# changelog

author: Salt Project Packaging <saltproject-packaging@vmware.com> - 3006.3
changelog:
  - Fedora 36 support was removed because it reached EOL [#64315](https://github.com/saltstack/salt/issues/64315)
  - Handle deprecation warnings:

    * Switch to `FullArgSpec` since Py 3.11 no longer has `ArgSpec`, deprecated since Py 3.0
    * Stop using the deprecated `cgi` module
    * Stop using the deprecated `pipes` module
    * Stop using the deprecated `imp` module [#64553](https://github.com/saltstack/salt/issues/64553)


  - Replace libnacl with PyNaCl [#64372](https://github.com/saltstack/salt/issues/64372)
  - Don't hardcode the python version on the Salt Package tests and on the `pkg/debian/salt-cloud.postinst` file [#64553](https://github.com/saltstack/salt/issues/64553)
  - Some more deprecated code fixes:

    * Stop using the deprecated `locale.getdefaultlocale()` function
    * Stop accessing deprecated attributes
    * `pathlib.Path.__enter__()` usage is deprecated and not required, a no-op [#64565](https://github.com/saltstack/salt/issues/64565)
  - Bump to `pyyaml==6.0.1` due to https://github.com/yaml/pyyaml/issues/601 and address lint issues [#64657](https://github.com/saltstack/salt/issues/64657)


  - Fix for assume role when used salt-cloud to create aws ec2. [#52501](https://github.com/saltstack/salt/issues/52501)
  - fixes aptpkg module by checking for blank comps. [#58667](https://github.com/saltstack/salt/issues/58667)
  - `wheel.file_roots.find` is now able to find files in subdirectories of the roots. [#59800](https://github.com/saltstack/salt/issues/59800)
  - pkg.latest no longer fails when multiple versions are reported to be installed (e.g. updating the kernel) [#60931](https://github.com/saltstack/salt/issues/60931)
  - Do not update the credentials dictionary in `utils/aws.py` while iterating over it, and use the correct delete functionality [#61049](https://github.com/saltstack/salt/issues/61049)
  - fixed runner not having a proper exit code when runner modules throw an exception. [#61173](https://github.com/saltstack/salt/issues/61173)
  - `pip.list_all_versions` now works with `index_url` and `extra_index_url` [#61610](https://github.com/saltstack/salt/issues/61610)
  - speed up file.recurse by using prefix with cp.list_master_dir and remove an un-needed loop. [#61998](https://github.com/saltstack/salt/issues/61998)
  - Preserve test=True condition while running sub states. [#62590](https://github.com/saltstack/salt/issues/62590)
  - Job returns are only sent to originating master [#62834](https://github.com/saltstack/salt/issues/62834)
  - Fixes an issue with failing subsequent state runs with the lgpo state module.
    The ``lgpo.get_polcy`` function now returns all boolean settings. [#63296](https://github.com/saltstack/salt/issues/63296)
  - Fix SELinux get policy with trailing whitespace [#63336](https://github.com/saltstack/salt/issues/63336)
  - Fixes an issue with boolean settings not being reported after being set. The
    ``lgpo.get_polcy`` function now returns all boolean settings. [#63473](https://github.com/saltstack/salt/issues/63473)
  - Ensure body is returned when salt.utils.http returns something other than 200 with tornado backend. [#63557](https://github.com/saltstack/salt/issues/63557)
  - Allow long running pillar and file client requests to finish using request_channel_timeout and request_channel_tries minion config. [#63824](https://github.com/saltstack/salt/issues/63824)
  - Fix state_queue type checking to allow int values [#64122](https://github.com/saltstack/salt/issues/64122)
  - Call global logger when catching pip.list exceptions in states.pip.installed
    Rename global logger `log` to `logger` inside pip_state [#64169](https://github.com/saltstack/salt/issues/64169)
  - Fixes permissions created by the Debian and RPM packages for the salt user.

    The salt user created by the Debian and RPM packages to run the salt-master process, was previously given ownership of various directories in a way which compromised the benefits of running the salt-master process as a non-root user.

    This fix sets the salt user to only have write access to those files and
    directories required for the salt-master process to run. [#64193](https://github.com/saltstack/salt/issues/64193)
  - Fix user.present state when groups is unset to ensure the groups are unchanged, as documented. [#64211](https://github.com/saltstack/salt/issues/64211)
  - Fixes issue with MasterMinion class loading configuration from `/etc/salt/minion.d/*.conf.

    The MasterMinion class (used for running orchestraions on master and other functionality) was incorrectly loading configuration from `/etc/salt/minion.d/*.conf`, when it should only load configuration from `/etc/salt/master` and `/etc/salt/master.d/*.conf`. [#64219](https://github.com/saltstack/salt/issues/64219)
  - Fixed issue in mac_user.enable_auto_login that caused the user's keychain to be reset at each boot [#64226](https://github.com/saltstack/salt/issues/64226)
  - Fixed KeyError in logs when running a state that fails. [#64231](https://github.com/saltstack/salt/issues/64231)
  - Fixed x509_v2 `create_private_key`/`create_crl` unknown kwargs: __pub_fun... [#64232](https://github.com/saltstack/salt/issues/64232)
  - remove the hard coded python version in error. [#64237](https://github.com/saltstack/salt/issues/64237)
  - `salt-pip` now properly errors out when being called from a non `onedir` environment. [#64249](https://github.com/saltstack/salt/issues/64249)
  - Ensure we return an error when adding the key fails in the pkgrepo state for debian hosts. [#64253](https://github.com/saltstack/salt/issues/64253)
  - Fixed file client private attribute reference on `SaltMakoTemplateLookup` [#64280](https://github.com/saltstack/salt/issues/64280)
  - Fix pkgrepo.absent failures on apt-based systems when repo either a) contains a
    trailing slash, or b) there is an arch mismatch. [#64286](https://github.com/saltstack/salt/issues/64286)
  - Fix detection of Salt codename by "salt_version" execution module [#64306](https://github.com/saltstack/salt/issues/64306)
  - Ensure selinux values are handled lowercase [#64318](https://github.com/saltstack/salt/issues/64318)
  - Remove the `clr.AddReference`, it is causing an `Illegal characters in path` exception [#64339](https://github.com/saltstack/salt/issues/64339)
  - Update `pkg.group_installed` state to support repo options [#64348](https://github.com/saltstack/salt/issues/64348)
  - Fix salt user login shell path in Debian packages [#64377](https://github.com/saltstack/salt/issues/64377)
  - Allow for multiple user's keys presented when authenticating, for example: root, salt, etc. [#64398](https://github.com/saltstack/salt/issues/64398)
  - Fixed an issue with ``lgpo_reg`` where existing entries for the same key in
    ``Registry.pol`` were being overwritten in subsequent runs if the value name in
    the subesequent run was contained in the existing value name. For example, a
    key named ``SetUpdateNotificationLevel`` would be overwritten by a subsequent
    run attempting to set ``UpdateNotificationLevel`` [#64401](https://github.com/saltstack/salt/issues/64401)
  - Add search for %ProgramData%\Chocolatey\choco.exe to determine if Chocolatey is installed or not [#64427](https://github.com/saltstack/salt/issues/64427)
  - Fix regression for user.present on handling groups with dupe GIDs [#64430](https://github.com/saltstack/salt/issues/64430)
  - Fix inconsistent use of args in ssh_auth.managed [#64442](https://github.com/saltstack/salt/issues/64442)
  - Ensure we raise an error when the name argument is invalid in pkgrepo.managed state for systems using apt. [#64451](https://github.com/saltstack/salt/issues/64451)
  - Fix file.symlink will not replace/update existing symlink [#64477](https://github.com/saltstack/salt/issues/64477)
  - Fixed salt-ssh state.* commands returning retcode 0 when state/pillar rendering fails [#64514](https://github.com/saltstack/salt/issues/64514)
  - Fix pkg.install when using a port in the url. [#64516](https://github.com/saltstack/salt/issues/64516)
  - `win_pkg` Fixes an issue runing `pkg.install` with `version=latest` where the
    new installer would not be cached if there was already an installer present
    with the same name. [#64519](https://github.com/saltstack/salt/issues/64519)
  - Added a `test:full` label in the salt repository, which, when selected, will force a full test run. [#64539](https://github.com/saltstack/salt/issues/64539)
  - Syndic's async_req_channel uses the asynchornous version of request channel [#64552](https://github.com/saltstack/salt/issues/64552)
  - Ensure runners properly save information to job cache. [#64570](https://github.com/saltstack/salt/issues/64570)
  - Added salt.ufw to salt-master install on Debian and Ubuntu [#64572](https://github.com/saltstack/salt/issues/64572)
  - Added support for Chocolatey 2.0.0+ while maintaining support for older versions [#64622](https://github.com/saltstack/salt/issues/64622)
  - Updated semanage fcontext to use --modify if context already exists when adding context [#64625](https://github.com/saltstack/salt/issues/64625)
  - Preserve request client socket between requests. [#64627](https://github.com/saltstack/salt/issues/64627)
  - Show user friendly message when pillars timeout [#64651](https://github.com/saltstack/salt/issues/64651)
  - File client timeouts durring jobs show user friendly errors instead of tracbacks [#64653](https://github.com/saltstack/salt/issues/64653)
  - SaltClientError does not log a traceback on minions, we expect these to happen so a user friendly log is shown. [#64729](https://github.com/saltstack/salt/issues/64729)
  - Look in location salt is running from, this accounts for running from an unpacked onedir file that has not been installed. [#64877](https://github.com/saltstack/salt/issues/64877)
  - Preserve credentials on spawning platforms, minions no longer re-authenticate
    with every job when using `multiprocessing=True`. [#64914](https://github.com/saltstack/salt/issues/64914)
  - Fixed uninstaller to not remove the `salt` directory by default. This allows
    the `extras-3.##` folder to persist so salt-pip dependencies are not wiped out
    during an upgrade. [#64957](https://github.com/saltstack/salt/issues/64957)
  - fix msteams by adding the missing header that Microsoft is now enforcing. [#64973](https://github.com/saltstack/salt/issues/64973)
  - Fix __env__ and improve cache cleaning see more info at pull #65017. [#65002](https://github.com/saltstack/salt/issues/65002)
  - Better error message on inconsistent decoded payload [#65020](https://github.com/saltstack/salt/issues/65020)
  - Handle permissions access error when calling `lsb_release` with the salt user [#65024](https://github.com/saltstack/salt/issues/65024)
  - Allow schedule state module to update schedule when the minion is offline. [#65033](https://github.com/saltstack/salt/issues/65033)
  - Fixed creation of wildcard DNS in SAN in `x509_v2` [#65072](https://github.com/saltstack/salt/issues/65072)
  - The macOS installer no longer removes the extras directory [#65073](https://github.com/saltstack/salt/issues/65073)


