1. Foreman 3.17 release notes

1.1. Headline features

1.1.1. User interface & experience

PatternFly 5 UI updates

Continued migration to PatternFly 5 brings modernized notifications (#38345) and other UI components, improving the overall user experience with updated design patterns.

1.1.2. Infrastructure & platform updates

Multi-architecture iPXE support

iPXE chain UEFI now supports multiple architectures (#38300), enabling proper provisioning of ARM64 and other non-x86_64 hosts by delivering the correct iPXE binary for each architecture.

Resource Quota plugin

If you use the Resource Quota plugin on Foreman 3.16, Foreman will automatically assign all existing hosts to the Unassigned resource quota during the upgrade to Foreman 3.17. For more information, see Limiting host resources in Administering Foreman.

1.2. Upgrade warnings

Ruby 2.7 no longer supported

Ruby 2.7 support has been dropped (#38115, #38883).

Grub1 removed

Support for legacy GRUB (Grub1) has been completely removed from both Foreman and Smart Proxy (#38768, #38772, #38787, #38791). Only GRUB2 is supported going forward. If you are still using Grub1 for provisioning, migrate to GRUB2 before upgrading.

1.3. Deprecations

There are no deprecations with Foreman 3.17.

2. Katello 4.19 release notes

2.1. Headline features

2.1.1. Pulpcore upgraded to 3.85 and plugins updated

Newer Pulpcore brings bug and performance fixes. Please see https://pulpproject.org/pulpcore/changes/#3.85.0 for new changes since Pulpcore 3.73. https://projects.theforeman.org/issues/38748

2.1.2. Pulp Resource Name (PRN) migration

In anticipation for a future upgrade to Pulp 4, Katello now indexes PRNs alongside Pulp hrefs. PRNs will enable more efficient API calls to Pulp in the future. https://projects.theforeman.org/issues/38809

2.1.3. New experimental Container Images page

A new experimental Container Images page will soon replace the older Angular content unit listing page for container image tags. The new page will eventually merge with the Booted Container Images page. To view it, enable the "Experimental Labs" setting, refresh the page, and navigate to Lab Features → Container Images (/labs/container_images). https://projects.theforeman.org/issues/38812

2.1.4. Structured APT for Deb content

With Katello 4.19, all Deb content will start using "structured APT" mode. This means that Deb content published in APT repositories on Katello will no longer publish metadata under the dists/default/ path. Instead, all APT repository publications will exclusively use the same repository structure (releases/distributions and components), that are synchronized from the upstream URL. https://projects.theforeman.org/issues/38741

2.1.5. New bulk actions have been added to the host overview page

Change host collection of multiple hosts - https://github.com/Katello/katello/commit/6625fe75ffea36a14666d26d1f8d314851b970a0 - https://github.com/Katello/katello/pull/11528 https://projects.theforeman.org/issues/38829

2.2. Upgrade warnings

2.2.1. Structured APT migration for Deb content

For users with Deb type content, Foreman community recommends that you migrate to "structured APT" enabled mode before upgrading to Katello 4.19. If you do not migrate your Deb content before upgrading, it will be automatically migrated during the upgrade. However, if this automatic migration run is omitted or fails, your Deb type content may be left in an inconsistent state. You will also need to perform a complete sync of your smart proxies after the upgrade. Detailed instructions for how to migrate before upgrading to Katello 4.19 can be found here: https://docs.theforeman.org/3.16/Managing_Content/index-katello.html#enabling-structured-apt-content

2.3. Deprecations

2.3.1. The deprecated auto_attach and autoheal parameters have been removed from all API endpoints.

These options are no longer relevant because all organizations are SCA-only, and attaching subscriptions to hosts and activation keys is obsolete.

2.3.2. With the switch to structured APT for Deb content, new publications for Deb content will no longer add metadata under the dists/default/ path.

You must configure hosts to use the same releases/distributions and components that were synchronized from the relevant upstream repository.

3. Foreman 3.17.0

You can find the complete list of changes on Redmine.

