3.27.1

Release announcement: https://cfengine.com/blog/2026/cfengine-3-24-4-and-3-27-1-released/

Pull requests

• ENT-13422: Updated CHANGELOG.md 3.27.0 (3.27) by @nickanderson in #3101
• Bumped .CFVERSION number to 3.27.1 by @olehermanse in #3103
• Fixed bad regex in packages promise method for pip (3.27) by @nickanderson in #3105
• ENT-13497: Improved CHANGELOG.md markdown formatting (3.27.x) by @aleksandrychev in #3108
• ENT-11784: Added dnf package module (3.27) by @nickanderson in #3109
• ENT-12129: Added full hosts delete and 2FA support to distributed cleanup script (3.27.x) by @aleksandrychev in #3115
• CFE-4623: Fix modules_presence to handle findfiles() trailing slash behavior (3.27) by @nickanderson in #3124
• inventory/linux: Use Python script to check version (3.27.x) by @nickanderson in #3126
• CFE-3866: Add workaround for set_variable_values_ini errors when section does not exist (3.27) by @nickanderson in #3130
• Fix typos (3.27) by @nickanderson in #3136
• Added changelog for 3.27.1 by @larsewi in #3141
• CFE-2852: dnf_group package module (3.27) by @nickanderson in #3142
• CFE-4639: Removed conflicting --global flag from standard_services systemctl invocation (3.27.x) by @larsewi in #3138
• CHANGELOG.md: updated changelog entries for 3.27.1 by @larsewi in #3147
• Added missing changelog entry by @nickanderson in #3150

All commits: 3.27.0...3.27.1

3.24.4

Release announcement: https://cfengine.com/blog/2026/cfengine-3-24-4-and-3-27-1-released/

Pull requests

• Fixed incorrect previous fix for timeout for php processing to allow for longer running API requests (3.24) by @craigcomstock in #3090
• Bumped .CFVERSION number to 3.24.4 by @olehermanse in #3092
• Fixed error when rendering mustache template on RHEL 10 by @larsewi in #3093
• ENT-13638: Fixed SELinux context on apachectl after template repair (3.24.x) by @aleksandrychev in #3097
• ENT-13667: Fixed bad regex in packages promise method for pip (3.24.x) by @larsewi in #3100
• ENT-11784: Added dnf package module (3.24) by @nickanderson in #3110
• CFE-4452: Made system_log_level configurable via Augments (3.24) by @nickanderson in #3121
• ENT-12658: Inhibit management of share config.php file when mpf_disable_mission_portal_docroot_sync_from_share_gui is defined (3.24) by @nickanderson in #3123
• CFE-4623: Fix modules_presence to handle findfiles() trailing slash behavior (3.24) by @nickanderson in #3125
• inventory/linux: Use Python script to check version (3.24.x) by @nickanderson in #3127
• CFE-3866: workaround set_variable_values_ini errors when section does not exist (3.24) by @nickanderson in #3131
• Fix typos (3.24) by @nickanderson in #3137
• ENT-13497: Improved CHANGELOG.md formatting (3.24.x) by @aleksandrychev in #3145
• CFE-2852: dnf_group package module (3.24) by @nickanderson in #3143
• Added changelog for 3.24.4 by @aleksandrychev in #3146
• CHANGELOG.md: updated changelog entries for 3.24.4 by @larsewi in #3148
• Removed invalid changelog entry by @nickanderson in #3151
• CFE-4639: Removed conflicting --global flag from standard_services systemctl invocation (3.24.x) by @larsewi in #3139

