1. Headline features

1.1. Infrastructure & platform updates

GRUB1 template support removed

Legacy GRUB (GRUB1) templates are no longer supported. Most distributions switched to GRUB2 by 2014, and maintaining GRUB1 support was causing compatibility issues with newer systems. Systems still using GRUB1 for provisioning must migrate to GRUB2 before upgrading.

1.2. Networking & connectivity

SSH certificate support for remote execution

Smart Proxies can now use SSH certificates signed by a trusted certificate authority (CA) during remote execution connections. By enabling this feature, you can avoid the default Trust on First Use (TOFU) model, and benefit from centralized trust management and revocation capabilities.

2. Upgrade warnings

NodeJS 18 no longer supported

NodeJS 18 support has been removed. Foreman now requires NodeJS 22 or later for development and building assets.

Application Centric Deployment (ACD) plugin removed

The ACD plugins for Foreman server and Smart Proxy servers have been removed. Ensure that you uninstall the plugin before upgrading to Foreman 3.18. For more information, see Deinstallation in foreman_acd.

3. Deprecations

ForemanModal component deprecated

The ForemanModal component in Foreman core is now deprecated. If you are a plugin maintainer, migrate your plugin to PatternFly 5 modal components.

PatternFly 3 select form field deprecated

The PatternFly 3 select form field component is deprecated. PatternFly 5 Select components are used instead.

4. Foreman 3.18.0

You can find the complete list of changes on Redmine.

4.1. Foreman

  • Remove exit calls from recurring rake tasks - #39057

  • Login delegation logout URL fails to redirect to external auth source - #39053

  • PostgreSQL process name pattern is wrong in PCP foreman-hotproc config file - #39050

  • Deprecate ForemanModal in the core - #39048

  • saltstack_setup: Use systemctl to enable salt-minion instead of chkconfig - #39043

  • pry-remote does not work at all when pry-byebug is enabled - #39039

  • Fix action button handling for plugins - #39038

  • BIOS info is not populated in All hosts page and in Host Details tab - #39036

  • Add new dynflow table to schema dumper ignore list - #39035

  • Replace useForemanModal in HostsIndex - #39027

  • Hide taxonomy options from API docs for taxonomy resources - #39025

  • Hosts index page incorrectly uses array index as React key for table rows - #39016

  • User.current not reloadable in dev console environment - #39014

  • Scoped order is ignored, it's forced to be batch order error displayed on application startup - #39007

  • ForemanContext app metadata registry values are only evaluated at app startup; should be evaluated at runtime instead - #38986

  • HostsController#template_used - find resource in before_action - #38983

  • Drop NodeJS 18 support - #38979

  • Allow newer dynflow - #38975

  • Fix NTP config in autoyast - #38959

  • Add Foreman::Cron and cron:* rake tasks as generic entrypoints for recurring jobs - #38956

  • Run power state bulk action on new Host Overview page - #38948

  • test/unit/puppet_fact_parser_test.rb tests are failing - #38944

  • Implement CSV exports on the hosts overview - #38941

  • Web UI: Kebab menu on Hosts > All Hosts does not close when clicking anywhere on screen - #38936

  • Cannot perform LEAPP upgrade when RHEL 9.7 os object already exists - #38930

  • Show logo on new host overview page - #38926

  • Webhook Events for config_report event - #38915

  • Host #template_kinds does not return image template kind when compute attributes are not set - #38910

  • Add Cloud Billing Details card to Host Details page - #38888

  • Support for Agama installer (SLES16) - #38877

  • Search is cleared when using bottom pagination on All Hosts page - #38858

  • Move AutocompleteInput to foremanCore - #38852

  • Update InputFactory component to PF5 - #38842

  • Introduce SSH certificate support in templates - #38499

  • Automatic firmware selection for VMware is not working on the `compute_attributes` form - #37834

  • Add snapshot tests for global_registration.erb - #37789

4.1.1. Compute resources

  • Not all old GCE files are cleaned up - #39020

4.1.2. Compute resources - OpenStack

  • Add support for assigning fixed IPv4 addresses to OpenStack hosts - #38742

4.1.3. DB migrations

  • Remove grub templates - #38974

4.1.4. Host creation

  • Add logging to Unattended#host_template - #39023

4.1.5. Inventory

  • Change Hostgroup form on new UI needs to show full nested structure, not just names - #38827

