Puppet Core 9.1.0

Released September 2026. This release adds Debian 12 ARM V7L support for Puppet agent, includes improvements to help prevent security vulnerabilities, and resolves compatibility issues with hiera-eyaml and JSON dependencies.

On this page:

New features and enhancements

Agent platforms added

This release adds support for the Puppet agent on the following operating system platforms:

Debian 12 ARM V7L PA-7764

Security updates

Updated OpenSSL

Updated OpenSSL from 3.5.7 to 3.5.8 to address the following CVEs:

CVE-2026-18798
CVE-2026-63072
CVE-2026-63076
CVE-2026-14456
CVE-2026-14457
CVE-2026-54874
CVE-2026-63073
CVE-2026-63074
CVE-2026-63075
CVE-2026-75803

PA-9223

Patched resolv gem

Patched the default gem resolv in Ruby to address the following CVEs:

CVE-2026-80212
CVE-2026-80213

PA-9229

Patched RubyGems

Patched RubyGems to address CVE-2026-82455.

PA-9260

Updated curl

Updated curl from 8.21.0 to 8.22.0 to address the following CVEs:

CVE-2026-13608
CVE-2026-18924
CVE-2026-19931
CVE-2026-80229
CVE-2026-82208

PA-9266

Updated libxml2

Updated libxml2 from 2.15.3 to 2.15.4 to address the following CVEs:

CVE-2026-86138
CVE-2026-86139
CVE-2026-86140
CVE-2026-86142
CVE-2026-86143
CVE-2026-86144

PA-9272

Resolved issues

Updated hiera-eyaml compatibility

Updated hiera-eyaml from 5.0.0 to 5.0.1 so that encrypted Hiera values can be decrypted when Puppet Server uses Bouncy Castle 1.85 or later.

PA-9262

Updated JSON dependency compatibility

Puppet now constrains its JSON dependency to greater than or equal to 2.0, and less than 4, to avoid JSON compatibility issues. This prevents breakage when newer JSON versions are installed in environments using Bundler or similar dependency tooling.

PA-9273