All commits: 3.24.3...3.24.4

3.27.0

Pull requests

• Bumped .CFVERSION number to 3.27.0 by @craigcomstock in #3010
• ENT-12990: Removed duplicate well known paths for ls and lsof on opensuse by @nickanderson in #3009
• CFE-4543: Made protocol_version configurable via Augments by @nickanderson in #3013
• Added exception for Ubuntu-24 to accept our test gpg key which is "weak" (rsa1024) by @craigcomstock in #3015
• ENT-13066: Removed edit_defaults attribute that does not have effect with content attribute by @nickanderson in #3018
• ENT-12988: Added dmidecode to well known paths for Red Hat by @nickanderson in #3007
• ENT-12987: Fixed path to lsof on Red Hat 7 and greater by @nickanderson in #3008
• CFE-4573: Added Ubuntu 24.04 and Debian 12 to standalone_self_upgrade. by @rexberg in #3026
• ENT-13170: Added history for mpf_disable_mission_portal_docroot_sync_from_share_gui class by @nickanderson in #3030
• ENT-13172: Stopped automatic mirroring of WORKDIR/share/GUI to Mission Portal docroot by @nickanderson in #3034
• Stopped enforcing permission management of $(sys.workdir)/share/GUI by @nickanderson in #3033
• ENT-13173: Stopped mirroring .htaccess from share/GUI to Mission Portal docroot by @nickanderson in #3035
• ENT-13175: Disabled sync of Mission Portal config from share/GUI unless explicitly enabled by @nickanderson in #3036
• Top down evaluation custom promise type test by @victormlg in #3029
• ENT-13210: Prevented nfs server inventory from doing unnecessary extra work by @nickanderson in #3038
• CFE-4582: Added fsattrs bodies for the immutable bit by @nickanderson in #3037
• Inventory Unique NFS Servers and Recommend consistency in definition by @nickanderson in #3041
• CFE-4588: Fixed duplicate bundlesequence_end when bundlesequence_classification not defined by @nickanderson in #3044
• ENT-13243: Stopped enforcing permissions of public docroot scripts by @nickanderson in #3047
• ENT-12740: Added more directories that should be deleted to prepare.sh by @jakub-nt in #3048
• ENT-11481: Redirection from HTTP to HTTPS responsibility moved from Apache to PHP by @aleksandrychev in #3049
• ENT-4043: Disabled policy versions by @victormlg in #3050
• Increased timeout for php processing to allow for longer running requests by @craigcomstock in #3051
• Fixed some ArchLinux missing paths by @m-bouissou in #3002
• Fix package naming for Ubuntu 24 arm64 by @rexberg in #3056
• lib/services: Fix systemd example/reports by @btriller in #3059
• Adjust nova API rest URL for custom https port by @craigcomstock in #2988
• Changelog improvements by @olehermanse in #3066
• CFE-4602: Added documentation for default:def.control_agent_maxconnections by @nickanderson in #3071
• Added RedHat 10 and Debian 13 to platforms to skip for packages tests by @craigcomstock in #3074
• ENT-13495: Made evaluation_order configurable via Augments by @nickanderson in #3068
• CFE-4590: Made default_directory_create_mode configurable via Augments by @nickanderson in #3076
• Fixed incorrect variable name for evaluation_order in update policy by @nickanderson in #3077
• ENT-13442: Added 3.27.0 changelog entries by @aleksandrychev in #3075
• Fixed improper inclusion of community agents in running test that relies on enterprise feature: packages patches data by @craigcomstock in #3079
• Removed not existing refrences to default_directory_create_mode in body common control by @aleksandrychev in #3083
• Fixed cfruncommand for Windows causing "Too many arguments" error by @craigcomstock in #3082
• Added late changelog entry for ENT-13530 by @craigcomstock in #3086
• Added needed custom port to API in the API itself (LDAP related) by @craigcomstock in #3087
• ENT-13638: Fixed SELinux context on apachectl after template repair by @aleksandrychev in #3096
• Added RHEL 10 support for semanage_package in FR setup by @aleksandrychev in #3095

New Contributors

• @victormlg made their first contribution in #3029
• @jakub-nt made their first contribution in #3048
• @m-bouissou made their first contribution in #3002

All commits: 3.26.0...3.27.0

3.24.3

Release announcement: https://cfengine.com/blog/2025/cfengine-3-21-8-and-3-24-3-released/
All commits: 3.24.1...3.24.3

