Puppet Core 9.0 and 8.21 Released: Ruby 4.0, OpenSSL 3.5, Platform Changes, and Security Hardening

Did you know there's a new major version in town for Puppet Core? You might have heard about it through the grapevine or in the Are You Ready for Puppet 9? webinar that @gpatton and I recently hosted. The wait is over and Puppet Core 9.0.0 is now available alongside Puppet Core 8.21.0. Puppet Core 9 introduces significant runtime and platform changes, moving to Ruby 4.0, OpenSSL 3.5, and other changes, but the essential Puppet under the hood is largely unchanged from Puppet 8. The majority of upgrade effort will center on Ruby 4 compatibility and runtime dependency changes rather than Puppet language changes. If you are staying on the Puppet Core 8.x release track, the latest Puppet Core 8.21 delivers the basic support fixes and security improvements you might need without the major dependency changes found in Puppet Core 9. What matters most for the admins Before upgrading to Puppet Core 9: - Test custom facts, functions, types, and providers against Ruby 4.0. - Validate any Forge modules you use for Ruby 4 compatibility. - Review integrations that depend on OpenSSL behavior. - Verify any workflows that still rely on SHA-1. - Confirm managed nodes are running supported operating systems. - Review any custom code that depends on PSON or multi_json . - Check deferred function behavior if you have custom types or providers. Perforce will be rolling out updates to Puppetlabs modules on the Forge based on their priority tier and dependencies. The first batch of these should be rolling out soon. Puppet Core 9.0 highlights These are a few highlights I pulled from the release notes. Make sure to reference the full 9.0 release notes to get all the details about what has changed! Ruby updated to 4.0.5: With a new Ruby baseline some deprecated syntax from older Ruby versions will no longer be compatible. This is the primary focus area for upgrades as you will want to validate your custom code and modules. The latest PDK 3.8.0 introduced some Ruby 4 validators to help you update your syntax while you are still on Puppet Core 8, before upgrading to Puppet Core 9. OpenSSL updated to 3.5.7: This lays the groundwork for supporting post-quantum cryptography (PQC) and moves to TLS 1.3 as the default protocol version. This upgrade will resolve several OpenSSL-related CVEs. Puppet Server has updated baseline components: As part of the move to JRuby 10.1, Puppet Server is now updated to require minimum JDK 21. The embedded web server is now using Jetty 12. PSON support removed: You will need to migrate to a supported data format if your code has relied on PSON. Deferred functions return to Puppet 7 behavior: While Puppet Core 9 largely keeps the same underlying behavior as Puppet Core 8.x, there is one change worth noting about deferred functions. In older versions (like Puppet 7), preprocess_deferred was enabled by default, but this was disabled by default in Puppet 8. In Puppet Core 9,preprocess_deferred is now enabled by default again.UTF-8 encoding now used on Windows: Puppet Core now uses UTF-8 as the default external encoding on Windows. You will want to look for any configuration files encoded in non-UTF-8 before upgrading. These are just some highlights I pulled from the full list, I really recommend taking a look at the release notes to get a full picture. Security hardening Both the 9.0 and 8.21 releases contain security-related fixes. - Stricter SSH key validation: Puppet now rejects malformed SSH keys that previously passed validation. This includes invalid inputs such as embedded newline characters. The goal is to prevent unsafe content from being written to managed files. - Improved autoloader validation: The puppet resource command now performs stricter validation of autoloader inputs. This change helps prevent unintended code loading through user-controlled values. - curl updated to 8.21.0: Both Puppet Core 9.0 and Puppet Core 8.21 update curl from 8.20.0 to 8.21.0. The update addresses numerous curl CVEs. Admins who track dependency risk should review the release notes for the complete CVE list: Platform updates New agent platforms The following agent platforms are now supported in both Puppet Core 9.0 and 8.21: - Rocky Linux 10 (x86_64) - Alma Linux 10 (x86_64) Operating systems removed from support Several end-of-life operating systems have been removed: Debian 10, macOS 13, RHEL 7, Ubuntu 18.04 and 20.04, and others. The official full list is in the docs. The list in this article is not complete, so make sure to reference those notes to check your systems! If you need to keep using a platform that has been removed you should know there is an extended support option. Migrating to a more modern OS is likely the best path, but if you can't migrate just yet, make sure to reach out to the team to get help with extended platform support Upgrade resources Before moving to Puppet Core 9, review the official upgrade documentation and release notes: - Puppet Core 9 upgrade documentation - Puppet Core 9.0.0 release notes - Puppet Core 8.21.0 release notes - Puppet Core platform support lifecycle - PDK 3.8.0 compatibility testing Make sure to start your Puppet Core 9 compatibility testing early and send over any questions as you encounter issues so that the team can help! Top comments (0)