1. Headline features

1.1. User interface & experience

TypeScript support for the frontend

The Foreman frontend can now use TypeScript, giving contributors static typing and better editor tooling when working on frontend code.

1.2. Infrastructure & platform updates

Ruby 3.3 support

Foreman can now run on Ruby 3.3.

settings.d support

Foreman settings can now be split across multiple files in a settings.d directory instead of a single settings file.

For example, instead of editing config/settings.yaml directly, you can create config/settings.d/10-local.yaml with just the keys you want to override:

---
:require_ssl: true

Files in config/settings.d/ are loaded in sorted filename order, after config/settings.plugins.d/*.yaml, so they can override both the defaults in config/settings.yaml and any plugin-provided settings.

1.3. Documentation & tooling

(Containerized deployments only) Documentation is incomplete at time of release

Documentation is not yet complete and does not describe the complete set of functionality available in containerized deployments. This is work in progress and we are continuously adding the remaining documentation to our guides, as we continue verifying that the described functionality is working as expected in containerized deployments.

2. Upgrade warnings

Smart Proxy TLS configuration parameters have been renamed

The ssl_disabled_ciphers and tls_disabled_versions Smart Proxy parameters have been replaced by tls_ciphers and tls_min_version.

  • ssl_disabled_ciphers (an array of cipher suites to disable) is replaced by tls_ciphers (an OpenSSL cipher string). When unset, the Smart Proxy auto-detects: PROFILE=SYSTEM if crypto-policies are present, otherwise HIGH.

  • tls_disabled_versions (an array of TLS versions to disable) is replaced by tls_min_version (a single minimum version: 1.0, 1.1, 1.2, or 1.3). When unset, the minimum version is determined by the system OpenSSL configuration.

If you customized these settings through foreman-installer, the old parameters are automatically removed during upgrade. No automatic migration of values is performed. If you previously set custom TLS cipher or version restrictions, reconfigure them using the new parameters after upgrading.

3. Deprecations

There are no deprecations with Foreman 5.0.

4. Foreman 5.0.0

You can find the complete list of changes on Redmine.

4.1. Foreman

  • Rubocop/CI job fails in GitHub Actions: cap2 gem fails to compile, missing libcap-dev - #39600

  • PageLayout uses PF3 layout of Breadcrumbs instead of PF5 - #39592

  • Loosen upper bound on scoped_search - #39588

  • Subnet: invalid mask bypasses validation when the network address contains a CIDR suffix - #39572

  • Update eslint-plugin-rules require-ouiaid with PF5 components - #39562

  • Remove unused NumericInput and drop the rc-input-number dependency - #39558

  • Automatically change title to text in APIActions toast handlers text - #39547

  • Add configurable CA cert to LDAP auth source - #39534

  • Add host parameter to skip rhsm registration for RHEL hosts and use the redhat_register snippet instead - #39521

  • Add audits for user login / logout / failed logins - #39512

  • Update EditorNavbar and EditorRadioButton components to PF5 and the tests to RTL - #39507

  • Update OrderableSelect to PF5 - #39505

  • package upgrade did upgrade all packages - #39499

  • Update EditorOptions to PF5 and it's tests to RTL - #39497

  • Update EditorSettings to PF5 and it's tests to RTL - #39496

  • Replace forms/FormField to PF5 - #39486

  • deprecate ForemanForm - #39485

  • Refactor HOC Enzyme tests to RTL - #39472

  • Refactor Component Wrapper Enzyme tests to RTL - #39468

  • taxonomies.ignore_types being a yaml-serialized array prevents exact db-level operations - #39465