  • Manage Columns modal extends offscreen and hides Save button - #38761

  • Manage columns does not pre-check boxes of displayed columns for users without table preferences - #38453

4.1.6. JavaScript stack

  • Add global css override for PF lists and labels - #39033

  • Deprecate pf3 select form field - #38998

  • Add @patternfly/react-templates - #38978

4.1.7. Logging

  • Log file count can reach max int for `logs_id_seq` - #38949

4.1.8. Notifications

  • Notifications title is cut by the header when instance title is set - #39069

4.1.9. Orchestration

  • Queue Orchestration::Templates only for Host::Managed class - #38976

4.1.10. Parameters

  • scoped_search fails with undefined method `subtree_ids' for nil:NilClass when host belongs to a hostgroup and hostgroup parameter is orphaned - #39002

  • Fix host_param macro to include transient parameters for new hosts - #38939

4.1.11. Reporting

  • Add Cloud Billing Metadata inclusion options to Host - Installed Products report template - #38920

4.1.12. Security

  • CVE-2025-9572: GraphQL API permission bypass leads to information disclosure - #38913

4.1.13. Templates

  • Fix NoMethodError in provisioning templates during dual-stack fallback - #39046

4.1.14. Tests

  • Subnet factories use the wrong proxy for HTTPBoot feature - #39045

  • Remove static wrapper methods for host fixtures in TemplateSnapshotService - #39044

  • "should update libvirt compute resource with locs" test is flaky due to array ordering differences - #39037

  • Preseed snapshots are not validated in tests - #39012

  • cloud-init snapshots are not validated in tests - #39006

  • Provisioning snapshots for Debian use RHEL-style partition table - #39005

  • Update ForemanContext mock to include all metadata - #39004

  • Improve output of KS validation test - #39001

  • Kickstart snapshots for EL10 are missing during tests - #38999

  • Refactor Slot.test.js to react testing library - #38971

  • Fix snapshot generation to generate the correct subnets - #35779

4.1.15. Unattended installations

  • Unattended::HostFinder - track search method - #39029

  • Support multiple timesource --ntp-server entries - #38173

4.1.16. Users, Roles and Permissions

  • Context-based permission management in React frontend - #37665

4.1.17. Web Interface

  • Update DateTimePicker to pf5 - #38962

  • Breadcrumb switcher for Module stream details shows multiple entries - #38895

  • Add a 'Compact' UI setting for tables - #38322

4.2. Installer

  • Add salt minimum auth version - #38964

  • Add support for openbolt plugin - #38963

  • Remove ACD plugin from installer - #38841

4.3. SELinux

4.3.1. Plugins

  • SELinux prevents foreman_kubevirt from connecting to the OpenShift API - #38987

4.4. Smart Proxy

  • Smart Proxy breaks IPMI support - #38783

Appendix A: Foreman contributors

We’d like to thank the following people who contributed to the Foreman 3.18 release:

Adam Lazik, Adam Růžička, Adrian Parreiras Horta, Archana Kumari, Arvind Jangir, Bernhard Suttner, Chris Roberts, EnigmaXV, Eric Helms, Evgeni Golov, Ewoud Kohl van Wijngaarden, Francesco Di Nucci, Giovanni Formisano, Jeremy Lenz, Jonathon Turel, Kajinami Takashi, Kenyon Ralph, Konstantinos Familonidis, Leos Stejskal, Lucy Fu, Lukas Jezek, MarcWort, Maria Agaphontzev, Markus Reisner, Maximilian Kolb, Nadja Heitmann, Nakul Pathak, Nofar Alfassi, Oleh Fedorenko, Ondřej Gajdušek, Pablo Méndez Hernández, Pat Riehecky, Peter Ondrejka, Ryan, Shimon Shtein, Takashi Kajinami, Thorben Denzer, Tim Meusel, Titani Labaj

As well as all users who helped test releases, report bugs and provide feedback on the project.

Pre-release version Report issue