  - Added a script to automate setting up a 2nd minion in a user context on Windows [#64439](https://github.com/saltstack/salt/issues/64439)
  - Several fixes to the CI workflow:

    * Don't override the `on` Jinja block on the `ci.yaml` template. This enables reacting to labels getting added/removed
      to/from pull requests.
    * Switch to using `tools` and re-use the event payload available instead of querying the GH API again to get the pull
      request labels
    * Concentrate test selection by labels to a single place
    * Enable code coverage on pull-requests by setting the `test:coverage` label [#64547](https://github.com/saltstack/salt/issues/64547)


  - Upgrade to `cryptography==41.0.3`(and therefor `pyopenssl==23.2.0` due to https://github.com/advisories/GHSA-jm77-qphf-c4w8)

    This only really impacts pip installs of Salt and the windows onedir since the linux and macos onedir build every package dependency from source, not from pre-existing wheels.

    Also resolves the following cryptography advisories:

    Due to:
      * https://github.com/advisories/GHSA-5cpq-8wj7-hf2v
      * https://github.com/advisories/GHSA-x4qr-2fvf-3mr5
      * https://github.com/advisories/GHSA-w7pp-m8wf-vj6r [#64595](https://github.com/saltstack/salt/issues/64595)
  - Bump to `aiohttp==3.8.5` due to https://github.com/advisories/GHSA-45c4-8wx5-qw6w [#64687](https://github.com/saltstack/salt/issues/64687)
  - Bump to `certifi==2023.07.22` due to https://github.com/advisories/GHSA-xqr8-7jwr-rhp7 [#64718](https://github.com/saltstack/salt/issues/64718)
  - Upgrade `relenv` to `0.13.2` and Python to `3.10.12`

    Addresses multiple CVEs in Python's dependencies: https://docs.python.org/release/3.10.12/whatsnew/changelog.html#python-3-10-12 [#64719](https://github.com/saltstack/salt/issues/64719)
  - Update to `gitpython>=3.1.32` due to https://github.com/advisories/GHSA-pr76-5cm5-w9cj [#64988](https://github.com/saltstack/salt/issues/64988)


author: Salt Project Packaging <saltproject-packaging@vmware.com> - 3006.4
changelog:
  - Fix CVE-2023-34049 by ensuring we do not use a predictable name for the script and correctly check returncode of scp command.
    This only impacts salt-ssh users using the pre-flight option. [#cve-2023-34049](https://github.com/saltstack/salt/issues/cve-2023-34049)
  - Update to `gitpython>=3.1.35` due to https://github.com/advisories/GHSA-wfm5-v35h-vwf4 and https://github.com/advisories/GHSA-cwvm-v4w8-q58c [#65163](https://github.com/saltstack/salt/issues/65163)
  - Bump to `cryptography==41.0.4` due to https://github.com/advisories/GHSA-v8gr-m533-ghj9 [#65268](https://github.com/saltstack/salt/issues/65268)
  - Upgrade relenv to 0.13.12 to address CVE-2023-4807 [#65316](https://github.com/saltstack/salt/issues/65316)
  - Bump to `urllib3==1.26.17` or `urllib3==2.0.6` due to https://github.com/advisories/GHSA-v845-jxx5-vc9f [#65334](https://github.com/saltstack/salt/issues/65334)
  - Bump to `gitpython==3.1.37` due to https://github.com/advisories/GHSA-cwvm-v4w8-q58c [#65383](https://github.com/saltstack/salt/issues/65383)


author: Salt Project Packaging <saltproject-packaging@vmware.com> - 3006.5
changelog:
  - Tech Debt - support for pysss removed due to functionality addition in Python 3.3 [#65029](https://github.com/saltstack/salt/issues/65029)


  - Improved error message when state arguments are accidentally passed as a string [#38098](https://github.com/saltstack/salt/issues/38098)
  - Allow `pip.install` to create a log file that is passed in if the parent directory is writeable [#44722](https://github.com/saltstack/salt/issues/44722)
  - Fixed merging of complex pillar overrides with salt-ssh states [#59802](https://github.com/saltstack/salt/issues/59802)
  - Fixed gpg pillar rendering with salt-ssh [#60002](https://github.com/saltstack/salt/issues/60002)
  - Made salt-ssh states not re-render pillars unnecessarily [#62230](https://github.com/saltstack/salt/issues/62230)
  - Made Salt maintain options in Debian package repo definitions [#64130](https://github.com/saltstack/salt/issues/64130)
  - Migrated all [`invoke`](https://www.pyinvoke.org/) tasks to [`python-tools-scripts`](https://github.com/s0undt3ch/python-tools-scripts).

    * `tasks/docs.py` -> `tools/precommit/docs.py`
    * `tasks/docstrings.py` -> `tools/precommit/docstrings.py`
    * `tasks/loader.py` -> `tools/precommit/loader.py`
    * `tasks/filemap.py` -> `tools/precommit/filemap.py` [#64374](https://github.com/saltstack/salt/issues/64374)
  - Fix salt user login shell path in Debian packages [#64377](https://github.com/saltstack/salt/issues/64377)
  - Fill out lsb_distrib_xxxx (best estimate) grains if problems with retrieving lsb_release data [#64473](https://github.com/saltstack/salt/issues/64473)
  - Fixed an issue in the ``file.directory`` state where the ``children_only`` keyword
    argument was not being respected. [#64497](https://github.com/saltstack/salt/issues/64497)
  - Move salt.ufw to correct location /etc/ufw/applications.d/ [#64572](https://github.com/saltstack/salt/issues/64572)
  - Fixed salt-ssh stacktrace when retcode is not an integer [#64575](https://github.com/saltstack/salt/issues/64575)
  - Fixed SSH shell seldomly fails to report any exit code [#64588](https://github.com/saltstack/salt/issues/64588)
  - Fixed some issues in x509_v2 execution module private key functions [#64597](https://github.com/saltstack/salt/issues/64597)
  - Fixed grp.getgrall() in utils/user.py causing performance issues [#64888](https://github.com/saltstack/salt/issues/64888)
  - Fix user.list_groups omits remote groups via sssd, etc. [#64953](https://github.com/saltstack/salt/issues/64953)
  - Ensure sync from _grains occurs before attempting pillar compilation in case custom grain used in pillar file [#65027](https://github.com/saltstack/salt/issues/65027)
  - Moved gitfs locks to salt working dir to avoid lock wipes [#65086](https://github.com/saltstack/salt/issues/65086)
  - Only attempt to create a keys directory when `--gen-keys` is passed to the `salt-key` CLI [#65093](https://github.com/saltstack/salt/issues/65093)
  - Fix nonce verification, request server replies do not stomp on eachother. [#65114](https://github.com/saltstack/salt/issues/65114)
  - speed up yumpkg list_pkgs by not requiring digest or signature verification on lookup. [#65152](https://github.com/saltstack/salt/issues/65152)
  - Fix pkg.latest failing on windows for winrepo packages where the package is already up to date [#65165](https://github.com/saltstack/salt/issues/65165)
  - Ensure __kwarg__ is preserved when checking for kwargs.  This change affects proxy minions when used with Deltaproxy, which had kwargs popped when targeting multiple minions id. [#65179](https://github.com/saltstack/salt/issues/65179)
  - Fixes traceback when state id is an int in a reactor SLS file. [#65210](https://github.com/saltstack/salt/issues/65210)
  - Install logrotate config as /etc/logrotate.d/salt-common for Debian packages
    Remove broken /etc/logrotate.d/salt directory from 3006.3 if it exists. [#65231](https://github.com/saltstack/salt/issues/65231)
  - Use ``sha256`` as the default ``hash_type``. It has been the default since Salt v2016.9 [#65287](https://github.com/saltstack/salt/issues/65287)
  - Preserve ownership on log rotation [#65288](https://github.com/saltstack/salt/issues/65288)
  - Ensure that the correct value of jid_inclue is passed if the argument is included in the passed keyword arguments. [#65302](https://github.com/saltstack/salt/issues/65302)
  - Uprade relenv to 0.14.2
     - Update openssl to address CVE-2023-5363.
     - Fix bug in openssl setup when openssl binary can't be found.
     - Add M1 mac support. [#65316](https://github.com/saltstack/salt/issues/65316)
  - Fix regex for filespec adding/deleting fcontext policy in selinux [#65340](https://github.com/saltstack/salt/issues/65340)
  - Ensure CLI options take priority over Saltfile options [#65358](https://github.com/saltstack/salt/issues/65358)
  - Test mode for state function `saltmod.wheel` no longer set's `result` to `(None,)` [#65372](https://github.com/saltstack/salt/issues/65372)
  - Client only process events which tag conforms to an event return. [#65400](https://github.com/saltstack/salt/issues/65400)
  - Fixes an issue setting user or machine policy on Windows when the Group Policy
    directory is missing [#65411](https://github.com/saltstack/salt/issues/65411)
  - Fix regression in file module which was not re-using a file client. [#65450](https://github.com/saltstack/salt/issues/65450)
  - pip.installed state will now properly fail when a specified user does not exists [#65458](https://github.com/saltstack/salt/issues/65458)
  - Publish channel connect callback method properly closes it's request channel. [#65464](https://github.com/saltstack/salt/issues/65464)
  - Ensured the pillar in SSH wrapper modules is the same as the one used in template rendering when overrides are passed [#65483](https://github.com/saltstack/salt/issues/65483)
  - Fix file.comment ignore_missing not working with multiline char [#65501](https://github.com/saltstack/salt/issues/65501)
  - Warn when an un-closed transport client is being garbage collected. [#65554](https://github.com/saltstack/salt/issues/65554)
  - Only generate the HMAC's for ``libssl.so.1.1`` and ``libcrypto.so.1.1`` if those files exist. [#65581](https://github.com/saltstack/salt/issues/65581)
  - Fixed an issue where Salt Cloud would fail if it could not delete lingering
    PAexec binaries [#65584](https://github.com/saltstack/salt/issues/65584)


