1. Headline features

1.1. User interface & experience

Foreman recurring tasks use standardized rake tasks and systemd timers

In this release, recurring Foreman maintenance tasks are no longer managed by ad‑hoc cron jobs. Instead, they now run through a standardized set of rake tasks, managed in /etc/cron.d/foreman. This change provides a more container‑native approach and enables plugins to register their tasks by using the Foreman::Cron framework.

Foreman core provides the following rake tasks:

  • foreman-rake cron:hourly

  • foreman-rake cron:daily

  • foreman-rake cron:weekly

  • foreman-rake cron:monthly

Users can no longer freely customize arbitrary schedules for these core recurring jobs. This is an intentional limitation to keep behavior more predictable and maintainable.

Important

During upgrade, existing cron schedules are not automatically detected or preserved. After upgrading, recurring jobs run on the new standardized schedules. If you previously relied on custom timings, review the new behavior and adjust any custom automation.
All Hosts page improvements

The All Hosts page has been enhanced for easier management of host collections and system purpose. You can now more efficiently make changes for multiple hosts at once.

React migration and PatternFly 5 components

Foreman 3.19 continues the UI modernization with migration of the Models page to React and updates to PatternFly 5 components including ActionButtons, PersonalAccessTokens, Charts (Area, Bar), and PageLayout. This provides improved performance and accessibility.

Notification management improvements

New features for managing notifications allow cleaning up all notifications or filtering by blueprint, with improved display of server messages in the UI and better notification title visibility.

1.2. Infrastructure & platform updates

Agama installer support

Added support for the Agama installer (SLES16), expanding Foreman’s provisioning capabilities for SUSE Linux Enterprise systems.

2. Upgrade warnings

HTTPS-only host registration

Host registration now uses HTTPS for the /unattended/built endpoint. This means that registration no longer requires Port 80, and it is not possible to use Port 80 during registration.

Registration template cleanup

The redhat_register snippet has been updated to remove references to deprecated Spacewalk and auto-attach functionality. Custom templates extending this snippet may need updates.

3. Deprecations

Hammer CLI plugin Admin is deprecated

As an alternative, you can use the foreman-installer to manage your Foreman server or Smart Proxy server.

PatternFly 3 components

The following PatternFly 3 components are deprecated and will be removed in a future release. Migrate to PatternFly 5 equivalents:

  • PF3-based table implementation

  • Unused PF3 buttons

  • PF3-based SearchInput component

  • RedirectCancelButton

Form components

Multiple form-related components have been deprecated in favor of PatternFly 5 alternatives:

  • forms/Form.js

  • forms/TextField

  • forms/RadioButtonGroup

  • forms/DateTime

  • Multiple components in common/forms/*

Use the PatternFly 5 form components for new development.

4. Foreman 3.19.0

You can find the complete list of changes on Redmine.

4.1. Foreman

  • TableIndexPage does not show server messages correctly - #39285

  • Use new_host_path for Notification - #39279

  • Support to clean up all notifications - #39278

  • Unused prop "showHide" in Editor - #39273

  • Navigation search shortcut placeholder - #39243

  • Deprecate PF3-based table implementation - #39235

  • CVE-2026-24001 nodejs-diff: denial of service vulnerability in parsePatch and applyPatch - #39234

  • Broken Apipie DSL cache generation and help section in live docs - #39233

  • Host deletion notification is gone after page refreshed on host delete on new host ui - #39227

  • Fix RHSM OS race condition reintroduced by recent refactor - #39226

  • Authorizer checks cause queries to include unnecessary taxonomy-related joins - #39209

  • Migrate Model Pages to React - #39200

  • Update ActionButtons to PF5 - #39182

  • All hosts- Add action – Configure Notifications - #39181

  • Facts upload fails due to new Cloud Billing - #39180

  • Deprecate unused PF3 buttons - #39174

  • Deprecate PF3-based common/SearchInput component - #39171

  • Fix of #38972 could make existing Foreman environment doesn't work - #39165

  • Update PF3 components in PersonalAccessTokens with PF5 components - #39164

  • Deprecate RedirectCancelButton - #39160

  • Exclude last_used_at from PersonalAccessToken auditing to prevent taxable_taxonomies bloat - #39158

  • Move robottelo test to upstream - #39152

  • Update developer docs for Foreman::Cron - #39151

  • Reports still reference obsolete subscription data - #39127

  • Foreman UI Displays Wrong Number of Hosts When Filter By Report Origin (Puppet , Ansible) - #39110

  • power manager should allow proxmox values - #39109

  • Fix taxonomy creation for unprivileged users due to callback ordering and cache issues - #39106

  • typo POWER_REQURST_KEY should be POWER_REQUEST_KEY - #39105

  • Ubuntu Autoinstall (preseed cloud-init) does not apply `time-zone` - #39100

  • Deprecate multiple components in common/forms/* - #39098

  • Deprecate forms/TextField - #39097

  • Deprecate forms/RadioButtonGroup - #39096

  • Deprecate forms/DateTime - #39095

  • Allow to overwrite boot_order for libvirt - #39094

  • Update Table component to wrap table headers for better readability - #39086

  • Rebuild host only if host turned off - #39067

  • update EditorHostSelect to pf5 - #38916

  • Support for Agama installer (SLES16) - #38877

  • Power status icon in new All Hosts page needs to be centered - #38749

  • deprecate foremans forms/Form.js - #38470

  • Deprecate bindMethods function as it is not used anywhere in Foreman - #36455

  • db:seed should run on every upgrade even if there are no changes to seed files directly - #35375