Pull requests

• ENT-12106: Replaced links to IRC channels with Matrix, help list, and Github discussions (3.24) by @nickanderson in #2967
• Fixed issue with yum package module regarding packages with epoch not validating (3.24) by @craigcomstock in #2971
• ENT-12531: Allowed images from raw.github.com (3.24) by @nickanderson in #2974
• Fixed location of Mission Portal application logs for log_dir cleanup (3.24) by @craigcomstock in #2978
• ENT-12560: Added paths for the dmsetup, fdisk, and lshw commands (3.24) by @nickanderson in #2981
• Fix typo and some formatting issues (3.24) by @nickanderson in #2985
• Tidied up some not needed steps in tests workflow (3.24) by @craigcomstock in #2996
• ENT-12842: Updated CHANGELOG.md for 3.24.2 (3.24.x) by @larsewi in #3000
• Bumped .CFVERSION number to 3.24.3 by @olehermanse in #3006
• ENT-12990: Removed duplicate well known paths for ls and lsof on opensuse (3.24) by @nickanderson in #3011
• CFE-4543: Made protocol_version configurable via Augments (3.24) by @nickanderson in #3014
• Added exception for Ubuntu-24 to accept our test gpg key which is "weak" (rsa1024) (3.24) by @craigcomstock in #3016
• ENT-13066: Removed edit_defaults attribute that does not have effect with content attribute (3.24) by @nickanderson in #3019
• ENT-12988: Added dmidecode to well known paths for Red Hat (3.24) by @nickanderson in #3021
• ENT-12987: Fixed path to lsof on Red Hat 7 and greater (3.24) by @nickanderson in #3023
• CFE-4573: Added Ubuntu 24.04 and Debian 12 by @nickanderson in #3027
• ENT-13170: Added history for mpf_disable_mission_portal_docroot_sync_from_share_gui class (3.24) by @nickanderson in #3031
• ENT-13210: Prevented nfs server inventory from doing unnecessary extra work (3.24) by @nickanderson in #3039
• Inventory unique NFS Servers and recommend consistency in definition (3.24) by @nickanderson in #3042
• CFE-4588: Fixed duplicate bundlesequence_end when bundlesequence_classification not defined (3.24) by @nickanderson in #3045
• Use current process ID to investigate proc filesystem to workaround in-container non-root owned symlinks (3.24) by @craigcomstock in #2998
• Increased timeout for php processing to allow for longer running API requests (3.24) by @craigcomstock in #3052
• Fixed some ArchLinux missing paths (3.24) by @nickanderson in #3055
• Fix package naming for Ubuntu 24 arm64 by @nickanderson in #3057
• lib/services: Fix systemd example/reports (3.24) by @nickanderson in #3060
• ENT-13388: Added 3.24.3 changelog entries by @aleksandrychev in #3064
• Changelog improvements (3.24) by @olehermanse in #3067
• CFE-4602: Added documentation for default:def.control_agent_maxconnections (3.24) by @nickanderson in #3072
• Marked packages acceptance tests as skip needs work for Debian 13 platform (3.24) by @craigcomstock in #3065
• Fixed improper inclusion of community agents in running test that relies on enterprise feature: packages patches data (3.24) by @craigcomstock in #3080
• Fixed cfruncommand for Windows causing "Too many arguments" error (3.24) by @craigcomstock in #3084

3.21.8

Release announcement: https://cfengine.com/blog/2025/cfengine-3-21-8-and-3-24-3-released/

All commits: 3.21.7...3.21.8

Pull requests

• Bumped .CFVERSION number to 3.21.8 by @olehermanse in #3005
• Added exception for Ubuntu-24 to accept our test gpg key which is "weak" (rsa1024) (3.21) by @craigcomstock in #3017
• ENT-13066: Removed edit_defaults attribute that does not have effect with content attribute (3.21) by @nickanderson in #3020
• ENT-12988: Added dmidecode to well known paths for Red Hat (3.21) by @nickanderson in #3022
• ENT-12987: Fixed path to lsof on Red Hat 7 and greater (3.21) by @nickanderson in #3024
• CFE-4573: Added Ubuntu 24.04 and Debian 12 by @nickanderson in #3028
• ENT-13170: Added history for mpf_disable_mission_portal_docroot_sync_from_share_gui class (3.21) by @nickanderson in #3032
• ENT-13210: Prevented nfs server inventory from doing unnecessary extra work (3.21) by @nickanderson in #3040
• Inventory unique NFS servers and recommend consistency in definition (3.21) by @nickanderson in #3043
• CFE-4588: Fixed duplicate bundlesequence_end when bundlesequence_classification not defined (3.21) by @nickanderson in #3046
• Increased timeout for php processing to allow for longer running API requests (3.21) by @craigcomstock in #3053
• Fix package naming for Ubuntu 24 arm64 by @nickanderson in #3058
• lib/services: Fix systemd example/reports (3.21) by @nickanderson in #3062
• ENT-13334: Added 3.21.8 changelog entries by @aleksandrychev in #3063
• CFE-4602: Added documentation for default:def.control_agent_maxconnections (3.21) by @nickanderson in #3073
• Fixed cfruncommand for Windows causing "Too many arguments" error (3.21) by @craigcomstock in #3085

