1. Foreman 5.0 release notes

1.1. Headline features

1.1.1. User interface & experience

TypeScript support for the frontend

The Foreman frontend can now use TypeScript, giving contributors static typing and better editor tooling when working on frontend code.

1.1.2. Infrastructure & platform updates

(Containerized deployments only) Enterprise Linux 10 support

Foreman 5.0 introduces support for running Foreman server and Smart Proxy servers on Enterprise Linux 10, but only for containerized deployments managed with foremanctl.

Running Foreman through the RPM installer on Enterprise Linux 10 is not supported, and there is currently no migration path from an RPM-installer-based installation to a foremanctl-based one. This migration path is planned for an upcoming Foreman release. If you run Foreman through the RPM installer, remain on your current, supported Enterprise Linux release until migration guidance is available.

For more details, see the EL10 RPM rebuild announcement.

Ruby 3.3 support

Foreman can now run on Ruby 3.3.

settings.d support

Foreman settings can now be split across multiple files in a settings.d directory instead of a single settings file.

For example, instead of editing config/settings.yaml directly, you can create config/settings.d/10-local.yaml with just the keys you want to override:

---
:require_ssl: true

Files in config/settings.d/ are loaded in sorted filename order, after config/settings.plugins.d/*.yaml, so they can override both the defaults in config/settings.yaml and any plugin-provided settings.

1.1.3. Documentation & tooling

(Containerized deployments only) Documentation is incomplete at time of release

Documentation is not yet complete and does not describe the complete set of functionality available in containerized deployments. This is work in progress and we are continuously adding the remaining documentation to our guides, as we continue verifying that the described functionality is working as expected in containerized deployments.

1.2. Upgrade warnings

Smart Proxy TLS configuration parameters have been renamed

The ssl_disabled_ciphers and tls_disabled_versions Smart Proxy parameters have been replaced by tls_ciphers and tls_min_version.

  • ssl_disabled_ciphers (an array of cipher suites to disable) is replaced by tls_ciphers (an OpenSSL cipher string). When unset, the Smart Proxy auto-detects: PROFILE=SYSTEM if crypto-policies are present, otherwise HIGH.

  • tls_disabled_versions (an array of TLS versions to disable) is replaced by tls_min_version (a single minimum version: 1.0, 1.1, 1.2, or 1.3). When unset, the minimum version is determined by the system OpenSSL configuration.

If you customized these settings through foreman-installer, the old parameters are automatically removed during upgrade. No automatic migration of values is performed. If you previously set custom TLS cipher or version restrictions, reconfigure them using the new parameters after upgrading.

1.3. Deprecations

There are no deprecations with Foreman 5.0.

2. Katello 5.0 release notes

2.1. Headline features

Content Credentials redesigned and now generally available

The Content Credentials page has been redesigned for an enhanced user experience using the PatternFly 5 design standard, ensuring a more consistent experience with other redesigned pages. Create and delete functionality is now available directly from the Content Credentials overview page. Content Credentials have also been moved out of the Labs section and are now a fully supported feature.

Container gateway on containerized Smart Proxies

Katello now supports synchronizing the container gateway on containerized Smart Proxies. Previously this was only supported for Smart Proxies installed through RPM.

DEB tracer support

The Host Details Traces tab now supports DEB content, bringing DEB host management to parity with RPM hosts.

Subscriptions page migrated to PatternFly 5

The Subscriptions and Add Subscriptions pages have been migrated to use modern PatternFly 5 components, providing a more consistent experience with other redesigned pages.

Post-quantum cryptography content support

Katello can now synchronize and distribute RHEL 10 content signed with the Module-Lattice-Based Digital Signature Standard (ML-DSA), a post-quantum cryptography algorithm. This ensures that you can consume quantum-resistant content without changes to your existing workflows.

Performance improvements for large deployments

Missing indexes have been added to content facet join tables, significantly improving performance for deployments with large numbers of hosts. Host collection membership updates have also been optimized to scale better on large collections. Redundant Candlepin requests during host registration have been eliminated to improve registration performance.

Errata application tracking

Errata applications are now tracked in the database, improving the Applied Errata report so that purging old tasks does not cause errata applications to be omitted from the report.

