzner module detect image architecture from instance type #65888 * Optimize async calls with using async wrapped method in thread only if io loop is already running #65983 * salt.auth.pam: fallback to use running Python in case /usr/bin/python3 is not found #66035 * Fix file.is_link hangs on paths that are hung mounts #66096 * Fix file.managed and file.serialize default tmp_dir to relative path #66098 * Make win_timezone recognize Qyzylorda timezone #66176 * Remove firing useless events with JID as a tag #66279 * Made gpg modules create GNUPGHOME if it does not exist #66312 * Fixed an issue where conflicting top level keys in the static grains file #66445 * (usually /etc/salt/grains) would break all grains states, and prevent static #66445 * grains from being loaded. #66445 * Fixed beacon delete not calling the beacon's close function, causing resource #66449 * leaks (e.g. inotify file descriptors) and CPU spin after deleting beacons at #66449 * runtime via beacons.delete. Also fixed inotify file descriptor leak during #66449 * beacon refresh when the Beacon instance is replaced. #66449 * Make "status.diskusage" more robust and prevent crashes when stats cannot be obtained #66646 * Use --cachedir parameter for setting extension_modules with salt-call. #66742 * Don't schedule __master_alive jobs if master_alive_interval is not specified #66757 * Make x509 module compatible with cryptography module newer than 43.0.0 #66818 * Fixed Python 3.13 compatibility regarding urllib.parse module #66898 * make salt.channel.server.handle_message codepath more defensive #66909 * Fix the installation of pip modules with special characters in the module name #66988 * Repaired mount.fstab_present always returning pending changes #67065 * dictupdate.update: throw a TypeError when trying to merge a list with a mapping when merge_lists=True. #67092 * Remove usage of spwd #67119 * Fixed order chunks not handling a state with both require and order first or last #67120 * Fixed pkg.install in test mode would not detect FreeBSD packages installed by their origin name #67126 * Fix virtual grains for VMs running on Nutanix AHV #67180 * Fixed creating relative directory symlinks on Windows, ensured listing targets of symlinks in file_roots always produces POSIX-style paths #67766 * Avoid loading salt.utils.crypt module instead of crypt if it's missing in Python as it was deprecated and removed in Python 3.13. #67797 * Fixed docstring error in salt/modules/file.py that misnamed an option "user" when it should have been "owner". #67911 * salt.key: check_minion_cache performance optimization #68030 * when a file is managed, and the same file is cleaned, an incorrect message is displayed saying "removed: Removed due to clean" when the file isn't actually removed. Now the correct message is returned. #68052 * log_beacon - remove verbose minion log output #68055 * Fix that the state saltmod.state can be used on a masterless minion with salt-ssh like saltmod.function currently does. #68116 * Fixed ssh_known_hosts.present failure when ssh host keys changed #68132 * grains.disks: fix exception with incompatible output of Get-PhysicalDisk #68184 * Made osfinger report major&minor version for NixOS #68230 * Fix tests failing on AlmaLinux 10 and other clones #68246 * Speedup wheel key.finger call by removing redundant processing calls. #68251 * Fixed cp.cache_file when using Tornado > 6.4 #68328 * Stop mutating locals, which is unsupported in Py >=3.13 #68445 * Add blockdev state module back in to core #68465 * #68465 * Adds the blockdev state module back into the core Salt repo as it is critical functionality that shouldn't have been pulled out in the module migration #68465 * Adds mdadm and lvm grains modules back in to core. #68470 * #68470 * Restores the modules that had been removed as part of the community module #68470 * migration. They are core bits of functionality and the associated execution and #68470 * states modules had not been removed. #68470 * Fixed grains.list_present state to correctly handle multiple calls within the same state run. #68520 * Fixed salt.utils.platform to properly handle __salt_system_encoding__ when synced as an extension module. #68520 * Improved