3.1. Foreman

  • Allow better empty states in TableIndexPage - #38875

  • Add Hardware Model inclusion option to Host - Installed Products report template - #38872

  • Use webpack cache in development - #38864

  • Sessions fail to expire if add_smart_proxy_filters is run - #38840

  • Kickstart dynamic partition table fails on UEFI systems - #38839

  • update TemplateGenerator to pf5 - #38837

  • Add mouseover support for host status icon in All Hosts page - #38836

  • Permit type param in foreman/links_controller - #38835

  • Add sub-menu Host collections to bulk hosts Change associations - #38830

  • update ModalProgressBar to use pf5 - #38828

  • Couldn't find User with 'id'=9 HTTP error code 404: Not Found when trying to register any host - #38819

  • Not all subnets are shown on subnets page - #38804

  • DB tables which dynflow needs to run are being truncated in JS integration tests - #38794

  • Adjust tests to changes in scoped_search >= 4.3.0 - #38788

  • As a user I would like to see the overall status of each host in the list - #38786

  • Error in global registration script for ubuntu - #38781

  • Get rid of Grub (not grub2) - #38768

  • skip_failure option in foreman upgrade:run rake task does not work as designed - #38755

  • Hostgroup data not loaded if host created from Hostgroup Page - #38747

  • Selected organization check mark covers name in the UI - #38740

  • Update CardTemplate dropdown for PF5 - #38737

  • yggdrasil service not enabled - #38736

  • Get rid of lsb in provisioning templates - #38733

  • Debian 13 Network Based Deployment not working on UEFI: "Loading GRUB2 from ESP" results in fwsetup - #38732

  • No scroll bar while selecting Organization/Location from change associations on new All host UI page - #38722

  • Association scopes are not honored by scoped search autocompletion - #38718

  • generate report datepicker overlapping - #38715

  • RSS URL doesn't support IPv6 literal - #38713

  • Settings page is slow to respond to clicks and searches - #38708

  • Refactor EmptyStateComponent snapshot tests to RTL - #38704

  • run github js test on js scripts - #38700

  • Make sure NODE_OPTIONS have a default and are usr-overridable - #38696

  • "No hosts matched search, or action unauthorized for selected hosts" error comes while using the filter box in Content Host Errata Management - #38694

  • dev docs - ui tests - #38673

  • dev docs - ui troubleshooting - #38438

  • update notifications to pf5 - #38345

  • HostCounter is not resetted - #38303

  • Add common network config scenarios for Ubuntu template snapshots - #38229

  • Missing space in help text for provision method - #37780

  • Always load local disk's GRUB2 configuration - #37653

  • Missing installation media during Host Registration: ERROR: Validation failed: Medium must belong to host's operating system - #37602

  • Changing the association of a host to hostgroups via UI and API differs extemely - #37523

  • BMC Power reboot button incorrectly triggered shutdown instead of reboot - #3073

3.1.1. API

  • Interface object does not provide backlink to host - #38725

  • Backend system status widget does not display all plugins - #38667

  • We get "undefined method" error when trying to show non-existent settings via id - #38653

3.1.2. Compute resources

  • Fix CR VM json partial rendering - #38793

3.1.3. Compute resources - libvirt

  • Enhance Libvirt Compute resource to allow user to change default video card - #38886

3.1.4. Compute resources - oVirt

  • available_vnic_profiles.rabl is unused - #38846

3.1.5. Host creation

  • Host form - accept hostgroup_id & host[hostgroup_id params] - #38769

3.1.6. Host registration

  • Always force manage_repos to be enabled in rhsm.conf as a part of subscription_manager_setup snippet execution - #38866

  • When provisioning rhel9+ via fdi using static network information, localhost.localdomain will be created on Foreman webUI - #38855

  • Ensure registration fails when /unattended/built endpoint is unreachable - #38762

  • Global Registration tries to unregister the host twice with --force - #38644

3.1.7. Internationalization

  • Setting descriptions aren't translated anymore - #38735

  • Redundant translation tag with only an interpolation string in vmware template - #37838

3.1.8. Inventory

  • Allow ForemanContext to be extended from plugins - #38799

  • Host details kebab inconsistent ui - #38663

3.1.9. JavaScript stack

  • drop react-bootstrap pin in package.json - #38614

  • pin react-bootstrap renegerator-runtime to packaged version - #38598

3.1.10. Network

  • Can't register systems with bond interface named bond- AND a tagged vlan on the same interface - #38870

3.1.11. Packaging

  • Drop Ruby 2.7 support - #38115

3.1.12. Power management

  • Add BMC Smart Proxy to host.smart_proxy_ids - #38767

3.1.13. Search

  • Allow ordering on virtual columns - #38024

3.1.14. Security

  • CVE-2025-9572: GraphQL API permission bypass leads to information disclosure - #38913

  • CVE-2025-10622: OS command injection via ct_location and fcct_location parameters - #38885

  • Autocomplete feature for search shows content that should be forbidden by RBAC - #38727