2.2. Upgrade warnings

Deprecated API parameters removed

The deprecated content_view_id and lifecycle_environment_id parameters have been removed from the hosts, activation keys, and host groups API endpoints. Use the content_view_environment_id parameter instead.

API error response format change

The displayMessage field in Katello API error responses has been renamed to message. Update any scripts or integrations that parse displayMessage from Katello API error responses.

Host groups now require a single content view environment

Host groups are now associated with a single content view environment, rather than a separate content view and lifecycle environment. Before upgrading, ensure the following:

  • Your host groups must either assign both content view and lifecycle environment fields, or assign neither field. This avoids breaking host group inheritance.

  • Do not rely on host group inheritance to compose a content view environment from separate lifecycle environment and content views.

  • The content view and lifecycle environment on each host group must be coherent: the content view must be promoted to the lifecycle environment assigned to the host group.

Dependency solving disabled by default for incremental updates

Dependency solving during incremental content view updates is now disabled by default, providing a significant speed improvement. For most users, dependency solving is unnecessary when incrementally adding errata because the erratum already includes all required packages. Only users who need to apply new errata to very old content views should consider re-enabling it. Note that dependency resolution does not always result in a working repository.

2.3. Deprecations

The katello-ca-consumer RPM package and katello-rhsm-consumer script

The katello-ca-consumer RPM package and the katello-rhsm-consumer script are deprecated and will be removed in a future release. Use the following alternatives instead:

3. Foreman 5.0.0

You can find the complete list of changes on Redmine.

3.1. Foreman

  • Rubocop/CI job fails in GitHub Actions: cap2 gem fails to compile, missing libcap-dev - #39600

  • PageLayout uses PF3 layout of Breadcrumbs instead of PF5 - #39592

  • Loosen upper bound on scoped_search - #39588

  • Subnet: invalid mask bypasses validation when the network address contains a CIDR suffix - #39572

  • Update eslint-plugin-rules require-ouiaid with PF5 components - #39562

  • Remove unused NumericInput and drop the rc-input-number dependency - #39558

  • Automatically change title to text in APIActions toast handlers text - #39547

  • Add configurable CA cert to LDAP auth source - #39534

  • Add host parameter to skip rhsm registration for RHEL hosts and use the redhat_register snippet instead - #39521

  • Add audits for user login / logout / failed logins - #39512

  • Update EditorNavbar and EditorRadioButton components to PF5 and the tests to RTL - #39507

  • Update OrderableSelect to PF5 - #39505

  • package upgrade did upgrade all packages - #39499

  • Update EditorOptions to PF5 and it's tests to RTL - #39497

  • Update EditorSettings to PF5 and it's tests to RTL - #39496

  • Replace forms/FormField to PF5 - #39486

  • deprecate ForemanForm - #39485

  • Refactor HOC Enzyme tests to RTL - #39472

  • Refactor Component Wrapper Enzyme tests to RTL - #39468

  • taxonomies.ignore_types being a yaml-serialized array prevents exact db-level operations - #39465

  • error toasts for disassociate and change owner are not shown - #39463

  • Update DiffModal in config reports to PF5 - #39461

  • Refactor long date time Enzyme tests to RTL - #39460

  • Replace JS snapshot tests - TokenLifeTime field - #39459

  • Replace JS snapshot tests - Taxonomies field - #39458

  • Replace JS snapshot tests - Repository field - #39457

  • Replace JS snapshot tests - HostGroup field - #39455

  • Replace JS snapshot tests - General component - #39454

  • Replace JS snapshot tests - ConfigParams field - #39453

  • Replace JS snapshot tests - Command component - #39452

  • Replace JS snapshot tests - Advanced component - #39451

  • Refactor ISO Date Enzyme tests to RTL - #39450

  • Replace JS snapshot tests - AuditsPageSelectors - #39445

  • Replace JS snapshot tests - AuditsPageActions - #39443

  • Replace JS snapshot tests - LoginPage - #39442

  • Replace JS snapshot tests - AuditsPage - #39439

  • Refactor Relative date time Enzyme tests to RTL - #39436

  • Refactor Short Date Time Enzyme tests to RTL - #39435

  • Refactor ConfirmModal Enzyme tests to RTL - #39431

  • Fix padding in register host page - #39422

  • sudo-rs on Ubuntu 26.04 does not support requiretty - #39417

  • Developer docs are out of date at places - #39416

  • Move FieldConstructor from webhooks plugin to core - #39408

  • Move reusable Area chart functions to helpers - #39403

  • Deprecate MessageBox and replace it with EmptyState - #39401

  • reusable empty state page - #39395

  • Add script to handle running plugin tests in multiple ways inspired by ktest - #39391

