Puppet Server release notes

Learn about new features, resolved issues, and deprecations in Puppet Server.

Puppet Server 9.0.2

Released August 2026 and shipped with Puppet Core 9.0.0. This version of Puppet Server includes a new version of JRuby, JDK, Jetty, improvements to the certificate authority, improvements to help prevent security issues. It adds support for Debian 13 (Trixie) and Ubuntu 24.04 (Noble) and removes support for end of life versions of Debian, Red Hat Enterprise Linux, and Ubuntu.

New features and enhancements

  • JRuby was updated to version 10.1.0.0. PA-8515. PE 44941

  • The minimum supported version of JDK is now version 21, testing was validated with JDK 21. PE-43832

  • The embedded web server was upgraded to Jetty 12. PE-38468, PE-42979

  • A new optional PostgreSQL-backed certificate authority (CA) storage backend was added. This is an alternative to filesystem storage, and is foundational for Puppet Enterprise (PE) disaster recovery deployments with a replica CA . PE-43767, PE-43795

  • New CRUD HTTP endpoints under /puppet-ca/v1/autosign-rules were added which can be used to manage autosigning rules via the API. PE-43789, PE-43881

  • New activity reporting events for CA lifecycle operations were added, including submitting certificate signing requests (CSRs), deleting CSRs, updating the certificate revocation list (CRL), importing, exporting, and deleting keys, and making changes to autosigning. PE-43792, PE-43949

  • Support was added for Puppet Server on the following operating system platforms:

    • Debian 13 (Trixie)

    • Ubuntu 24.04 (Noble)

Security updates

  • By default, the /status/v1/services endpoint now requires an authenticated client. The /status/v1/simple endpoint remains unauthenticated for load balancer health checks. PE-44727

  • CSRs with a certname including invalid inputs are now rejected with a 400 error instead of being accepted. PE-44719

  • Fixed a log-injection vulnerability where invalid environment and code-id query parameters could be written verbatim into logs and error responses. PE-44718

  • Agent certificate signing paths now unconditionally reject CSRs requesting CA signing authority (CA:true). PE-44766

  • Fixed a native-extension gem fallback that silently bypassed the erb 6.0.4 fix for CVE-2026-41316. PE-44677

Resolved issues

  • Fixed puppetserver irb and other subcommands crashing on JDK 21 due to missing --add-opens flags.

  • Fixed file resources with spaces or percent-encoded names failing to deploy under Jetty 12. PE-43882

  • Fixed GET /puppet-ca/v1/certificate/ca returning 404 on the database backend, breaking agent bootstrap and cert refresh. PE-44969

  • Fixed an incomplete CRL (missing Root CA CRL) after a storage import or on two-tier setups. PE-44249, PE-44273, PE-44609

  • Fixed revoked and expired certificates incorrectly being reported as not found. PE-43880

  • Fixed a raw 500 error instead of a clear message on migration-import failures. PE-45100

  • Fixed the filesystem-to-database migration silently dropping the offline root CA private key in two-tier PE deployments. PE-45043

  • Fixed a race condition that could let a just revoked certificate be renewed before the CRL was published. PE-44659

  • Fixed CRL updates not being fully flushed to disk after running puppet-backup restore in database CA mode. PE-44341

  • Fixed a performance degradation (up to 200 to 500 times slower) during large bulk certificate cleanup operations. PE-44263

  • Fixed connection-pool starvation under concurrent certificate revocations. PE-44071, PE-44073

  • Certificate-authority endpoints now consistently return a 503 with Retry-After header on lock timeout instead of inconsistent behavior. PE-44170, PE-44171, PE-44269, PE-44272

Deprecations

  • The following packages are no longer available for Puppet Server:

    • Debian 10, 11 and 12 PE-44231, PA-9056

    • Red Hat Enterprise Linux 7 (x86_64) PA-9056

    • Ubuntu 18.04 and 20.04 PA-9056

Puppet Server 9.0.0, 9.0.1

These versions of Puppet Server were never released.