3.1.15. Settings

  • Settings - Update value from response - #38795

3.1.16. Templates

  • Remove EOL OSes from kickstart default - #38647

  • Update links in partition tables - #38646

  • Support OpenVox Agent in Provisioning Template - #38624

  • ca_registration snippet does not update ca-trust on debian - #38318

  • The "CloudInit default" template is not designed to set or update the root password on deployed systems - #37901

3.1.17. Tests

  • Unstable integration tests - #38770

3.1.18. Unattended installations

  • Managed interfaces without subnet assigned should include options to not initialize them at boot time - #38750

  • Provisioning templates use host_enc macro to determine the realm - #38688

  • iPXE chain UEFI - Add support for multiple architectures - #38300

  • Display subscription-manager status in logs - #38136

3.1.19. Users, Roles and Permissions

  • User's organization and location membership is not propagated to authorization checks - #38731

  • user jwt ui warning - #38660

  • Handle invalid scope filter in UI - #38655

  • Filters are created as completely unlimited, ignoring parent taxonomy - #37987

3.1.20. Web Interface

  • New css variable for list color - #38884

  • replace all pf3 icon imports with pf5 icons - #38817

  • Allow TableIndexPage to accept and pass through a custom ouiaId prop - #38790

  • Add expand all rows functionality to the table component - #38629

3.2. Installer

3.2.1. External modules

  • Remove SCA-irrelevant event handling from broker filter - #38813

3.2.2. Foreman modules

  • Add support for foreman_ovirt plugin - #38921

  • puppet-foreman_proxy - tftp.pp - Do not create a directory for grub1 - #38791

3.3. Smart Proxy

  • Drop Ruby 2.7 support - #38883

  • PXE & iPXE configs in :tftp_root/host_config directory - #38820

  • BMC developer docs - #38803

  • Get rid of grub (not grub2) - #38772

  • Wrong/missing implementation of BMC proxy power operation - #38498

3.4. Hammer CLI

  • Password is not hidden in logs - #38894

3.5. Hammer CLI - Foreman

  • Remove unlimited and override fields for filters #38805

4. Katello 4.19.0

You can find the complete list of changes on Redmine.

4.1. Katello

  • Host#yum_or_yum_transient may return nil - #38672

  • undefined method `repository_url' for nil:NilClass - #37077

  • make it possible to run seeds/migrations after foreman was fully migrated/seeded - #37076

4.1.1. API

  • The rails 7 upgrade causes DNS aliased hostnames to error when pulling containers with podman - #38744

  • Remove Backend System Status widget - #38668

4.1.2. Container

  • Create a modal to display labels and annotations for manifests. - #38873

  • Untagged manifests remain tagged in Katello - #38865

  • Create a manifest details page for the container content UI - #38863

  • Create an expandable table for Synced image tags - #38850

  • Create a new route/page with tabs for Synced images and Booted images - #38812

  • Make it easier to add redhat remotes with UI help texts - #38810

  • Use certs for primary identification for hosts on katello registry - #38802

  • Update tag API results to return manifests and lists tagged by the docker tag - #38801

  • Long container push uploads result in authentication error - #38649

4.1.3. Content Views

  • Dependency solved CV publishes fail - #38821

  • Content View Filter Errata: error when searching by date - #38754

  • 500 error is creating rolling CV via API with no environments - #38726

  • Can't create CV from create CV form since empty environment id is passed for all CV types. - #38721

  • Error "Katello::Resources::Candlepin::Environment: 404 Not Found" When Deleting Rolling Content View - #38689

  • RPM filter rule deletes existing entries when a rule is edited - #38652

  • Few PF5 widgets have dynamic OUIA IDs on Contentview Page - #38635

  • Repo removal from a rolling CV does not trigger the Capsule sync - #38561

  • Extend rolling content views to arbitrary lifecycle environments - #38477

  • Content view environments endpoint does not work well with FAM - #38443

  • Version option for deb filter rules - #37729

4.1.4. Errata Management

  • /hosts/bulk/applicable_errata API is listing installable hosts - #38824

  • Errata applicability and Refresh applicability tasks for RHEL 7 hosts runs dnf command - #38797

  • Host details content page does not display 'other' type errata - #38005

4.1.5. Foreman Proxy Content

  • Pulpcore 3.85 breaks n-1 capsule syncing: gpgcheck cannot be nil - #38808

  • Trigger Capsule content repair from UI - #38662

4.1.6. Hosts

  • As a user I want to be able to change the host collection of multiple hosts - #38829

  • Debian repos are shown multiple times on the new host details page in repo sets for multi-cves - #38699

  • Bulk Errata Wizard should only show installable Errata - #38687

  • Need an option to retain build profile information like cve, lce and ks repo id on unregistering hosts - #38671