  - Added Salt support for Debian 12 [#64223](https://github.com/saltstack/salt/issues/64223)
  - Added Salt support for Amazon Linux 2023 [#64455](https://github.com/saltstack/salt/issues/64455)


  - Bump to `cryptography==41.0.4` due to https://github.com/advisories/GHSA-v8gr-m533-ghj9 [#65268](https://github.com/saltstack/salt/issues/65268)
  - Bump to `cryptography==41.0.7` due to https://github.com/advisories/GHSA-jfhm-5ghh-2f97 [#65643](https://github.com/saltstack/salt/issues/65643)


author: Salt Project Packaging <saltproject-packaging@vmware.com> - 3007.0~rc1
changelog:
  - Removed RHEL 5 support since long since end-of-lifed [#62520](https://github.com/saltstack/salt/issues/62520)
  - Removing Azure-Cloud modules from the code base. [#64322](https://github.com/saltstack/salt/issues/64322)
  - Dropped Python 3.7 support since it's EOL in 27 Jun 2023 [#64417](https://github.com/saltstack/salt/issues/64417)
  - Remove salt.payload.Serial [#64459](https://github.com/saltstack/salt/issues/64459)
  - Remove netmiko_conn and pyeapi_conn from salt.modules.napalm_mod [#64460](https://github.com/saltstack/salt/issues/64460)
  - Removed 'transport' arg from salt.utils.event.get_event [#64461](https://github.com/saltstack/salt/issues/64461)
  - Removed the usage of retired Linode API v3 from Salt Cloud [#64517](https://github.com/saltstack/salt/issues/64517)


  - Deprecate all Proxmox cloud modules [#64224](https://github.com/saltstack/salt/issues/64224)
  - Deprecate all the Vault modules in favor of the Vault Salt Extension https://github.com/salt-extensions/saltext-vault. The Vault modules will be removed in Salt core in 3009.0. [#64893](https://github.com/saltstack/salt/issues/64893)
  - Deprecate all the Docker modules in favor of the Docker Salt Extension https://github.com/saltstack/saltext-docker. The Docker modules will be removed in Salt core in 3009.0. [#64894](https://github.com/saltstack/salt/issues/64894)
  - Deprecate all the Zabbix modules in favor of the Zabbix Salt Extension https://github.com/salt-extensions/saltext-zabbix. The Zabbix modules will be removed in Salt core in 3009.0. [#64896](https://github.com/saltstack/salt/issues/64896)
  - Deprecate all the Apache modules in favor of the Apache Salt Extension https://github.com/salt-extensions/saltext-apache. The Apache modules will be removed in Salt core in 3009.0. [#64909](https://github.com/saltstack/salt/issues/64909)
  - Deprecation warning for Salt's backport of ``OrderedDict`` class which will be removed in 3009 [#65542](https://github.com/saltstack/salt/issues/65542)
  - Deprecate Kubernetes modules for move to saltext-kubernetes in version 3009 [#65565](https://github.com/saltstack/salt/issues/65565)
  - Deprecated all Pushover modules in favor of the Salt Extension at https://github.com/salt-extensions/saltext-pushover. The Pushover modules will be removed from Salt core in 3009.0 [#65567](https://github.com/saltstack/salt/issues/65567)


  - Masquerade property will not default to false turning off masquerade if not specified. [#53120](https://github.com/saltstack/salt/issues/53120)
  - Addressed Python 3.11 deprecations:

    * Switch to `FullArgSpec` since Py 3.11 no longer has `ArgSpec`, deprecated since Py 3.0
    * Stopped using the deprecated `cgi` module.
    * Stopped using the deprecated `pipes` module
    * Stopped using the deprecated `imp` module [#64457](https://github.com/saltstack/salt/issues/64457)
  - changed 'gpg_decrypt_must_succeed' default from False to True [#64462](https://github.com/saltstack/salt/issues/64462)


  - When an NFS or FUSE mount fails to unmount when mount options have changed, try again with a lazy umount before mounting again. [#18907](https://github.com/saltstack/salt/issues/18907)
  - fix autoaccept gpg keys by supporting it in refresh_db module [#42039](https://github.com/saltstack/salt/issues/42039)
  - Made cmd.script work with files from the fileserver via salt-ssh [#48067](https://github.com/saltstack/salt/issues/48067)
  - Made slsutil.renderer work with salt-ssh [#50196](https://github.com/saltstack/salt/issues/50196)
  - Fixed defaults.merge is not available when using salt-ssh [#51605](https://github.com/saltstack/salt/issues/51605)
  - Fix extfs.mkfs missing parameter handling for -C, -d, and -e [#51858](https://github.com/saltstack/salt/issues/51858)
  - Fixed Salt master does not renew token [#51986](https://github.com/saltstack/salt/issues/51986)
  - Fixed salt-ssh continues state/pillar rendering with incorrect data when an exception is raised by a module on the target [#52452](https://github.com/saltstack/salt/issues/52452)
  - Fix extfs.tune has 'reserved' documented twice and is missing the 'reserved_percentage' keyword argument [#54426](https://github.com/saltstack/salt/issues/54426)
  - Fix the ability of the 'selinux.port_policy_present' state to modify. [#55687](https://github.com/saltstack/salt/issues/55687)
  - Fixed config.get does not support merge option with salt-ssh [#56441](https://github.com/saltstack/salt/issues/56441)
  - Removed an unused assignment in file.patch [#57204](https://github.com/saltstack/salt/issues/57204)
  - Fixed vault module fetching more than one secret in one run with single-use tokens [#57561](https://github.com/saltstack/salt/issues/57561)
  - Use brew path from which in mac_brew_pkg module and rely on _homebrew_bin() everytime [#57946](https://github.com/saltstack/salt/issues/57946)
  - Fixed Vault verify option to work on minions when only specified in master config [#58174](https://github.com/saltstack/salt/issues/58174)
  - Fixed vault command errors configured locally [#58580](https://github.com/saltstack/salt/issues/58580)
  - Fixed issue with basic auth causing invalid header error and 401 Bad Request, by using HTTPBasicAuthHandler instead of header. [#58936](https://github.com/saltstack/salt/issues/58936)
  - Make the LXD module work with pyLXD > 2.10 [#59514](https://github.com/saltstack/salt/issues/59514)
  - Return error if patch file passed to state file.patch is malformed. [#59806](https://github.com/saltstack/salt/issues/59806)
  - Handle failure and error information from tuned module/state [#60500](https://github.com/saltstack/salt/issues/60500)
  - Fixed sdb.get_or_set_hash with Vault single-use tokens [#60779](https://github.com/saltstack/salt/issues/60779)
  - Fixed state.test does not work with salt-ssh [#61100](https://github.com/saltstack/salt/issues/61100)
  - Made slsutil.findup work with salt-ssh [#61143](https://github.com/saltstack/salt/issues/61143)
  - Allow all primitive grain types for autosign_grains [#61416](https://github.com/saltstack/salt/issues/61416), [#63708](https://github.com/saltstack/salt/issues/63708)
  - `ipset.new_set` no longer fails when creating a set type that uses the `family` create option [#61620](https://github.com/saltstack/salt/issues/61620)
  - Fixed Vault session storage to allow unlimited use tokens [#62380](https://github.com/saltstack/salt/issues/62380)
  - fix the efi grain on FreeBSD [#63052](https://github.com/saltstack/salt/issues/63052)
  - Fixed gpg.receive_keys returns success on failed import [#63144](https://github.com/saltstack/salt/issues/63144)
  - Fixed GPG state module always reports success without changes [#63153](https://github.com/saltstack/salt/issues/63153)
  - Fixed GPG state module does not respect test mode [#63156](https://github.com/saltstack/salt/issues/63156)
  - Fixed gpg.absent with gnupghome/user, fixed gpg.delete_key with gnupghome [#63159](https://github.com/saltstack/salt/issues/63159)
  - Fixed service module does not handle enable/disable if systemd service is an alias [#63214](https://github.com/saltstack/salt/issues/63214)
  - Made x509_v2 compound match detection use new runner instead of peer publishing [#63278](https://github.com/saltstack/salt/issues/63278)
  - Need to make sure we update __pillar__ during a pillar refresh to ensure that process_beacons has the updated beacons loaded from pillar. [#63583](https://github.com/saltstack/salt/issues/63583)
  - This implements the vpc_uuid parameter when creating a droplet. This parameter selects the correct virtual private cloud (private network interface). [#63714](https://github.com/saltstack/salt/issues/63714)
  - pkg.installed no longer reports failure when installing packages that are installed via the task manager [#63767](https://github.com/saltstack/salt/issues/63767)
  - mac_xattr.list and mac_xattr.read will replace undecode-able bytes to avoid raising CommandExecutionError. [#63779](https://github.com/saltstack/salt/issues/63779) [#63779](https://github.com/saltstack/salt/issues/63779)
  - Fix aptpkg.latest_version performance, reducing number of times to 'shell out' [#63982](https://github.com/saltstack/salt/issues/63982)
  - Added option to use a fresh connection for mysql cache [#63991](https://github.com/saltstack/salt/issues/63991)
  - [lxd] Fixed a bug in `container_create` which prevented devices which are not of type `disk` to be correctly created and added to the container when passed via the `devices` parameter. [#63996](https://github.com/saltstack/salt/issues/63996)
  - Skipped the `isfile` check to greatly increase speed of reading minion keys for systems with a large number of minions on slow file storage [#64260](https://github.com/saltstack/salt/issues/64260)
  - Fix utf8 handling in 'pass' renderer [#64300](https://github.com/saltstack/salt/issues/64300)
  - Upgade tornado to 6.3.2 [#64305](https://github.com/saltstack/salt/issues/64305)
  - Prevent errors due missing 'transactional_update.apply' on SLE Micro and MicroOS. [#64369](https://github.com/saltstack/salt/issues/64369)
  - Fix 'unable to unmount' failure to return False result instead of None [#64420](https://github.com/saltstack/salt/issues/64420)
  - Fixed issue uninstalling duplicate packages in ``win_appx`` execution module [#64450](https://github.com/saltstack/salt/issues/64450)
  - Clean up tech debt, IPC now uses tcp transport. [#64488](https://github.com/saltstack/salt/issues/64488)
  - Made salt-ssh more strict when handling unexpected situations and state.* wrappers treat a remote exception as failure, excluded salt-ssh error returns from mine [#64531](https://github.com/saltstack/salt/issues/64531)
  - Fix flaky test for LazyLoader with isolated mocking of threading.RLock [#64567](https://github.com/saltstack/salt/issues/64567)
  - Fix possible `KeyError` exceptions in `salt.utils.user.get_group_dict`
    while reading improper duplicated GID assigned for the user. [#64599](https://github.com/saltstack/salt/issues/64599)
  - changed vm_config() to deep-merge vm_overrides of specific VM, instead of simple-merging the whole vm_overrides [#64610](https://github.com/saltstack/salt/issues/64610)
  - Fix the way Salt tries to get the Homebrew's prefix