network.traceroute parsing to be more robust across different traceroute versions. #68520 * Added retry logic to saltutil.wheel integration test to improve reliability in CI. #68520 * Improved architecture detection in salt-ssh to better support ARM64 platforms. #68520 * Fixed salt-ssh extension module syncing to avoid accidentally bundling core Salt modules and to correctly load wrapper modules. #68520 * Ensured salt-ssh relenv tests skip gracefully if the relenv tarball is unavailable in the test environment. #68520 * Fixed mine.get runner to correctly handle master's ID when ACLs are enabled. #68520 * Fixed win_useradd.get_user_sid to correctly handle non-string input. #68520 * Improved reliability of state.running integration test for salt-ssh. #68520 * Fixed high CPU usage in minion asynchronous authentication loop when masters are unreachable. #68520 * Added support for running Salt tools using python -m tools. #68520 * Adds alias state module back in to core. #68574 * #68574 * Restores the module that had been removed as part of the #68574 * community module migration. The associated execution module #68574 * had not been migrated. #68574 * Fixed mongodb tops module authentication to be compatible with pymongo v4+ by passing credentials directly to MongoClient instead of using the deprecated authenticate() method #68659 * Improved the rejected authentication warning message to include the minion ID, #68671 * making it easier for administrators to identify which minions need upgrading. #68671 * This PR fixes a bug where corrupted grains cache files cause unhandled #68678 * SaltDeserializationError exceptions, resulting in CRITICAL errors. #68678 * The fix adds proper exception handling to gracefully recover from corrupted #68678 * cache by regenerating grains. #68678 * Fix mac_brew_pkg.list_pkgs crashing or producing incorrect results when #68763 * Homebrew returns null values for cask metadata: #68763 * #68763 * - When the installed version of a cask is null (e.g. Homebrew cannot #68763 * determine the installed version), it is now reported as "unknown" #68763 * instead of raising an error. #68763 * - When full_token is null, it is now filtered out so that None #68763 * is never used as a package name key in the returned dictionary. #68763 * Fix ansible.playbooks extra_vars quoting to prevent passing broken variables to ansible-playbook. #68787 * Make x86_64_v2 to be handled properly with salt.modules.yumpkg module as a possible package architecture. #68789 * Make salt-ssh work without issues using domain\user notation for remote user with SSH. #68790 * Fixed source package builds (DEB/RPM) failing with LookupError: hatchling is already being built by adding hatchling to the --only-binary allow-list so pip uses its universal wheel instead of attempting a circular source build. #68858 * Use a 30 second salt CLI timeout in the reauth scenario tests so Windows CI does not time out on test.ping after master/minion restart (default was often 5s). #68924 * Fix logging in potentially dead process in reap_stray_processes fixture #68927 * Fix dynamic version discovery on a new release branch before the first v<major>* tag exists: git describe still anchored on the previous line (e.g. v3007.13) is lifted to the unreleased codename baseline (e.g. 3008.0) while keeping the commit offset and SHA. #68964 * Remove deprecations. #68985 * - salt/auth/pki.py (removed) #68985 * - salt/features.py (removed) #68985 * - salt/modules/nxos.py (modified) #68985 # Added * Added proxy option to gitfs, git_pillar and winrepo for specifying a proxy server used to connect to git repositories #30990 * Added support for limiting the number of parallel states executing at the same time via state_max_parallel #49301 * Added metalink to mod_repo in yumpkg and documented in pkgrepo state #58931 * Added ssl and verify_ssl arguments to mongodb module and states. #59927 * Added two new options, win_delay_start and win_install_dir, to pass to #61318 * the Windows installer in salt-cloud #61318 * Add context aware change handling for file state module #63328 * Added the ability to access already compiled pillar data during the pillar rendering process via the __pillar__ global in templates and matchers. #64043 * Allow salt-call arguments --file-root, --pillar-root and --states-dir to be specified multiple times #64486 * Adds documentation notes to clarify that Salt's file module only supports numeric mode specifications and does not support symbolic modes. #64624 * Added management of SSH keys and certificates #65197 * Add option (auth_events_autosign_grains) to add autosign_grains to auth events #65426 * Enable "KeepAlive" probes for Salt SSH executions #65488 * Add ability to show diff for new files in file.managed #65546 * Added Virtuozzo Linux to Redhat os_family #65600 * Pillar dunder is now available in extension modules during pillar render. #65724 * Added x509_v2 SSH wrapper module. In addition to the regular calls, it provides a function for statefully managing remote certificates, even when access to the event bus is required #65728 * Introduce fibre_channel_host grain #65750 * Make salt-run jobs.master return runner jobs that are currently running on a master. #66007 * Added file and plaintext sources to gpg.present, allowed to skip keyserver queries #66173 * added pkg.which to aptpkg, for finding which package installed a file. #66201 * Allow pre-connection scripts to be run on host before any ssh commands #66210 * Added port, tls, username and password to the smtp configuration of the highstate returner. #66251 * Improve macOS defaults support #66466 * Added support for specifying different signature verification backends in file.managed/archive.extracted #66527 * Added an asymmetric execution module for signing/verifying data using raw asymmetric algorithms #66528 * Added support in service Beacon for only fire matching configured running state #66809 * Add --relenv Option to salt-ssh for Using a Onedir Bundled Salt+Python #66877 * Add support for state.sls_exists when using salt-ssh #66894 * Add detection for OS grains when running in AlmaLinux Kitten #66991 * Added a merge option to file.recurse, which merges subpaths from all existing sources before managing the directory. Handy when using different saltenvs or the TOFS pattern. #67072 * Add _auth calls to the master stats #67746 * Added possibility to load data from multiple inventories with ansible.targets. #67776 * Detect openEuler as RedHat family OS. #67796 * refactored server-side PKI to support cache interface #67799 * optimization: check_compound_minions: defer _pki_minions fetch #67799 * refactor: push salt.utils.minions bits into salt.key / optimize matching #67799 * Add deb822 apt source format support to aptpkg module #67956 * Add subsystem filter to "udev.exportdb" execution module function #68047 * Implement SL Micro 6.2 detection to fill the grains with proper values. #68247 * Added booleans argument to selinux.booleans #68323 * Added mod_aggregate to selinux to combine boolean #68323 * Added some type hints to selinux module and made some minor changes to improve readability and performance slightly #68323 * Add support for minion_id in log formats #68410 * #68410 * Adds support for including %(minion_id)s in log formats. Where id is available log messages on the master will have that data added to allow easier correlation of messages to minions. #68410 * Added feature parity for relenv and thin dir with salt-ssh. All salt-ssh tests pass with both thin dir and relenv. #68531 * Added tunable worker pools: partition the master's MWorkers into named pools #68532 * and route specific commands (for example _auth) to dedicated pools so a #68532 * slow workload cannot starve time-critical traffic. Controlled by the new #68532 * worker_pools and worker_pools_enabled master settings; see the "Tunable #68532 * Worker Pools" topic guide for details. Existing worker_threads #68532 * configurations remain fully backward compatible. #68532 * Added TLS encryption optimization via disable_aes_with_tls config option that eliminates redundant AES encryption when TLS with mutual authentication is active, improving performance while maintaining security through certificate identity verification. #68536 * utils.dictdiffer: support diffing of dicts in lists #68726 * Add support for nix package manager. #68752 * Added a centralized, declarative