These release notes are for an old release of Salt. This release might contain known security and other issues that are fixed in the latest release.

(release-3006.5)=

# Salt 3006.5 release notes

## Changelog

### Removed

- Tech Debt - support for pysss removed due to functionality addition in Python 3.3 #65029

### Fixed

- Improved error message when state arguments are accidentally passed as a string #38098

- Allow `pip.install` to create a log file that is passed in if the parent directory is writeable #44722

- Fixed merging of complex pillar overrides with salt-ssh states #59802

- Fixed gpg pillar rendering with salt-ssh #60002

- Made salt-ssh states not re-render pillars unnecessarily #62230

- Made Salt maintain options in Debian package repo definitions #64130

- Migrated all `invoke` tasks to `python-tools-scripts`.

  - `tasks/docs.py` -> `tools/precommit/docs.py`

  - `tasks/docstrings.py` -> `tools/precommit/docstrings.py`

  - `tasks/loader.py` -> `tools/precommit/loader.py`

  - `tasks/filemap.py` -> `tools/precommit/filemap.py` #64374

- Fix salt user login shell path in Debian packages #64377

- Fill out lsb_distrib_xxxx (best estimate) grains if problems with retrieving lsb_release data #64473

- Fixed an issue in the `file.directory` state where the `children_only` keyword argument was not being respected. #64497

- Move salt.ufw to correct location /etc/ufw/applications.d/ #64572

- Fixed salt-ssh stacktrace when retcode is not an integer #64575

- Fixed SSH shell seldomly fails to report any exit code #64588

- Fixed some issues in x509_v2 execution module private key functions #64597

- Fixed grp.getgrall() in utils/user.py causing performance issues #64888

- Fix user.list_groups omits remote groups via sssd, etc. #64953

- Ensure sync from _grains occurs before attempting pillar compilation in case custom grain used in pillar file #65027

- Moved gitfs locks to salt working dir to avoid lock wipes #65086

- Only attempt to create a keys directory when `--gen-keys` is passed to the `salt-key` CLI #65093

- Fix nonce verification, request server replies do not stomp on eachother. #65114

- speed up yumpkg list_pkgs by not requiring digest or signature verification on lookup. #65152

- Fix pkg.latest failing on windows for winrepo packages where the package is already up to date #65165

- Ensure kwarg is preserved when checking for kwargs. This change affects proxy minions when used with Deltaproxy, which had kwargs popped when targeting multiple minions id. #65179

- Fixes traceback when state id is an int in a reactor SLS file. #65210

- Install logrotate config as /etc/logrotate.d/salt-common for Debian packages Remove broken /etc/logrotate.d/salt directory from 3006.3 if it exists. #65231

- Use `sha256` as the default `hash_type`. It has been the default since Salt v2016.9 #65287

- Preserve ownership on log rotation #65288

- Ensure that the correct value of jid_inclue is passed if the argument is included in the passed keyword arguments. #65302

- Uprade relenv to 0.14.2

  - Update openssl to address CVE-2023-5363.

  - Fix bug in openssl setup when openssl binary can't be found.

  - Add M1 mac support. #65316

- Fix regex for filespec adding/deleting fcontext policy in selinux #65340

- Ensure CLI options take priority over Saltfile options #65358

- Test mode for state function `saltmod.wheel` no longer set's `result` to `(None,)` #65372

- Client only process events which tag conforms to an event return. #65400

- Fixes an issue setting user or machine policy on Windows when the Group Policy directory is missing #65411

- Fix regression in file module which was not re-using a file client. #65450

- pip.installed state will now properly fail when a specified user does not exists #65458

- Publish channel connect callback method properly closes it's request channel. #65464

- Ensured the pillar in SSH wrapper modules is the same as the one used in template rendering when overrides are passed #65483

- Fix file.comment ignore_missing not working with multiline char #65501

- Warn when an un-closed transport client is being garbage collected. #65554

- Only generate the HMAC's for `libssl.so.1.1` and `libcrypto.so.1.1` if those files exist. #65581

- Fixed an issue where Salt Cloud would fail if it could not delete lingering PAexec binaries #65584

### Added

- Added Salt support for Debian 12 #64223

- Added Salt support for Amazon Linux 2023 #64455

### Security

- Bump to `cryptography==41.0.4` due to https://github.com/advisories/GHSA-v8gr-m533-ghj9 #65268

- Bump to `cryptography==41.0.7` due to https://github.com/advisories/GHSA-jfhm-5ghh-2f97 #65643