  • in host-details-kebab- update to non deprecated dropdown - #38666

  • Add Debian support to the new All Hosts --> Manage packages wizard - #38186

4.1.7. Inter Server Sync

  • incremental exports broken when using destination server and no history id - #38775

  • Incremental repository export fails on syncable content unless --format syncable is passed - #38637

4.1.8. Organizations and Locations

  • Attempts to set cdn_configuration on downstream SAT organization fails due to RH Cloud controller overwrites - #38723

  • Raw backend error displayed on submitting blank 'New Organisation' form - #38701

4.1.9. Reporting

  • Add "updated" to the Erratum Jail - #38816

4.1.10. Repositories

  • Missing product ID arg shows Ruby error when mirroring flatpak - #38874

  • Repetitive recalculation of Katello::RepositoryTypeManager.enabled_repository_types makes katello:correct_repositories very slow - #38838

  • Temporarily pin pulp-rpm-client to 3.32.2 to avoid remote response error - #38831

  • Index PRN IDs on all new / updated Pulp entities - #38809

  • Adjust tests to changes in scoped_search >= 4.3.0 - #38792

  • Error while synchronizing concurrently RPM content - PG::TRDeadlockDetected: ERROR: deadlock detected - #38789

  • Populate PRN columns for Repository versions - #38778

  • Refactor Flatpak pages to use TableIndexPage component - #38776

  • Populate PRN fields for DB records in a migration - #38751

  • Add pulp prn fields to katello tables with a db migration - #38743

  • Migrate all deb content to use structured APT - #38741

  • Sync of "flat" Nagios deb repos fails with message: Paths are duplicated - #38710

  • Clean duplicate erratum packages before bigint migration - #38685

  • Repo discovery Registry Search Parameter Default:* (search all) can return incomplete results - #38675

  • Incorrect APT Pinning Priority for Debian Backports in Katello Repositories - #38471

4.1.11. Roles and Permissions

  • Adjust tests to taxonomy checks being done as part of authorization checks - #38844

  • Wrong error message when trying to disable a Red Hat Repository - #28369

4.1.12. Subscriptions

  • Katello should not send cp-consumer or cp-user header to hosted Candlepin - #38845

  • Remove entitlement-mode-related Dynflow and API references - #38823

  • Remove handling of entitlement-mode-related Candlepin events - #38814

  • Calls to upstream Candlepin consumer fail when using an apiUrl from manifest - #38724

4.1.13. Tests

  • UpdateRollingTest sometimes fails based on array order - #38745

  • Random content unit test failures - #38670

4.1.14. Tooling

  • Upgrade Pulpcore to 3.85 - #38748

Appendix A: Foreman contributors

We’d like to thank the following people who contributed to the Foreman 3.17 release:

Adam Lazik, Adam Růžička, Archana Kumari, Arvind Jangir, Bastian Schmidt, Ben Ford, Bernhard Suttner, Brian Witt, Chris Roberts, Dieter Maes, dosas, Eric Helms, Evgeni Golov, Ewoud Kohl van Wijngaarden, Francesco Di Nucci, Frank Wall, Hiroshi Ikuta, Jan Löser, Jeremy Lenz, Joniel Pasqualetto, Kenyon Ralph, kmalyjur, Konstantinos Familonidis, Leos Stejskal, Lisa Bekdache, Lucy Fu, Lukas Hellebrandt, Lukas Jezek, Lukas Magauer, Maria Agaphontzev, Markus Bucher, Markus Reisner, Matt Darcy, Nadja Heitmann, Oleh Fedorenko, Ondřej Gajdušek, Pat Riehecky, pavanshekar Quirin Pamp, Robert Everson, Romain Tartière, Sayan Das, Shimon Shtein, Shubham Ganar, Takashi Kajinami, Tim Meusel, Vanou Ishii, Waldirio M Pinheiro, Yusuke Hirota

As well as all users who helped test releases, report bugs and provide feedback on the project.

Appendix B: Katello contributors

We’d like to thank the following people who contributed to the Katello 4.19 release:

Adam Růžička Arvind Jangir Baptiste Agasse Evgeni Golov hstct Ian Ballou Jeremy Lenz Lucy Fu Lukáš Hellebrandt Maria Markus Bucher Maximilian Kolb Nadja Heitmann Partha Aji pavanshekar Pavan Soma Shekar Peter Ondrejka Quinn James Quirin Pamp Samir Jha Zachary Huntington-Meath

As well as all users who helped test releases, report bugs and provide feedback on the project.

Pre-release version Report issue