  • REX job "Schedule a job" with "select all" check does not run for any host - #39389

  • hosts index page loads full Host objects when only hostgroup_ids are needed - #39381

  • Bump safemode to 2.0 - #39370

  • Deprecate Loader and update its usage to PF5 - #39366

  • Add Ruby 3.3 support to Foreman - #39361

  • Deprecate LineChart wrapper in Foreman core - #39357

  • Add support for `settings.d` - #39347

  • Merge page logic and styles from TableIndexPage to PageLayout - #39340

  • N+1 queries when loading taxonomy descendants - #39336

  • Add additive fact import mode - #39299

  • Use bulk insert for new fact values on persisted hosts - #39298

  • container_certs_setup snippet missing cert directories for load balancer backend hostnames - #39193

  • Subnet UI allows CIDR in Network Address causing duplicated prefix (/24/24) - #39159

  • Update host vmware form to PF5 - #38992

3.1.1. Authentication

  • SSO login via Apache OIDC fails with a 500 Internal Server Error on Ruby 3.2 - #39099

3.1.2. BMC

  • Specifying organization_id/location_id in hammer host boot causes ERF42-5227 unknown parent permission error - #39374

  • Remove SSH provider for BMC in foreman - #39321

3.1.3. Inventory

  • Host actions are disabled after bulk action - #39538

  • Registration form checkboxes not vertically aligned with text - #38674

3.1.4. JavaScript stack

  • Share time unit JS consts for plugins - #39568

  • Add PF lint rules: prefer-pf-components/props - #39513

  • update ui test guidelines and best practices - #39438

  • add no-magic-numbers js lint rule - #39383

  • TypeScript support for the frontend - #39137

  • Update CounterInput component to PF5 - #39056

3.1.5. Logging

  • foreman-rake drops RAILS_LOG_TO_STDOUT and writes production.log during RPM install (Containerised installation) - #39536

3.1.6. Organizations and Locations

  • Exclude host taxonomies that don't match the Smart Proxy taxonomies from used_taxonomy_ids - #39220

3.1.7. Rails

  • Missing validation for domain name input under Infrastructure in Foreman UI - #39287

3.1.8. Rake tasks

  • Provide a way for plugins to run a predefined subset of core tests - #39545

3.1.9. Reporting

  • Errata severity macro is not available in 'Host - Applied Errata' report - #39334

  • Add still_applicable column to Host - Applied Errata report template - #39212

3.1.10. Security

  • CVE-2026-5138: Information disclosure via improper validation of nested request parameters - #39481

  • CVE-2026-5135: Unauthorized modification of host configurations via broken access control - #39480

  • CVE-2026-5142: Cross-tenant private SSH key disclosure via taxonomy scoping bypass - #39479

  • CVE-2026-5136: Privilege escalation via usergroup role assignment manipulation - #39478

3.1.11. Smart Proxy

  • SmartProxy model should be able to find smart proxies located on the same host - #39574

  • auth_smart_proxy can set @detected_proxy incorrectly - #39570

  • Track and surface unrecognized Smart Proxy features - #39413

3.1.12. Templates

  • Allow custom pre-install script in kickstart default template - #39293

3.1.13. Users, Roles and Permissions

  • I'd like to enable/disable users directly from the users table - #39474

3.1.14. VM management

  • VMware - Normalize firmware type in clone args - #39310

3.1.15. Web Interface

  • Apply pf-v5-c-page--BackgroundColor to #rails-app-content - #39593

  • Fix React tables toolbar alignment - #39523

  • Hide count in SelectAllCheckbox when unavailable - #39475

  • Foreman performs bulk actions on hosts in different location then marked - #39437