3.26.0

Official announcement: https://cfengine.com/blog/2025/cfengine-3-26-released-admin/

Changelog: https://docs.cfengine.com/docs/3.26/release-notes-whatsnew-changelog-masterfiles-policy-framework.html

Commits: 3.25.0...3.26.0

Pull requests

• ENT-12560: Add paths for the dmsetup, fdisk, and lshw commands by @jimrt in #2980
• Bumped .CFVERSION number to 3.26.0 by @olehermanse in #2983
• CFE-2528: Changed the default for allowallconnects by @olehermanse in #2969
• Fix typo and some formatting issues by @btriller in #2984
• Inhibit management of share config.php file when mpf_disable_mission_portal_docroot_sync_from_share_gui is defined by @craigcomstock in #2987
• ENT-11440: Enable http2 in Mission Portal webserver by @craigcomstock in #2944
• Fixed tiny typo in README: policy /for/ installations by @craigcomstock in #2991
• Added case if http/2(php-fpm binary present) no need for php_version variable for httpd.conf template by @craigcomstock in #2992
• Fix some minor issues by @btriller in #2993
• Use current process ID to investigate proc filesystem to workaround in-container non-root owned symlinks by @craigcomstock in #2990
• Tidied up some not needed steps in tests workflow by @craigcomstock in #2995
• Updated the MPF to use sys.moduledir and sys.keydir if present by @olehermanse in #2997
• Revert "CFE-2528: Changed the default for allowallconnects" by @olehermanse in #2994
• Added changelog for 3.26.0 by @craigcomstock in #3001
• Aligned PHP-FPM config based on system resources by @aleksandrychev in #3004

New Contributors

• @jimrt made their first contribution in #2980

3.24.2

Official announcement: https://cfengine.com/blog/2025/cfengine-3-21-7-and-3-24-2-released/

What's Changed

• ENT-12106: Replaced links to IRC channels with Matrix, help list, and Github discussions (3.24) by @nickanderson in #2967
• Fixed issue with yum package module regarding packages with epoch not validating (3.24) by @craigcomstock in #2971
• ENT-12531: Allowed images from raw.github.com (3.24) by @nickanderson in #2974
• Fixed location of Mission Portal application logs for log_dir cleanup (3.24) by @craigcomstock in #2978
• ENT-12560: Added paths for the dmsetup, fdisk, and lshw commands (3.24) by @nickanderson in #2981
• Fix typo and some formatting issues (3.24) by @nickanderson in #2985
• Tidied up some not needed steps in tests workflow (3.24) by @craigcomstock in #2996
• ENT-12842: Updated CHANGELOG.md for 3.24.2 (3.24.x) by @larsewi in #3000

All comits: 3.24.1...3.24.2

3.21.7

Official announcement: https://cfengine.com/blog/2025/cfengine-3-21-7-and-3-24-2-released/

What's Changed

• ENT-12106: Replaced links to IRC channels with Matrix, help list, and Github discussions (3.21) by @nickanderson in #2968
• Fixed issue with yum package module regarding packages with epoch not validating (3.21) by @craigcomstock in #2972
• ENT-12531: Allowed images from raw.github.com (3.21) by @nickanderson in #2975
• Fixed location of Mission Portal application logs for log_dir cleanup (3.21) by @craigcomstock in #2979
• ENT-12560: Added paths for the dmsetup, fdisk, and lshw commands (3.21) by @nickanderson in #2982
• Fix typo and some formatting issues (3.21) by @nickanderson in #2986
• Added changelog for 3.21.7 by @craigcomstock in #2999