  • error toasts for disassociate and change owner are not shown - #39463

  • Update DiffModal in config reports to PF5 - #39461

  • Refactor long date time Enzyme tests to RTL - #39460

  • Replace JS snapshot tests - TokenLifeTime field - #39459

  • Replace JS snapshot tests - Taxonomies field - #39458

  • Replace JS snapshot tests - Repository field - #39457

  • Replace JS snapshot tests - HostGroup field - #39455

  • Replace JS snapshot tests - General component - #39454

  • Replace JS snapshot tests - ConfigParams field - #39453

  • Replace JS snapshot tests - Command component - #39452

  • Replace JS snapshot tests - Advanced component - #39451

  • Refactor ISO Date Enzyme tests to RTL - #39450

  • Replace JS snapshot tests - AuditsPageSelectors - #39445

  • Replace JS snapshot tests - AuditsPageActions - #39443

  • Replace JS snapshot tests - LoginPage - #39442

  • Replace JS snapshot tests - AuditsPage - #39439

  • Refactor Relative date time Enzyme tests to RTL - #39436

  • Refactor Short Date Time Enzyme tests to RTL - #39435

  • Refactor ConfirmModal Enzyme tests to RTL - #39431

  • Fix padding in register host page - #39422

  • sudo-rs on Ubuntu 26.04 does not support requiretty - #39417

  • Developer docs are out of date at places - #39416

  • Move FieldConstructor from webhooks plugin to core - #39408

  • Move reusable Area chart functions to helpers - #39403

  • Deprecate MessageBox and replace it with EmptyState - #39401

  • reusable empty state page - #39395

  • Add script to handle running plugin tests in multiple ways inspired by ktest - #39391

  • REX job "Schedule a job" with "select all" check does not run for any host - #39389

  • hosts index page loads full Host objects when only hostgroup_ids are needed - #39381

  • Bump safemode to 2.0 - #39370

  • Deprecate Loader and update its usage to PF5 - #39366

  • Add Ruby 3.3 support to Foreman - #39361

  • Deprecate LineChart wrapper in Foreman core - #39357

  • Add support for `settings.d` - #39347

  • Merge page logic and styles from TableIndexPage to PageLayout - #39340

  • N+1 queries when loading taxonomy descendants - #39336

  • Add additive fact import mode - #39299

  • Use bulk insert for new fact values on persisted hosts - #39298

  • container_certs_setup snippet missing cert directories for load balancer backend hostnames - #39193

  • Subnet UI allows CIDR in Network Address causing duplicated prefix (/24/24) - #39159

  • Update host vmware form to PF5 - #38992

4.1.1. Authentication

  • SSO login via Apache OIDC fails with a 500 Internal Server Error on Ruby 3.2 - #39099

4.1.2. BMC

  • Specifying organization_id/location_id in hammer host boot causes ERF42-5227 unknown parent permission error - #39374

  • Remove SSH provider for BMC in foreman - #39321

4.1.3. Inventory

  • Host actions are disabled after bulk action - #39538

  • Registration form checkboxes not vertically aligned with text - #38674

4.1.4. JavaScript stack

  • Share time unit JS consts for plugins - #39568

  • Add PF lint rules: prefer-pf-components/props - #39513

  • update ui test guidelines and best practices - #39438

  • add no-magic-numbers js lint rule - #39383

  • TypeScript support for the frontend - #39137

  • Update CounterInput component to PF5 - #39056

4.1.5. Logging

  • foreman-rake drops RAILS_LOG_TO_STDOUT and writes production.log during RPM install (Containerised installation) - #39536

4.1.6. Organizations and Locations

  • Exclude host taxonomies that don't match the Smart Proxy taxonomies from used_taxonomy_ids - #39220

4.1.7. Rails

  • Missing validation for domain name input under Infrastructure in Foreman UI - #39287

4.1.8. Rake tasks

  • Provide a way for plugins to run a predefined subset of core tests - #39545

4.1.9. Reporting

  • Errata severity macro is not available in 'Host - Applied Errata' report - #39334

  • Add still_applicable column to Host - Applied Errata report template - #39212

4.1.10. Security

  • CVE-2026-5138: Information disclosure via improper validation of nested request parameters - #39481