    The first attempt to get the Homebrew's prefix is to look for
    the `HOMEBREW_PREFIX` environment variable. If it's not set, then
    Salt tries to get the prefix from the `brew` command. However, the
    `brew` command can fail. So a last attempt is made to get the
    prefix by guessing the installation path. [#64924](https://github.com/saltstack/salt/issues/64924)
  - Add missing MySQL Grant SERVICE_CONNECTION_ADMIN to mysql module. [#64934](https://github.com/saltstack/salt/issues/64934)
  - Fixed slsutil.update with salt-ssh during template rendering [#65067](https://github.com/saltstack/salt/issues/65067)
  - Keep track when an included file only includes sls files but is a requisite. [#65080](https://github.com/saltstack/salt/issues/65080)
  - Fixed `gpg.present` succeeds when the keyserver is unreachable [#65169](https://github.com/saltstack/salt/issues/65169)
  - Fix issue with openscap when the error was outside the expected scope. It now
    returns failed with the error code and the error [#65193](https://github.com/saltstack/salt/issues/65193)
  - Fix typo in nftables module to ensure unique nft family values [#65295](https://github.com/saltstack/salt/issues/65295)
  - Dereference symlinks to set proper __cli opt [#65435](https://github.com/saltstack/salt/issues/65435)
  - Made salt-ssh merge master top returns for the same environment [#65480](https://github.com/saltstack/salt/issues/65480)
  - Account for situation where the metadata grain fails because the AWS environment requires an authentication token to query the metadata URL. [#65513](https://github.com/saltstack/salt/issues/65513)
  - Improve the condition of overriding target for pip with VENV_PIP_TARGET environment variable. [#65562](https://github.com/saltstack/salt/issues/65562)
  - Added SSH wrapper for logmod [#65630](https://github.com/saltstack/salt/issues/65630)
  - Include changes in the results when schedule.present state is run with test=True. [#65652](https://github.com/saltstack/salt/issues/65652)
  - Fixed Salt-SSH pillar rendering and state rendering with nested SSH calls when called via saltutil.cmd or in an orchestration [#65670](https://github.com/saltstack/salt/issues/65670)
  - Fix extfs.tune doesn't pass retcode to module.run [#65686](https://github.com/saltstack/salt/issues/65686)
  - Fix boto execution module loading [#65691](https://github.com/saltstack/salt/issues/65691)
  - Removed PR 65185 changes since incomplete solution [#65692](https://github.com/saltstack/salt/issues/65692)
  - Return an error message when the DNS plugin is not supported [#65739](https://github.com/saltstack/salt/issues/65739)


  - Allowed publishing to regular minions from the SSH wrapper [#40943](https://github.com/saltstack/salt/issues/40943)
  - Added syncing of custom salt-ssh wrappers [#45450](https://github.com/saltstack/salt/issues/45450)
  - Made salt-ssh sync custom utils [#53666](https://github.com/saltstack/salt/issues/53666)
  - Add ability to use file.managed style check_cmd in file.serialize [#53982](https://github.com/saltstack/salt/issues/53982)
  - Revised use of deprecated net-tools and added support for ip neighbour with IPv4 ip_neighs, IPv6 ip_neighs6 [#57541](https://github.com/saltstack/salt/issues/57541)
  - Added password support to Redis returner. [#58044](https://github.com/saltstack/salt/issues/58044)
  - Added keyring param to gpg modules [#59783](https://github.com/saltstack/salt/issues/59783)
  - Added new grain to detect the Salt package type: onedir, pip or system [#62589](https://github.com/saltstack/salt/issues/62589)
  - Added Vault AppRole and identity issuance to minions [#62823](https://github.com/saltstack/salt/issues/62823)
  - Added Vault AppRole auth mount path configuration option [#62825](https://github.com/saltstack/salt/issues/62825)
  - Added distribution of Vault authentication details via response wrapping [#62828](https://github.com/saltstack/salt/issues/62828)
  - Add salt package type information. Either onedir, pip or system. [#62961](https://github.com/saltstack/salt/issues/62961)
  - Added signature verification to file.managed/archive.extracted [#63143](https://github.com/saltstack/salt/issues/63143)
  - Added signed_by_any/signed_by_all parameters to gpg.verify [#63166](https://github.com/saltstack/salt/issues/63166)
  - Added match runner [#63278](https://github.com/saltstack/salt/issues/63278)
  - Added Vault token lifecycle management [#63406](https://github.com/saltstack/salt/issues/63406)
  - adding new call for openscap xccdf eval supporting new parameters [#63416](https://github.com/saltstack/salt/issues/63416)
  - Added Vault lease management utility [#63440](https://github.com/saltstack/salt/issues/63440)
  - implement removal of ptf packages in zypper pkg module [#63442](https://github.com/saltstack/salt/issues/63442)
  - add JUnit output for saltcheck [#63463](https://github.com/saltstack/salt/issues/63463)
  - Add ability for file.keyvalue to create a file if it doesn't exist [#63545](https://github.com/saltstack/salt/issues/63545)
  - added cleanup of temporary mountpoint dir for macpackage installed state [#63905](https://github.com/saltstack/salt/issues/63905)
  - Add pkg.installed show installable version in test mode [#63985](https://github.com/saltstack/salt/issues/63985)
  - Added patch option to Vault SDB driver [#64096](https://github.com/saltstack/salt/issues/64096)
  - Added flags to create local users and groups [#64256](https://github.com/saltstack/salt/issues/64256)
  - Added inline specification of trusted CA root certificate for Vault [#64379](https://github.com/saltstack/salt/issues/64379)
  - Add ability to return False result in test mode of configurable_test_state [#64418](https://github.com/saltstack/salt/issues/64418)
  - Switched Salt's onedir Python version to 3.11 [#64457](https://github.com/saltstack/salt/issues/64457)
  - Added support for dnf5 and its new command syntax [#64532](https://github.com/saltstack/salt/issues/64532)
  - Adding a new decorator to indicate when a module is deprecated in favor of a Salt extension. [#64569](https://github.com/saltstack/salt/issues/64569)
  - Add jq-esque to_entries and from_entries functions [#64600](https://github.com/saltstack/salt/issues/64600)
  - Added ability to use PYTHONWARNINGS=ignore to silence deprecation warnings. [#64660](https://github.com/saltstack/salt/issues/64660)
  - Add follow_symlinks to file.symlink exec module to switch to os.path.lexists when False [#64665](https://github.com/saltstack/salt/issues/64665)
  - Added win_appx state and execution modules for managing Microsoft Store apps and deprovisioning them from systems [#64978](https://github.com/saltstack/salt/issues/64978)
  - Add support for show_jid to salt-run