  • Update TableIndexPage ActionButtons OuiaId to be customizable. - #39426

  • Some links still redirect to the old /hosts page - #39396

  • AutocompleteInput doesn't allow to select typed value - #39311

  • Host search breaks when using % in search bar - #39302

  • Add Stylelint rule to block global css overrides - #39276

  • Web UI -> Infrastructures -> Smart Proxies page takes long time to load - #38275

3.2. Hammer CLI - Foreman

  • Implement LDAP CA certs support - #39537

3.2.1. Proxy

  • Display unknown proxy features, if there are any - #39414

3.3. Installer

  • katello-certs-check can sometimes not be used with wildcards - #39546

3.3.1. Foreman modules

  • Warn about unrecognized smart proxy features - #39415

3.4. Packaging

  • Remove unused nodejs-rc-input-number - #39561

3.5. SELinux

  • Foreman policy uses deprecated functions - #39343

3.5.1. Smart proxy

  • Proxy policy can't be compiled on EL10 - #39342

3.6. Smart Proxy

  • Add tls_min_version and tls_ciphers to smart proxy - #39405

  • Cache global registration script in smart-proxy - #39208

3.6.1. BMC

  • Expose bmc_default_provider setting via v2/features API - #39320

  • Identify LED operations do not support LocationIndicatorActive, failing on BMCs where IndicatorLED is deprecated - #39301

  • Identify LED on operation fails due to invalid IndicatorLED value On - #39300

3.6.2. Tests

  • smart-proxy test failures due to rake 13.4.2 breaking ci_reporter_test_unit - #39315

4. Katello 5.0.0

You can find the complete list of changes on Redmine.

4.1. Katello

  • "hammer hostgroup" commands should use new param content_view_environment_id - #39603

  • Organization destroy fails with 'Couldn't find Katello::Repository' after PR #11762 - #39392

4.1.1. API

  • Convert RSA references to generic PKey - #39509

  • Change singular Katello api errors from displayMessage to message - #39400

  • API endpoint GET /api/host_packages/installed_packages in apidoc is wrong - #39351

  • Katello hard overrides list of valid controllers for bookmarks, preventing plugins from extending it - #39322

  • Non-admin users cannot curl /rhsm/ endpoints even if they have proper permissions - #39313

4.1.2. Client/Agent

  • Remove old TaskStatus model - #39222

4.1.3. Container

  • Enable Katello to support syncing container gateway on containerized smart proxies - #39576

4.1.4. Content Credentials

  • Content Credentials overview - Create modal + Remove action - #39332

  • Deleting an organization fails when its Content Credentials are referenced by an Alternate Content Source - #39433

4.1.5. Content Views

  • Prevent assigning multiple content view environments to hosts through Hammer - #39578

  • Add warning to dependency solving checkbox - #39535

  • Incremental update fails with undefined method 'version_href' for nil:NilClass, when multiple content views are assigned - #39379

  • Fail to delete CV / CCV versions with error "The repository version cannot be deleted because it (or its publications) are currently being used to distribute content" - #39346

  • Remove separate content_view_id and lifecycle_environment_id params - #39330

4.1.6. Errata Management

  • Disable dependency solving default for incremental update and update UI to match - #39519

  • Errata Synchronization Status Mismatch Between Default Organization View and Content View - #39432

  • Applied Errata Report generate empty - #39185

4.1.7. Foreman Proxy Content

  • [RFE Smart Proxy content tab not showing synced content count on page.] - #39388

  • Ensure load balanced Smart Proxies have same data in auth tables - #39314

4.1.8. HTTP Proxy

  • Use valid PEM for HttpProxy cacert in yum test - #39577

4.1.9. Host Collections

  • Host collection membership updates scale poorly on large collections - #39421

4.1.10. Hosts

  • Host edit page misses information about assigned Content view environment - #39571

  • Registration assumes that the registration smart proxy and pulpcore smart proxy are the same - #39569

  • CVEnvs displayed in wrong order in UI due to CVECF priorities not set during initial host registration - #39503

  • Registering with --name="#poundSign" should throw "System name cannot begin with # character" - #39493