4.1.1. API

  • Allow VM ids with dots in the compute_resources controller - #39123

  • Importing from a compute resource with a UUID parameter is not documented - #38526

4.1.2. BMC

  • Redfish power operation fails due to certificate authentication error with FQDN - #38972

4.1.3. Development tools

  • dev docs - Patternfly 3 to Patternfly 5 guidance - #39166

4.1.4. Host registration

  • redhat_register snippet still has references to Spacewalk and auto attach - #39272

4.1.5. Inventory

  • Accessing new host index page without view hosts permission displays the page with a 403 error - #39103

  • Host status is not recalculated on new All Hosts page, leading to stale values possibly being displayed - #39068

  • New All Hosts - Change Hostgroup modal has bad UX while hostgroups are loading - #38760

4.1.6. JavaScript stack

  • JS lint in plugins fails if package is only defined in core - #39063

4.1.7. Notifications

  • Notifications title is cut by the header when instance title is set - #39069

4.1.8. Orchestration

  • Compute orchestration methods setCompute and delCompute run on unmanaged hosts - #39142

4.1.9. Packaging

  • CVE-2026-33176: Active Support Denial of Service via large scientific notation strings - #39190

  • Install libffi-devel to be able to build fiddle - #39124

4.1.10. Reporting

  • Cloning a locked report template via Hammer creates a locked clone - #39173

4.1.11. Security

  • CVE-2026-1961: Remote Code Execution via command injection in WebSocket proxy - #39121

4.1.12. Templates

  • Can't clone locked Partition table in API - #39176

  • All communication should happen only over https during global registration execution - #39131

  • db:seed should report failing template - #35316

  • iPXE bootstrap and global handling is incorrect - #32563

4.1.13. Tests

  • Allow plugins to import core js test config - #39144

4.1.14. Unattended installations

  • openSUSE Leap 15 provisioning not working - #36947

4.1.15. VM management

  • VMware - Normalize firmware type in clone args - #39310

4.1.16. Web Interface

  • AutocompleteInput doesn't allow to select typed value - #39311

  • prevent global override of radio position - #39275

  • Add helper method for handling bulk modal states after removal of ForemanModal - #39134

  • Update Area Chart to PatternFly5 - #39070

  • Update PageLayout to use PF5 - #39059

  • Update BarChart to Patternfly5 - #38879

4.2. Hammer CLI - Foreman

  • Provide empty provider_vm_specific_fields in cr::base - #39126

  • Always print vm data, even if the provider is absent - #39125

4.3. Installer

  • Registration command generation via REST API fails on Smart Proxy servers in isolated networks - #39119

4.3.1. Foreman modules

  • Add Apache config support for `/pypi` in puppet-pulpcore - #39242

  • Configure container gateway DB max connections and pool timeout - #39093

4.4. Packaging

4.4.1. Debian/Ubuntu

  • Migrate Foreman DEB packaging to use consolidated cron entrypoints - #39161

4.4.2. RPMs

  • Migrate Foreman RPM packaging to use consolidated cron entrypoints - #39089

  • lodash: Bump from 4.17.21 to 4.17.23 due to CVE-2025-13465 - #39081

4.5. Smart Proxy

  • Boot order cannot be changed to PXE via Redfish (ETag required but not handled) - #38914

4.5.1. BMC

  • IP address not retrieved when using SSH API of BMC - #38973

4.5.2. Tests

  • smart-proxy test failures due to rake 13.4.2 breaking ci_reporter_test_unit - #39315

Appendix A: Foreman contributors

We’d like to thank the following people who contributed to the Foreman 3.19 release:

Adam Lazik, Adam Růžička, Alexander Olofsson, Andrei Lakatos, Archana Kumari, Bastian Blank, Bernhard Suttner, Christian Paruzel, Cole Higgins, Danny Synk, Dirk Götz, Evgeni Golov, Ewoud Kohl van Wijngaarden, Gene Liverman, Jakub Duchek, Jeremy Lenz, Jonathon Turel, Karolina Malyjurkova, Ladislav Vasina, Leos Stejskal, Lucy Fu, Lukas Hellebrandt, Lukas Jezek, Lukáš Ježek, Marek Hulán, Maria Agaphontzev, Markus Bucher, Nadja Heitmann, Nofar Alfassi, Odilon Sousa, Oleh Fedorenko, Ondřej Gajdušek, Pablo Méndez Hernández, Pavan Soma Shekar, Peter Ondrejka, Shubham Ganar, Susumu Sakamoto, Tim Meusel, Vanou Ishii, Yury Bushmelev, Yusuke Hirota, Zach Huntington-Meath, andreilakatos, rvasikarla, tlabaj

As well as all users who helped test releases, report bugs and provide feedback on the project.

Pre-release version Report issue