All commits: 3.21.6...3.21.7

3.25.0

Official announcement: https://cfengine.com/blog/2025/cfengine-3-25-released-auditability/

Changelog: https://docs.cfengine.com/docs/3.25/release-notes-whatsnew-changelog-masterfiles-policy-framework.html

Commits: 3.24.0...3.25.0

Pull requests:

• Bumped .CFVERSION number to 3.25.0 (master) by @olehermanse in #2928
• CFE-4426: Added inline docs showing valid values for method (field_operation) in body edit_field quoted_var by @nickanderson in #2931
• ENT-11734: Update branches to test against with new LTS: master, 3.24.x and 3.21.x by @craigcomstock in #2930
• ENT-11472: Added CSP HTTP Header to Mission Portals apache config by @mineralsfree in #2926
• Use --rows-per-insert instead of merge_inserts.awk by @vpodzime in #2936
• Changed Mission Portal's CSP to support data url images by @aleksandrychev in #2938
• Adjusted CSP in httpd.conf to suit ACE javascript editor by @craigcomstock in #2939
• ENT-12116: Added trailing /. to files promises targeting local_software_dir by @nickanderson in #2941
• CFE-4442: Clarified need to specify namespace when defining custom policy update bundle by @nickanderson in #2948
• ENT-4400: Allowed blob image-src in the Mission Portal CSP rules by @aleksandrychev in #2949
• Fixed failed to open /dev/tty errors when using systemd unit management by @craigcomstock in #2956
• Added support for AIX System Resource Controller services promises by @craigcomstock in #2959
• ENT-12151: Added possibility to configure Mission Portal web server ports by @aleksandrychev in #2947
• CFE-4452: Made system_log_level configurable via Augments by @nickanderson in #2964
• CFE-4453: Added missing trailing slash to .no-distrib directory in MPF by @nickanderson in #2965
• ENT-12106: Replaced links to IRC channels with Matrix, help list, and Github discussions by @nickanderson in #2966
• Fixed issue with yum package module regarding packages with epoch not validating by @craigcomstock in #2970
• ENT-12531: Allowed images from raw.github.com by @nickanderson in #2973
• Added changelog for 3.25.0 by @craigcomstock in #2976
• Fixed location of Mission Portal application logs for log_dir cleanup by @craigcomstock in #2977

3.24.1

Release announcement: https://cfengine.com/blog/2024/cfengine-3-21-6-and-3-24-1-released/

Official changelogs: https://docs.cfengine.com/docs/3.21/release-notes-whatsnew-changelog-masterfiles-policy-framework.html

Pull requests

• Bumped .CFVERSION number to 3.25.0 (master) by @olehermanse in #2928
• Bumped .CFVERSION number to 3.24.1 (3.24) by @olehermanse in #2929
• CFE-4426: Added inline docs showing valid values for method (field_operation) in body edit_field quoted_var (3.24) by @nickanderson in #2932
• [3.24.x] Use --rows-per-insert instead of merge_inserts.awk by @vpodzime in #2937
• Update branches to test against with new LTS: master, 3.24.x and 3.21.x (3.24) by @craigcomstock in #2940
• ENT-11472: Added CSP HTTP Header to MP apache config (3.24) by @mineralsfree in #2934
• ENT-12116: Added trailing /. to files promises targeting local_software_dir (3.24) by @nickanderson in #2942
• Changed Mission Portal's CSP to support data url images (3.24.x) by @aleksandrychev in #2945
• CFE-4442: Clarified need for namespace to be specified when definging a custom policy update bundle (3.24) by @nickanderson in #2950
• ENT-4400: Allowed blob image-src in the Mission Portal CSP rules (3.24.x) by @aleksandrychev in #2952
• Adjusted CSP in httpd.conf to suit ACE javascript editor (3.24.x) by @craigcomstock in #2954
• Fixed failed to open /dev/tty errors when using systemd unit management (3.24) by @craigcomstock in #2957
• Added support for AIX System Resource Controller services promises (3.24) by @craigcomstock in #2960
• Added changelog for 3.24.1 by @craigcomstock in #2962

All commits: 3.24.0...3.24.1