    Adds support for show_jid master config option to salt-run, so its behaviour matches the salt cli command. [#65008](https://github.com/saltstack/salt/issues/65008)
  - Add ability to remove packages by wildcard via apt execution module [#65220](https://github.com/saltstack/salt/issues/65220)
  - Added support for master top modules on masterless minions [#65479](https://github.com/saltstack/salt/issues/65479)
  - Allowed accessing the regular mine from the SSH wrapper [#65645](https://github.com/saltstack/salt/issues/65645)
  - Allow enabling backup for Linode in Salt Cloud [#65697](https://github.com/saltstack/salt/issues/65697)
  - Add a backup schedule setter fFunction for Linode VMs [#65713](https://github.com/saltstack/salt/issues/65713)
  - Add acme support for manual plugin hooks [#65744](https://github.com/saltstack/salt/issues/65744)


  - Upgrade to `tornado>=6.3.3` due to https://github.com/advisories/GHSA-qppv-j76h-2rpx [#64989](https://github.com/saltstack/salt/issues/64989)
  - Update to `gitpython>=3.1.35` due to https://github.com/advisories/GHSA-wfm5-v35h-vwf4 and https://github.com/advisories/GHSA-cwvm-v4w8-q58c [#65137](https://github.com/saltstack/salt/issues/65137)


author: Salt Project Packaging <saltproject-packaging@vmware.com> - 3006.6
changelog:
  - Salt no longer time bombs user installations on code using `salt.utils.versions.warn_until_date` [#665924](https://github.com/saltstack/salt/issues/665924)


  - Fix un-closed transport in tornado netapi [#65759](https://github.com/saltstack/salt/issues/65759)


  - CVE-2024-22231 Prevent directory traversal when creating syndic cache directory on the master
    CVE-2024-22232 Prevent directory traversal attacks in the master's serve_file method.
    These vulerablities were discovered and reported by:
    Yudi Zhao(Huawei Nebula Security Lab),Chenwei Jiang(Huawei Nebula Security Lab) [#565](https://github.com/saltstack/salt/issues/565)
  - Update some requirements which had some security issues:

    * Bump to `pycryptodome==3.19.1` and `pycryptodomex==3.19.1` due to https://github.com/advisories/GHSA-j225-cvw7-qrx7
    * Bump to `gitpython==3.1.41` due to https://github.com/advisories/GHSA-2mqj-m65w-jghx
    * Bump to `jinja2==3.1.3` due to https://github.com/advisories/GHSA-h5c8-rqwp-cp95 [#65830](https://github.com/saltstack/salt/issues/65830)


author: Salt Project Packaging <saltproject-packaging@vmware.com> - 3006.7
changelog:
  - Deprecate and stop using ``salt.features`` [#65951](https://github.com/saltstack/salt/issues/65951)


  - Change module search path priority, so Salt extensions can be overridden by syncable modules and module_dirs. You can switch back to the old logic by setting features.enable_deprecated_module_search_path_priority to true, but it will be removed in Salt 3008. [#65938](https://github.com/saltstack/salt/issues/65938)


  - Fix an issue with mac_shadow that was causing a command execution error when
    retrieving values that were not yet set. For example, retrieving last login
    before the user had logged in. [#34658](https://github.com/saltstack/salt/issues/34658)
  - Fixed an issue when keys didn't match because of line endings [#52289](https://github.com/saltstack/salt/issues/52289)
  - Corrected encoding of credentials for use with Artifactory [#63063](https://github.com/saltstack/salt/issues/63063)
  - Use `send_multipart` instead of `send` when sending multipart message. [#65018](https://github.com/saltstack/salt/issues/65018)
  - Fix an issue where the minion would crash on Windows if some of the grains
    failed to resolve [#65154](https://github.com/saltstack/salt/issues/65154)
  - Fix issue with openscap when the error was outside the expected scope. It now
    returns failed with the error code and the error [#65193](https://github.com/saltstack/salt/issues/65193)
  - Upgrade relenv to 0.15.0 to fix namespaced packages installed by salt-pip [#65433](https://github.com/saltstack/salt/issues/65433)
  - Fix regression of fileclient re-use when rendering sls pillars and states [#65450](https://github.com/saltstack/salt/issues/65450)
  - Fixes the s3fs backend computing the local cache's files with the wrong hash type [#65589](https://github.com/saltstack/salt/issues/65589)
  - Fixed Salt-SSH pillar rendering and state rendering with nested SSH calls when called via saltutil.cmd or in an orchestration [#65670](https://github.com/saltstack/salt/issues/65670)
  - Fix boto execution module loading [#65691](https://github.com/saltstack/salt/issues/65691)
  - Removed PR 65185 changes since incomplete solution [#65692](https://github.com/saltstack/salt/issues/65692)
  - catch only ret/ events not all returning events. [#65727](https://github.com/saltstack/salt/issues/65727)
  - Fix nonsensical time in fileclient timeout error. [#65752](https://github.com/saltstack/salt/issues/65752)
  - Fixes an issue when reading/modifying ini files that contain unicode characters [#65777](https://github.com/saltstack/salt/issues/65777)
  - added https proxy to the list of proxies so that requests knows what to do with https based proxies [#65824](https://github.com/saltstack/salt/issues/65824)
  - Ensure minion channels are closed on any master connection error. [#65932](https://github.com/saltstack/salt/issues/65932)
  - Fixed issue where Salt can't find libcrypto when pip installed from a cloned repo [#65954](https://github.com/saltstack/salt/issues/65954)
  - Fix RPM package systemd scriptlets to make RPM packages more universal [#65987](https://github.com/saltstack/salt/issues/65987)
  - Fixed an issue where fileclient requests during Pillar rendering cause
    fileserver backends to be needlessly refreshed. [#65990](https://github.com/saltstack/salt/issues/65990)
  - Fix exceptions being set on futures that are already done in ZeroMQ transport [#66006](https://github.com/saltstack/salt/issues/66006)
  - Use hmac compare_digest method in hashutil module to mitigate potential timing attacks [#66041](https://github.com/saltstack/salt/issues/66041)
  - Fix request channel default timeout regression. In 3006.5 it was changed from
    60 to 30 and is now set back to 60 by default. [#66061](https://github.com/saltstack/salt/issues/66061)
  - Upgrade relenv to 0.15.1 to fix debugpy support. [#66094](https://github.com/saltstack/salt/issues/66094)


  - Bump to ``cryptography==42.0.0`` due to https://github.com/advisories/GHSA-3ww4-gg4f-jr7f

    In the process, we were also required to update to ``pyOpenSSL==24.0.0`` [#66004](https://github.com/saltstack/salt/issues/66004)
  - Bump to `cryptography==42.0.3` due to https://github.com/advisories/GHSA-3ww4-gg4f-jr7f [#66090](https://github.com/saltstack/salt/issues/66090)


author: Salt Project Packaging <saltproject-packaging@vmware.com> - 3007.0
changelog:
  - Removed RHEL 5 support since long since end-of-lifed [#62520](https://github.com/saltstack/salt/issues/62520)
  - Removing Azure-Cloud modules from the code base. [#64322](https://github.com/saltstack/salt/issues/64322)
  - Dropped Python 3.7 support since it's EOL in 27 Jun 2023 [#64417](https://github.com/saltstack/salt/issues/64417)
  - Remove salt.payload.Serial [#64459](https://github.com/saltstack/salt/issues/64459)
  - Remove netmiko_conn and pyeapi_conn from salt.modules.napalm_mod [#64460](https://github.com/saltstack/salt/issues/64460)
  - Removed 'transport' arg from salt.utils.event.get_event [#64461](https://github.com/saltstack/salt/issues/64461)
  - Removed the usage of retired Linode API v3 from Salt Cloud [#64517](https://github.com/saltstack/salt/issues/64517)


  - Deprecate all Proxmox cloud modules [#64224](https://github.com/saltstack/salt/issues/64224)
  - Deprecate all the Vault modules in favor of the Vault Salt Extension https://github.com/salt-extensions/saltext-vault. The Vault modules will be removed in Salt core in 3009.0. [#64893](https://github.com/saltstack/salt/issues/64893)
  - Deprecate all the Docker modules in favor of the Docker Salt Extension https://github.com/saltstack/saltext-docker. The Docker modules will be removed in Salt core in 3009.0. [#64894](https://github.com/saltstack/salt/issues/64894)
  - Deprecate all the Zabbix modules in favor of the Zabbix Salt Extension https://github.com/salt-extensions/saltext-zabbix. The Zabbix modules will be removed in Salt core in 3009.0. [#64896](https://github.com/saltstack/salt/issues/64896)
  - Deprecate all the Apache modules in favor of the Apache Salt Extension https://github.com/salt-extensions/saltext-apache. The Apache modules will be removed in Salt core in 3009.0. [#64909](https://github.com/saltstack/salt/issues/64909)
  - Deprecation warning for Salt's backport of ``OrderedDict`` class which will be removed in 3009 [#65542](https://github.com/saltstack/salt/issues/65542)
  - Deprecate Kubernetes modules for move to saltext-kubernetes in version 3009 [#65565](https://github.com/saltstack/salt/issues/65565)
  - Deprecated all Pushover modules in favor of the Salt Extension at https://github.com/salt-extensions/saltext-pushover. The Pushover modules will be removed from Salt core in 3009.0 [#65567](https://github.com/saltstack/salt/issues/65567)
  - Removed deprecated code:

    * All of ``salt/log/`` which has been on a deprecation path for a long time.
    * Some of the logging handlers found in ``salt/_logging/handlers`` have been removed since the standard library provides
      them.
    * Removed the deprecated ``salt/modules/cassandra_mod.py`` module and any tests for it.
    * Removed the deprecated ``salt/returners/cassandra_return.py`` module and any tests for it.
    * Removed the deprecated ``salt/returners/django_return.py`` module and any tests for it. [#65986](https://github.com/saltstack/salt/issues/65986)


  - Masquerade property will not default to false turning off masquerade if not specified. [#53120](https://github.com/saltstack/salt/issues/53120)
  - Addressed Python 3.11 deprecations:

    * Switch to `FullArgSpec` since Py 3.11 no longer has `ArgSpec`, deprecated since Py 3.0
    * Stopped using the deprecated `cgi` module.
    * Stopped using the deprecated `pipes` module
    * Stopped using the deprecated `imp` module [#64457](https://github.com/saltstack/salt/issues/64457)
  - changed 'gpg_decrypt_must_succeed' default from False to True [#64462](https://github.com/saltstack/salt/issues/64462)


  - When an NFS or FUSE mount fails to unmount when mount options have changed, try again with a lazy umount before mounting again. [#18907](https://github.com/saltstack/salt/issues/18907)
  - fix autoaccept gpg keys by supporting it in refresh_db module [#42039](https://github.com/saltstack/salt/issues/42039)
  - Made cmd.script work with files from the fileserver via salt-ssh [#48067](https://github.com/saltstack/salt/issues/48067)
  - Made slsutil.renderer work with salt-ssh [#50196](https://github.com/saltstack/salt/issues/50196)
  - Fixed defaults.merge is not available when using salt-ssh [#51605](https://github.com/saltstack/salt/issues/51605)
  - Fix extfs.mkfs missing parameter handling for -C, -d, and -e [#51858](https://github.com/saltstack/salt/issues/51858)
  - Fixed Salt master does not renew token [#51986](https://github.com/saltstack/salt/issues/51986)
  - Fixed salt-ssh continues state/pillar rendering with incorrect data when an exception is raised by a module on the target [#52452](https://github.com/saltstack/salt/issues/52452)
  - Fix extfs.tune has 'reserved' documented twice and is missing the 'reserved_percentage' keyword argument [#54426](https://github.com/saltstack/salt/issues/54426)
  - Fix the ability of the 'selinux.port_policy_present' state to modify. [#55687](https://github.com/saltstack/salt/issues/55687)
  - Fixed config.get does not support merge option with salt-ssh [#56441](https://github.com/saltstack/salt/issues/56441)
  - Removed an unused assignment in file.patch [#57204](https://github.com/saltstack/salt/issues/57204)
  - Fixed vault module fetching more than one secret in one run with single-use tokens [#57561](https://github.com/saltstack/salt/issues/57561)
  - Use brew path from which in mac_brew_pkg module and rely on _homebrew_bin() everytime [#57946](https://github.com/saltstack/salt/issues/57946)
  - Fixed Vault verify option to work on minions when only specified in master config [#58174](https://github.com/saltstack/salt/issues/58174)
  - Fixed vault command errors configured locally [#58580](https://github.com/saltstack/salt/issues/58580)
  - Fixed issue with basic auth causing invalid header error and 401 Bad Request, by using HTTPBasicAuthHandler instead of header. [#58936](https://github.com/saltstack/salt/issues/58936)
  - Make the LXD module work with pyLXD > 2.10 [#59514](https://github.com/saltstack/salt/issues/59514)
  - Return error if patch file passed to state file.patch is malformed. [#59806](https://github.com/saltstack/salt/issues/59806)
  - Handle failure and error information from tuned module/state [#60500](https://github.com/saltstack/salt/issues/60500)
  - Fixed sdb.get_or_set_hash with Vault single-use tokens [#60779](https://github.com/saltstack/salt/issues/60779)
  - Fixed state.test does not work with salt-ssh [#61100](https://github.com/saltstack/salt/issues/61100)
  - Made slsutil.findup work with salt-ssh [#61143](https://github.com/saltstack/salt/issues/61143)
  - Allow all primitive grain types for autosign_grains [#61416](https://github.com/saltstack/salt/issues/61416), [#63708](https://github.com/saltstack/salt/issues/63708)
  - `ipset.new_set` no longer fails when creating a set type that uses the `family` create option [#61620](https://github.com/saltstack/salt/issues/61620)
  - Fixed Vault session storage to allow unlimited use tokens [#62380](https://github.com/saltstack/salt/issues/62380)
  - fix the efi grain on FreeBSD [#63052](https://github.com/saltstack/salt/issues/63052)
  - Fixed gpg.receive_keys returns success on failed import [#63144](https://github.com/saltstack/salt/issues/63144)
  - Fixed GPG state module always reports success without changes [#63153](https://github.com/saltstack/salt/issues/63153)
  - Fixed GPG state module does not respect test mode [#63156](https://github.com/saltstack/salt/issues/63156)
  - Fixed gpg.absent with gnupghome/user, fixed gpg.delete_key with gnupghome [#63159](https://github.com/saltstack/salt/issues/63159)
  - Fixed service module does not handle enable/disable if systemd service is an alias [#63214](https://github.com/saltstack/salt/issues/63214)
  - Made x509_v2 compound match detection use new runner instead of peer publishing [#63278](https://github.com/saltstack/salt/issues/63278)
  - Need to make sure we update __pillar__ during a pillar refresh to ensure that process_beacons has the updated beacons loaded from pillar. [#63583](https://github.com/saltstack/salt/issues/63583)
  - This implements the vpc_uuid parameter when creating a droplet. This parameter selects the correct virtual private cloud (private network interface). [#63714](https://github.com/saltstack/salt/issues/63714)
  - pkg.installed no longer reports failure when installing packages that are installed via the task manager [#63767](https://github.com/saltstack/salt/issues/63767)
  - mac_xattr.list and mac_xattr.read will replace undecode-able bytes to avoid raising CommandExecutionError. [#63779](https://github.com/saltstack/salt/issues/63779) [#63779](https://github.com/saltstack/salt/issues/63779)
  - Fix aptpkg.latest_version performance, reducing number of times to 'shell out' [#63982](https://github.com/saltstack/salt/issues/63982)
  - Added option to use a fresh connection for mysql cache [#63991](https://github.com/saltstack/salt/issues/63991)
  - [lxd] Fixed a bug in `container_create` which prevented devices which are not of type `disk` to be correctly created and added to the container when passed via the `devices` parameter. [#63996](https://github.com/saltstack/salt/issues/63996)
  - Skipped the `isfile` check to greatly increase speed of reading minion keys for systems with a large number of minions on slow file storage [#64260](https://github.com/saltstack/salt/issues/64260)
  - Fix utf8 handling in 'pass' renderer [#64300](https://github.com/saltstack/salt/issues/64300)
  - Upgade tornado to 6.3.2 [#64305](https://github.com/saltstack/salt/issues/64305)
  - Prevent errors due missing 'transactional_update.apply' on SLE Micro and MicroOS. [#64369](https://github.com/saltstack/salt/issues/64369)
  - Fix 'unable to unmount' failure to return False result instead of None [#64420](https://github.com/saltstack/salt/issues/64420)
  - Fixed issue uninstalling duplicate packages in ``win_appx`` execution module [#64450](https://github.com/saltstack/salt/issues/64450)
  - Clean up tech debt, IPC now uses tcp transport. [#64488](https://github.com/saltstack/salt/issues/64488)
  - Made salt-ssh more strict when handling unexpected situations and state.* wrappers treat a remote exception as failure, excluded salt-ssh error returns from mine [#64531](https://github.com/saltstack/salt/issues/64531)
  - Fix flaky test for LazyLoader with isolated mocking of threading.RLock [#64567](https://github.com/saltstack/salt/issues/64567)
  - Fix possible `KeyError` exceptions in `salt.utils.user.get_group_dict`
    while reading improper duplicated GID assigned for the user. [#64599](https://github.com/saltstack/salt/issues/64599)
  - changed vm_config() to deep-merge vm_overrides of specific VM, instead of simple-merging the whole vm_overrides [#64610](https://github.com/saltstack/salt/issues/64610)
  - Fix the way Salt tries to get the Homebrew's prefix

    The first attempt to get the Homebrew's prefix is to look for
    the `HOMEBREW_PREFIX` environment variable. If it's not set, then
    Salt tries to get the prefix from the `brew` command. However, the
    `brew` command can fail. So a last attempt is made to get the
    prefix by guessing the installation path. [#64924](https://github.com/saltstack/salt/issues/64924)
  - Add missing MySQL Grant SERVICE_CONNECTION_ADMIN to mysql module. [#64934](https://github.com/saltstack/salt/issues/64934)
  - Fixed slsutil.update with salt-ssh during template rendering [#65067](https://github.com/saltstack/salt/issues/65067)
  - Keep track when an included file only includes sls files but is a requisite. [#65080](https://github.com/saltstack/salt/issues/65080)
  - Fixed `gpg.present` succeeds when the keyserver is unreachable [#65169](https://github.com/saltstack/salt/issues/65169)
  - Fix typo in nftables module to ensure unique nft family values [#65295](https://github.com/saltstack/salt/issues/65295)
  - Dereference symlinks to set proper __cli opt [#65435](https://github.com/saltstack/salt/issues/65435)
  - Made salt-ssh merge master top returns for the same environment [#65480](https://github.com/saltstack/salt/issues/65480)
  - Account for situation where the metadata grain fails because the AWS environment requires an authentication token to query the metadata URL. [#65513](https://github.com/saltstack/salt/issues/65513)
  - Improve the condition of overriding target for pip with VENV_PIP_TARGET environment variable. [#65562](https://github.com/saltstack/salt/issues/65562)
  - Added SSH wrapper for logmod [#65630](https://github.com/saltstack/salt/issues/65630)
  - Include changes in the results when schedule.present state is run with test=True. [#65652](https://github.com/saltstack/salt/issues/65652)
  - Fix extfs.tune doesn't pass retcode to module.run [#65686](https://github.com/saltstack/salt/issues/65686)
  - Return an error message when the DNS plugin is not supported [#65739](https://github.com/saltstack/salt/issues/65739)
  - Execution modules have access to regular fileclient durring pillar rendering. [#66124](https://github.com/saltstack/salt/issues/66124)
  - Fixed a issue with server channel where a minion's public key
    would be rejected if it contained a final newline character. [#66126](https://github.com/saltstack/salt/issues/66126)