  • CVE-2026-5135: Unauthorized modification of host configurations via broken access control - #39480

  • CVE-2026-5142: Cross-tenant private SSH key disclosure via taxonomy scoping bypass - #39479

  • CVE-2026-5136: Privilege escalation via usergroup role assignment manipulation - #39478

4.1.11. Smart Proxy

  • SmartProxy model should be able to find smart proxies located on the same host - #39574

  • auth_smart_proxy can set @detected_proxy incorrectly - #39570

  • Track and surface unrecognized Smart Proxy features - #39413

4.1.12. Templates

  • Allow custom pre-install script in kickstart default template - #39293

4.1.13. Users, Roles and Permissions

  • I'd like to enable/disable users directly from the users table - #39474

4.1.14. VM management

  • VMware - Normalize firmware type in clone args - #39310

4.1.15. Web Interface

  • Apply pf-v5-c-page--BackgroundColor to #rails-app-content - #39593

  • Fix React tables toolbar alignment - #39523

  • Hide count in SelectAllCheckbox when unavailable - #39475

  • Foreman performs bulk actions on hosts in different location then marked - #39437

  • Update TableIndexPage ActionButtons OuiaId to be customizable. - #39426

  • Some links still redirect to the old /hosts page - #39396

  • AutocompleteInput doesn't allow to select typed value - #39311

  • Host search breaks when using % in search bar - #39302

  • Add Stylelint rule to block global css overrides - #39276

  • Web UI -> Infrastructures -> Smart Proxies page takes long time to load - #38275

4.2. Hammer CLI - Foreman

  • Implement LDAP CA certs support - #39537

4.2.1. Proxy

  • Display unknown proxy features, if there are any - #39414

4.3. Installer

  • katello-certs-check can sometimes not be used with wildcards - #39546

4.3.1. Foreman modules

  • Warn about unrecognized smart proxy features - #39415

4.4. Packaging

  • Remove unused nodejs-rc-input-number - #39561

4.5. SELinux

  • Foreman policy uses deprecated functions - #39343

4.5.1. Smart proxy

  • Proxy policy can't be compiled on EL10 - #39342

4.6. Smart Proxy

  • Add tls_min_version and tls_ciphers to smart proxy - #39405

  • Cache global registration script in smart-proxy - #39208

4.6.1. BMC

  • Expose bmc_default_provider setting via v2/features API - #39320

  • Identify LED operations do not support LocationIndicatorActive, failing on BMCs where IndicatorLED is deprecated - #39301

  • Identify LED on operation fails due to invalid IndicatorLED value On - #39300

4.6.2. Tests

  • smart-proxy test failures due to rake 13.4.2 breaking ci_reporter_test_unit - #39315

Appendix A: Foreman contributors

We’d like to thank the following people who contributed to the Foreman 5.0 release:

Adam Lazik,Adam Růžička,Alexander Olofsson,Alleny244,Andrei Lakatos,Arvind Jangir,Bernhard Suttner,Danny Synk,Eric Helms,Evgeni Golov,Gerald Vogt,Ian Ballou,Jakub Duchek,Jeremy Lenz,Karolina Malyjurkova,Leos Stejskal,Lucy Fu,Lukas Hellebrandt,Lukas Jezek,Lukas Pramuk,Marek Hulán,Maria Agaphontzev,Matt Darcy,Michal Gritzbach,Nadja Heitmann,Odilon Sousa,Oleh Fedorenko,Ondřej Gajdušek,Pablo Méndez Hernández,Pascal Kontschan,Pavan Soma Shekar,Peter Ondrejka,Quinn James,Sam Bible,Samir Jha,Shubham Ganar,Thorben Denzer,Tim Meusel,Titani Labaj,Yusuke Hirota,Zachary Huntington-Meath

As well as all users who helped test releases, report bugs and provide feedback on the project.

Pre-release version Report issue