system for managing Salt's optional dependencies and their version-specific requirements in salt/utils/versions.py. #68894 * Implemented an O(1) memory-mapped PKI index to optimize minion public key lookups. This optimization substantially reduces master disk I/O and publication overhead in large-scale environments by replacing linear directory scans with constant-time hash table lookups. The feature is opt-in via the pki_index_enabled master configuration setting. #68936 -- Salt Project Packaging [email protected] Thu, 23 Apr 2026 23:02:39 +0000 salt (3007.14) stable; urgency=medium # Fixed * Fix mac_brew_pkg.list_pkgs crashing or producing incorrect results when Homebrew returns null values for cask metadata: * When the installed version of a cask is null (e.g. Homebrew cannot determine the installed version), it is now reported as "unknown" instead of raising an error. * When full_token is null, it is now filtered out so that None is never used as a package name key in the returned dictionary. #68763 -- Salt Project Packaging [email protected] Wed, 29 Apr 2026 16:40:47 +0000 salt (3007.13) stable; urgency=medium # Fixed * Fix user.info when querying domain users. Uses DsGetDcName for more dependable domain controller lookup. #68612 * Fixed minion instability and resource exhaustion under high load by implementing resource-aware job queuing and backpressure. Added process_count_max enforcement and disk-based queuing to prevent unbounded process spawning and file descriptor exhaustion. #68703 -- Salt Project Packaging [email protected] Wed, 11 Feb 2026 19:46:35 +0000 Preconfiguring packages ... Fetched 37.3 MB in 1s (45.5 MB/s) (Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 41036 files and directories currently installed.) Preparing to unpack .../salt-minion_3008.1_arm64.deb ... chown: cannot access '/var/run/salt/minion': No such file or directory Unpacking salt-minion (3008.1) over (3007.12) ... Preparing to unpack .../salt-common_3008.1_arm64.deb ... usermod: no changes Unpacking salt-common (3008.1) over (3007.12) ... Preparing to unpack .../openmediavault-salt_8.1.0_arm64.deb ... Unpacking openmediavault-salt (8.1.0) over (8.0) ... dpkg: warning: unable to delete old directory '/opt/saltstack/salt/extras-3.10/pyudev/device': Directory not empty dpkg: warning: unable to delete old directory '/opt/saltstack/salt/extras-3.10/pyudev/_os': Directory not empty dpkg: warning: unable to delete old directory '/opt/saltstack/salt/extras-3.10/pyudev/_ctypeslib': Directory not empty dpkg: warning: unable to delete old directory '/opt/saltstack/salt/extras-3.10/pyudev': Directory not empty dpkg: warning: unable to delete old directory '/opt/saltstack/salt/extras-3.10/natsort/compat': Directory not empty dpkg: warning: unable to delete old directory '/opt/saltstack/salt/extras-3.10/natsort': Directory not empty dpkg: warning: unable to delete old directory '/opt/saltstack/salt/extras-3.10/lxml': Directory not empty dpkg: warning: unable to delete old directory '/opt/saltstack/salt/extras-3.10/click': Directory not empty dpkg: warning: unable to delete old directory '/opt/saltstack/salt/extras-3.10': Directory not empty Preparing to unpack .../openmediavault_8.5.8-1_all.deb ... Unpacking openmediavault (8.5.8-1) over (8.1.1-1) ... Setting up salt-common (3008.1) ... Setting up salt-minion (3008.1) ... Installing new version of config file /etc/salt/minion ... salt-minion.service is a disabled or a static unit not running, not starting it. Setting up openmediavault-salt (8.1.0) ... Setting up openmediavault (8.5.8-1) ... Installing new version of config file /etc/apt/apt.conf.d/95openmediavault-unattended-upgrade ... Installing new version of config file /etc/sysctl.d/99-openmediavault.conf ... Creating configuration database ... Migrating configuration database ... Running migration 'conf_8.2.0' ... Running migration 'conf_8.5.8' ... Setting up Salt environment ... Processing system modifications ... Processing triggers for man-db (2.13.1-1) ... Processing triggers for libc-bin (2.41-12+deb13u4) ... Processing triggers for openmediavault (8.5.8-1) ... Restarting engine daemon ... Updating workbench configuration files ... END OF LINE █