  • Shutdown command not found while running resolve traces on SLES 16 - #39441

  • Child host group fails to inherit "Synced Content" from the parent - #39418

  • Changing focus doesn't close dropdowns on bulk repository set wizard - #39341

  • Remove content_facet.uuid usage in favor of subscription_facet.uuid - #39259

  • Import only OS-detection facts at registration to keep RhelLifecycleStatus accurate - #39213

  • Eliminate redundant Candlepin GETs during host registration - #39202

4.1.11. Organizations and Locations

  • LoadingState component does not clear setTimeout on unmount - #39338

4.1.12. Performance

  • Missing content_facet_id indexes on join tables cause sequential scans at scale - #39358

4.1.13. Reporting

  • Errata severity macro is not available in 'Host - Applied Errata' report - #39326

4.1.14. Repositories

  • Drop Pulp 2 Smart Proxy status code - #39575

  • content_uploads_controller does not filter repository context by "editable" - #39440

  • product_content_importer do not update the content_label even if it has changed in the source for same content_id - #39423

  • Red Hat container registry authentication not working as expected in Repo Discovery - #39337

  • [katello Update RedHatRepositories from pf3 to pf5] - #39325

  • Generic content pages are not scoped by organization - #39319

  • Improve empty repo metadata handling for deb content - #39054

  • ContentFacet#find_by_installable_rpms finds applicable rpms, not installable - #38746

4.1.15. Subscriptions

  • Migrate Upstream Subscriptions table from PF3 to TableIndexPage - #39556

  • Subscriptions Api Returns SubTotal as the number of items filtered - #39551

  • [katello Update Subscriptions from pf3 to pf5] - #39444

  • Replace JS snapshot tests – Subscriptions page - #39331

  • Add macro to allow showing and fetching activation_key_names used to register a content host - #39328

  • Host cleanup fails in some scenarios - #39308

  • Using "Custom CDN" configuration with alternate Red Hat CDN URLs cause certificate errors - #39303

4.1.16. Tests

  • Fix sporadic test failure - #39581

4.1.17. Tooling

  • Add Ruby 3.3 support to Foreman - #39410

4.1.18. Web UI

  • Remove unused legacy Content table components - #39584

  • UX feedback on Module Streams UI - #39573

  • Update ouiaIds for Create and Delete Content Credentials - #39430

  • Update TooltipButton component from pf3 to pf5 - #39390

  • Prevent global override of CSS - #39367

Appendix A: Foreman contributors

We’d like to thank the following people who contributed to the Foreman 5.0 release:

Adam Lazik,Adam Růžička,Alexander Olofsson,Alleny244,Andrei Lakatos,Arvind Jangir,Bernhard Suttner,Danny Synk,Eric Helms,Evgeni Golov,Gerald Vogt,Ian Ballou,Jakub Duchek,Jeremy Lenz,Karolina Malyjurkova,Leos Stejskal,Lucy Fu,Lukas Hellebrandt,Lukas Jezek,Lukas Pramuk,Marek Hulán,Maria Agaphontzev,Matt Darcy,Michal Gritzbach,Nadja Heitmann,Odilon Sousa,Oleh Fedorenko,Ondřej Gajdušek,Pablo Méndez Hernández,Pascal Kontschan,Pavan Soma Shekar,Peter Ondrejka,Quinn James,Sam Bible,Samir Jha,Shubham Ganar,Thorben Denzer,Tim Meusel,Titani Labaj,Yusuke Hirota,Zachary Huntington-Meath

As well as all users who helped test releases, report bugs and provide feedback on the project.

Appendix B: Katello contributors

Adam Lazík, Adam Růžička, Aiden Fine, Andrei Lakatos, Bernhard Suttner, Chris Roberts, Ian Ballou, Jeremy Lenz, jnagare-redhat, Jonathon Turel, Ladislav Vašina, Lucy Fu, Maria, Nofar, Odilon Sousa, Pablo Méndez Hernández, Pavan Soma Shekar, Quinn James, Quirin Pamp, Sam Bible, Samir Jha, Sayan Das, Soham Majumdar, synkd, Titani Labaj, Vijaykumar Sawant, Vladimir Sedmik, Zach Huntington-Meath

Pre-release version Report issue