  - Allowed publishing to regular minions from the SSH wrapper [#40943](https://github.com/saltstack/salt/issues/40943)
  - Added syncing of custom salt-ssh wrappers [#45450](https://github.com/saltstack/salt/issues/45450)
  - Made salt-ssh sync custom utils [#53666](https://github.com/saltstack/salt/issues/53666)
  - Add ability to use file.managed style check_cmd in file.serialize [#53982](https://github.com/saltstack/salt/issues/53982)
  - Revised use of deprecated net-tools and added support for ip neighbour with IPv4 ip_neighs, IPv6 ip_neighs6 [#57541](https://github.com/saltstack/salt/issues/57541)
  - Added password support to Redis returner. [#58044](https://github.com/saltstack/salt/issues/58044)
  - Added a state (win_task) for managing scheduled tasks on Windows [#59037](https://github.com/saltstack/salt/issues/59037)
  - Added keyring param to gpg modules [#59783](https://github.com/saltstack/salt/issues/59783)
  - Added new grain to detect the Salt package type: onedir, pip or system [#62589](https://github.com/saltstack/salt/issues/62589)
  - Added Vault AppRole and identity issuance to minions [#62823](https://github.com/saltstack/salt/issues/62823)
  - Added Vault AppRole auth mount path configuration option [#62825](https://github.com/saltstack/salt/issues/62825)
  - Added distribution of Vault authentication details via response wrapping [#62828](https://github.com/saltstack/salt/issues/62828)
  - Add salt package type information. Either onedir, pip or system. [#62961](https://github.com/saltstack/salt/issues/62961)
  - Added signature verification to file.managed/archive.extracted [#63143](https://github.com/saltstack/salt/issues/63143)
  - Added signed_by_any/signed_by_all parameters to gpg.verify [#63166](https://github.com/saltstack/salt/issues/63166)
  - Added match runner [#63278](https://github.com/saltstack/salt/issues/63278)
  - Added Vault token lifecycle management [#63406](https://github.com/saltstack/salt/issues/63406)
  - adding new call for openscap xccdf eval supporting new parameters [#63416](https://github.com/saltstack/salt/issues/63416)
  - Added Vault lease management utility [#63440](https://github.com/saltstack/salt/issues/63440)
  - implement removal of ptf packages in zypper pkg module [#63442](https://github.com/saltstack/salt/issues/63442)
  - add JUnit output for saltcheck [#63463](https://github.com/saltstack/salt/issues/63463)
  - Add ability for file.keyvalue to create a file if it doesn't exist [#63545](https://github.com/saltstack/salt/issues/63545)
  - added cleanup of temporary mountpoint dir for macpackage installed state [#63905](https://github.com/saltstack/salt/issues/63905)
  - Add pkg.installed show installable version in test mode [#63985](https://github.com/saltstack/salt/issues/63985)
  - Added patch option to Vault SDB driver [#64096](https://github.com/saltstack/salt/issues/64096)
  - Added flags to create local users and groups [#64256](https://github.com/saltstack/salt/issues/64256)
  - Added inline specification of trusted CA root certificate for Vault [#64379](https://github.com/saltstack/salt/issues/64379)
  - Add ability to return False result in test mode of configurable_test_state [#64418](https://github.com/saltstack/salt/issues/64418)
  - Switched Salt's onedir Python version to 3.11 [#64457](https://github.com/saltstack/salt/issues/64457)
  - Added support for dnf5 and its new command syntax [#64532](https://github.com/saltstack/salt/issues/64532)
  - Adding a new decorator to indicate when a module is deprecated in favor of a Salt extension. [#64569](https://github.com/saltstack/salt/issues/64569)
  - Add jq-esque to_entries and from_entries functions [#64600](https://github.com/saltstack/salt/issues/64600)
  - Added ability to use PYTHONWARNINGS=ignore to silence deprecation warnings. [#64660](https://github.com/saltstack/salt/issues/64660)
  - Add follow_symlinks to file.symlink exec module to switch to os.path.lexists when False [#64665](https://github.com/saltstack/salt/issues/64665)
  - Strenghten Salt's HA capabilities with master clustering. [#64939](https://github.com/saltstack/salt/issues/64939)
  - Added win_appx state and execution modules for managing Microsoft Store apps and deprovisioning them from systems [#64978](https://github.com/saltstack/salt/issues/64978)
  - Add support for show_jid to salt-run

    Adds support for show_jid master config option to salt-run, so its behaviour matches the salt cli command. [#65008](https://github.com/saltstack/salt/issues/65008)
  - Add ability to remove packages by wildcard via apt execution module [#65220](https://github.com/saltstack/salt/issues/65220)
  - Added support for master top modules on masterless minions [#65479](https://github.com/saltstack/salt/issues/65479)
  - Allowed accessing the regular mine from the SSH wrapper [#65645](https://github.com/saltstack/salt/issues/65645)
  - Allow enabling backup for Linode in Salt Cloud [#65697](https://github.com/saltstack/salt/issues/65697)
  - Add a backup schedule setter fFunction for Linode VMs [#65713](https://github.com/saltstack/salt/issues/65713)
  - Add acme support for manual plugin hooks [#65744](https://github.com/saltstack/salt/issues/65744)


  - Upgrade to `tornado>=6.3.3` due to https://github.com/advisories/GHSA-qppv-j76h-2rpx [#64989](https://github.com/saltstack/salt/issues/64989)
  - Update to `gitpython>=3.1.35` due to https://github.com/advisories/GHSA-wfm5-v35h-vwf4 and https://github.com/advisories/GHSA-cwvm-v4w8-q58c [#65137](https://github.com/saltstack/salt/issues/65137)


author: Salt Project Packaging <saltproject-packaging@vmware.com> - 3006.8
changelog:
  - Removed deprecated code scheduled to be removed on 2024-01-01:

    * ``TemporaryLoggingHandler`` and ``QueueHandler`` in ``salt/_logging/handlers.py``
    * All of the ``salt/log`` package.
    * The ``salt/modules/cassandra_mod.py`` module.
    * The ``salt/returners/cassandra_return.py`` returner.
    * The ``salt/returners/django_return.py`` returner. [#66147](https://github.com/saltstack/salt/issues/66147)


  - Drop Fedora 37 and Fedora 38 support [#65860](https://github.com/saltstack/salt/issues/65860)
  - Drop CentOS Stream 8 and 9 from CI/CD [#66104](https://github.com/saltstack/salt/issues/66104)
  - Drop Photon OS 3 support [#66105](https://github.com/saltstack/salt/issues/66105)
  - The ``salt.utils.psutil_compat`` module has been deprecated and will be removed in Salt 3008. Please use the ``psutil`` module directly. [#66139](https://github.com/saltstack/salt/issues/66139)


  - ``user.add`` on Windows now allows you to add user names that contain all
    numeric characters [#53363](https://github.com/saltstack/salt/issues/53363)
  - Fix an issue with the win_system module detecting established connections on
    non-Windows systems. Uses psutils instead of parsing the return of netstat [#60508](https://github.com/saltstack/salt/issues/60508)
  - pkg.refresh_db on Windows now honors saltenv [#61807](https://github.com/saltstack/salt/issues/61807)
  - Fixed an issue with adding new machine policies and applying those same
    policies in the same state by adding a ``refresh_cache`` option to the
    ``lgpo.set`` state. [#62734](https://github.com/saltstack/salt/issues/62734)
  - file.managed correctly handles file path with '#' [#63060](https://github.com/saltstack/salt/issues/63060)
  - Fix master ip detection when DNS records change [#63654](https://github.com/saltstack/salt/issues/63654)
  - Fix user and group management on Windows to handle the Everyone group [#63667](https://github.com/saltstack/salt/issues/63667)
  - Fixes an issue in pkg.refresh_db on Windows where new package definition
    files were not being picked up on the first run [#63848](https://github.com/saltstack/salt/issues/63848)
  - Display a proper error when pki commands fail in the win_pki module [#64933](https://github.com/saltstack/salt/issues/64933)
  - Prevent full system upgrade on single package install for Arch Linux [#65200](https://github.com/saltstack/salt/issues/65200)
  - When using s3fs, if files are deleted from the bucket, they were not deleted in
    the master or minion local cache, which could lead to unexpected file copies or
    even state applications. This change makes the local cache consistent with the
    remote bucket by deleting files locally that are deleted from the bucket.

