PuppetDB: Release notes

PuppetDB 9.0.1

Released August 2026 and shipped with Puppet Core 9.0.0. This version of PuppetDB updates JDK and Jetty, adds support for Amazon Linux 2023, Red Hat Enterprise Linux (RHEL) 10, and Debian 13 (Trixie), includes improvements to help prevent security vulnerabilities, and removes support for end of life versions of Debian, Red Hat Enterprise Linux (RHEL), and Ubuntu.

New features and enhancements

  • PuppetDB 9 requires JDK 21. Review your code and dependencies for compatibility with JDK 21. PE-43561, PE-43276

  • Jetty was updated to version 12 as part of the update to JDK 21. PE-38468, PE-42978

  • This release adds support for the PuppetDB on the following operating system platforms:

    • Amazon Linux 2023

    • Red Hat Enterprise Linux (RHEL) 10

    • Debian 13 (Trixie)

    PUPDOC-6073

Security updates

  • PuppetDB now enables the certificate allowlist by default. The allowlist restricts access to certificates whose common names match the current fully qualified domain name, hosts must be on allowlist to query PuppetDB and submit commands. PE-44893

  • The unauthenticated cleartext HTTP listener on port 8080 is no longer enabled by default on new installations. New installations are mTLS-only unless the cleartext listener is manually re-enabled. Upgraded installations are unaffected.

    If the cleartext listener on port 8080 is enabled for new installations or upgrades:

    • Ensure the host setting is configured to use the loopback interface (host is either unset or configured to use localhost).

    • Ensure the firewall does not allow connections on port 8080.

    If the cleartext listener is disabled, before starting the PuppetDB service:

    • Ensure ssl-* settings are enabled.

    • Ensure that the following files exist:

      • /etc/puppetlabs/puppetdb/ssl/ca.pem
      • /etc/puppetlabs/puppetdb/ssl/private.pem

    • You can create these files using the puppetdb ssl-setup command.

    PE-44906

  • The /metrics endpoint now denies access by default instead of allowing any client with a valid Puppet certificate to connect. If you need to collect Jolokia metrics from an external host, add an allow rule to /etc/puppetlabs/puppetdb/conf.d/auth.conf. PE-44831

  • When ssl-cert is configured, PuppetDB now automatically generates a self-only certificate allowlist so that by default, only the local node can submit commands or run queries. If you have more than one Puppet Server, make sure that you set certificate-allowlist. It is best practice to set certificate-allowlist when upgrading so that only your Puppet Server can connect to PuppetDB.PE-44893

  • For deployments that can't maintain an allowlist, there is now a new certificate-allowlist-required setting, by default set to true. You can revert to previous behavior by setting certificate-allowlist-required=false which allows any node with a valid client certificate to connect to PuppetDB’s port 8081 as in previous releases.PE-45404

    If you are running serverless Puppet Core, you might need to set certificate-allowlist-required=false so that all nodes can connect to PuppetDB.

Resolved issues

  • Fixed a ClassCastException that could permanently kill the background thread that manages the cleanup of abandoned queries. PE-45014

  • Fixed a retry and backoff bug affecting JDK 19 through 21 that could turn transient database retries into request failures. PDB-5880

  • CVE-2026-2332 and CVE-2026-5795 were resolved via a dependency update. PE-43936

Deprecations

  • Support was removed for JDK 8 and JDK 11. PE-43561, PE-43276

  • Support was removed for:

    • Debian 10 (Buster) and 11 (Bullseye) PA-9056

    • Red Hat Enterprise Linux (RHEL) 7 PA-9056

    • Ubuntu 18.04 (Bionic) LTS and 20.04 (Focal) PA-9056

PuppetDB 9.0.0

This version of PuppetDB was never released.