    **NOTE** this could lead to **breakage** on your affected systems if it was
    inadvertently depending on previously deleted files. [#65611](https://github.com/saltstack/salt/issues/65611)
  - Fixed an issue with file.directory state where paths would be modified in test
    mode if backupname is used. [#66049](https://github.com/saltstack/salt/issues/66049)
  - Execution modules have access to regular fileclient durring pillar rendering. [#66124](https://github.com/saltstack/salt/issues/66124)
  - Fixed a issue with server channel where a minion's public key
    would be rejected if it contained a final newline character. [#66126](https://github.com/saltstack/salt/issues/66126)
  - Fix content type backwards compatablity with http proxy post requests in the http utils module. [#66127](https://github.com/saltstack/salt/issues/66127)
  - Fix systemctl with "try-restart" instead of "retry-restart" within the RPM spec, properly restarting upgraded services [#66143](https://github.com/saltstack/salt/issues/66143)
  - Auto discovery of ssh, scp and ssh-keygen binaries. [#66205](https://github.com/saltstack/salt/issues/66205)
  - Add leading slash to salt helper file paths as per dh_links requirement [#66280](https://github.com/saltstack/salt/issues/66280)
  - Fixed x509.certificate_managed - ca_server did not return a certificate [#66284](https://github.com/saltstack/salt/issues/66284)
  - removed log line that did nothing. [#66289](https://github.com/saltstack/salt/issues/66289)
  - Chocolatey: Make sure the return dictionary from ``chocolatey.version``
    contains lowercase keys [#66290](https://github.com/saltstack/salt/issues/66290)
  - fix cacheing inline pillar, by not rendering inline pillar during cache save function. [#66292](https://github.com/saltstack/salt/issues/66292)
  - The file module correctly perserves file permissions on link target. [#66400](https://github.com/saltstack/salt/issues/66400)
  - Upgrade relenv to 0.16.0 and python to 3.10.14 [#66402](https://github.com/saltstack/salt/issues/66402)
  - backport the fix from #66164 to fix #65703. use OrderedDict to fix bad indexing. [#66705](https://github.com/saltstack/salt/issues/66705)


  - Add Fedora 39 support [#65859](https://github.com/saltstack/salt/issues/65859)


  - Upgrade to `cryptography==42.0.5` due to a few security issues:

    * https://github.com/advisories/GHSA-9v9h-cgj8-h64p
    * https://github.com/advisories/GHSA-3ww4-gg4f-jr7f
    * https://github.com/advisories/GHSA-6vqw-3v5j-54x4 [#66141](https://github.com/saltstack/salt/issues/66141)
  - Bump to `idna==3.7` due to https://github.com/advisories/GHSA-jjg7-2v4v-x38h [#66377](https://github.com/saltstack/salt/issues/66377)
  - Bump to `aiohttp==3.9.4` due to https://github.com/advisories/GHSA-7gpw-8wmc-pm8g [#66411](https://github.com/saltstack/salt/issues/66411)


author: Salt Project Packaging <saltproject-packaging@vmware.com> - 3007.1
changelog:
  - The ``salt.utils.psutil_compat`` was deprecated and now removed in Salt 3008. Please use the ``psutil`` module directly. [#66160](https://github.com/saltstack/salt/issues/66160)


  - Fixes multiple issues with the cmd module on Windows. Scripts are called using
    the ``-File`` parameter to the ``powershell.exe`` binary. ``CLIXML`` data in
    stderr is now removed (only applies to encoded commands). Commands can now be
    sent to ``cmd.powershell`` as a list. Makes sure JSON data returned is valid.
    Strips whitespace from the return when using ``runas``. [#61166](https://github.com/saltstack/salt/issues/61166)
  - Fixed the win_lgpo_netsh salt util to handle non-English systems. This was a
    rewrite to use PowerShell instead of netsh to make the changes on the system [#61534](https://github.com/saltstack/salt/issues/61534)
  - Fix typo in nftables module to ensure unique nft family values [#65295](https://github.com/saltstack/salt/issues/65295)
  - Corrected x509_v2 CRL creation `last_update` and `next_update` values when system timezone is not UTC [#65837](https://github.com/saltstack/salt/issues/65837)
  - Fix for NoneType can't be used in 'await' expression error. [#66177](https://github.com/saltstack/salt/issues/66177)
  - Log "Publish server binding pub to" messages to debug instead of error level. [#66179](https://github.com/saltstack/salt/issues/66179)
  - Fix syndic startup by making payload handler a coroutine [#66237](https://github.com/saltstack/salt/issues/66237)
  - Fixed `aptpkg.remove` "unable to locate package" error for non-existent package [#66260](https://github.com/saltstack/salt/issues/66260)
  - Fixed pillar.ls doesn't accept kwargs [#66262](https://github.com/saltstack/salt/issues/66262)
  - Fix cache directory setting in Master Cluster tutorial [#66264](https://github.com/saltstack/salt/issues/66264)
  - Change log level of successful master cluster key exchange from error to info. [#66266](https://github.com/saltstack/salt/issues/66266)
  - Made `file.managed` skip download of a remote source if the managed file already exists with the correct hash [#66342](https://github.com/saltstack/salt/issues/66342)
  - Fixed nftables.build_rule breaks ipv6 rules by using the wrong syntax for source and destination addresses [#66382](https://github.com/saltstack/salt/issues/66382)


  - Added the ability to pass a version of chocolatey to install to the
    chocolatey.bootstrap function. Also added states to bootstrap and
    unbootstrap chocolatey. [#64722](https://github.com/saltstack/salt/issues/64722)
  - Add Ubuntu 24.04 support [#66180](https://github.com/saltstack/salt/issues/66180)
  - Add Fedora 40 support, replacing Fedora 39 [#66300](https://github.com/saltstack/salt/issues/66300)


  - Bump to `pydantic==2.6.4` due to https://github.com/advisories/GHSA-mr82-8j83-vxmv [#66433](https://github.com/saltstack/salt/issues/66433)
  - Bump to ``jinja2==3.1.4`` due to https://github.com/advisories/GHSA-h75v-3vvj-5mfj [#66488](https://github.com/saltstack/salt/issues/66488)


author: Salt Project Packaging <saltproject-packaging@vmware.com> - 3007.1+198.g29ffc3ab1d
changelog:
  - Drop CentOS 7 support [#66623](https://github.com/saltstack/salt/issues/66623)
  - No longer build RPM packages with CentOS Stream 9 [#66624](https://github.com/saltstack/salt/issues/66624)


  - Made slsutil.renderer work with salt-ssh [#50196](https://github.com/saltstack/salt/issues/50196)
  - Fixed defaults.merge is not available when using salt-ssh [#51605](https://github.com/saltstack/salt/issues/51605)
  - Fixed config.get does not support merge option with salt-ssh [#56441](https://github.com/saltstack/salt/issues/56441)
  - Update to include croniter in pkg requirements [#57649](https://github.com/saltstack/salt/issues/57649)
  - Fixed state.test does not work with salt-ssh [#61100](https://github.com/saltstack/salt/issues/61100)
  - Made slsutil.findup work with salt-ssh [#61143](https://github.com/saltstack/salt/issues/61143)
  - Fix utf8 handling in 'pass' renderer [#64300](https://github.com/saltstack/salt/issues/64300)
  - Fixed incorrect version argument will be ignored for multiple package targets warning when using pkgs argument to yumpkg module. [#64563](https://github.com/saltstack/salt/issues/64563)
  - salt-cloud honors root_dir config setting for log_file location and fixes for root_dir locations on windows. [#64728](https://github.com/saltstack/salt/issues/64728)
  - Fixed slsutil.update with salt-ssh during template rendering [#65067](https://github.com/saltstack/salt/issues/65067)
  - Fix config.items when called on minion [#65251](https://github.com/saltstack/salt/issues/65251)
  - pkg.installed state aggregate does not honors requires requisite [#65304](https://github.com/saltstack/salt/issues/65304)
  - Added SSH wrapper for logmod [#65630](https://github.com/saltstack/salt/issues/65630)
  - Fix for GitFS failure to unlock lock file, and resource cleanup for process SIGTERM [#65816](https://github.com/saltstack/salt/issues/65816)
  - Make sure the master_event_pub.ipc file has correct reed/write permissions for salt group. [#66228](https://github.com/saltstack/salt/issues/66228)
  - fix #66194: Exchange HTTPClient by AsyncHTTPClient in salt.utils.http [#66330](https://github.com/saltstack/salt/issues/66330)
  - Fix win_task ExecutionTimeLimit and result/error code interpretation [#66347](https://github.com/saltstack/salt/issues/66347), [#66441](https://github.com/saltstack/salt/issues/66441)
  - Fixed x509_v2 certificate.managed crash for locally signed certificates if the signing policy defines signing_private_key [#66414](https://github.com/saltstack/salt/issues/66414)
  - Fix support for FIPS approved encryption and signing algorithms. [#66579](https://github.com/saltstack/salt/issues/66579)
  - Fix RPM package provides [#66604](https://github.com/saltstack/salt/issues/66604)
  - Upgrade relAenv to 0.16.1. This release fixes several package installs for salt-pip [#66632](https://github.com/saltstack/salt/issues/66632)
  - Upgrade relenv to 0.17.0 (https://github.com/saltstack/relenv/blob/v0.17.0/CHANGELOG.md) [#66663](https://github.com/saltstack/salt/issues/66663)
  - Upgrade dependencies due to security issues:
    - pymysql>=1.1.1
    - requests>=2.32.0
    - docker>=7.1.0 [#66666](https://github.com/saltstack/salt/issues/66666)
  - Corrected missed line in branch 3006.x when backporting from PR 61620 and 65044 [#66683](https://github.com/saltstack/salt/issues/66683)


  - Build RPM packages with Rocky Linux 9 (instead of CentOS Stream 9) [#66624](https://github.com/saltstack/salt/issues/66624)


