Puppet Enterprise 2026.0, 2025.12.0, and 2023.8.12 Are Here

Gavin Patton — Mon, 19 Oct 2026 13:53:40 +0000

Puppet Enterprise (PE) 2026.0, 2025.12.0, and 2023.8.12 are now available.

PE 2026.0 highlights include: Puppet Core 9, new operating system support, patch management updates, security updates, and more.
PE 2025.12.0 moves to our latest-1 release, including critical security and bug fixes.
PE 2023.8.12 is now in extended support, which ends February 27, 2027. This release includes critical security and bug fixes.

What's New in Puppet Enterprise 2026.0

Built on Puppet Core 9

PE 2026.0 is the first Puppet Enterprise release built on Puppet Core 9. Puppet Core 9 updates key runtime and security foundations, including Ruby 4.0 and OpenSSL 3.5, and adds hardening for certificates, authentication, and server endpoints. Because you inherit these changes when you upgrade, we recommend testing your custom code and modules before rolling out.

Helpful resources:

Puppet Core 9 release notes
Puppet Core 9 upgrade documentation
Puppet Core platform support lifecycle
Validate your modules for Puppet Core 9 compatibility with Puppet Development Kit (PDK) 4.0

Patch Management Reporting

Patching tasks now report failures that occur while packages are being installed, instead of showing an overall success. Advanced Patching flags failed Windows patch runs as failures in the patch runs report, so your reports reflect what really happened.

Reliable CA Storage Migration and Recovery

PE 2026.0 uses database-backed CA storage by default. To make moving existing CA storage to the database, and recovering afterward, more dependable, this release includes several fixes:

Puppet runs no longer fail after cleanup
Missing on-disk CA files are handled
Mismatched backup restores are rejected up front
Fresh installs and imports are more reliable
Recovery no longer writes other nodes' settings into the primary

Security Refresh

PE 2026.0 includes many security updates, covering the Git tooling used by r10k, the nginx and Jetty web servers, FIPS cryptography, logging, and the toolchain used to build PE client tools. See Security Updates below, and Platform Support Updates for operating system changes.

What's Included in PE 2025.12.0 and PE 2023.8.12

PE 2025.12.0

This release moves PE 2025 into the latest-1 release. Highlights for the PE 2025 release include:

More reliable CA storage: Puppet runs no longer fail after a CA database-storage migration, and intentionally absent local CA files are handled correctly.
Security updates: See Security Updates below.

PE 2023.8.12 (LTS maintenance and security release)

This release includes security and bug fixes, including updated FIPS cryptography components, the Git tooling used by r10k, and related components. It does not add new features or change platform support.

Important for LTS customers: PE 2023.8.12 does not include the logging library (logback-core) fixes delivered in PE 2026.0 and 2025.12.0, which address CVE-2026-9828, CVE-2026-10532, and CVE-2026-13006. The 2023.8 line uses an older logging library branch that no longer receives upstream updates, so these fixes cannot be applied to it. Support for PE 2023.8.x ends February 27, 2027.

Platform Support Updates

Agent platform additions: AlmaLinux 10, Rocky Linux 10, Ubuntu 26.04 (AMD), and Ubuntu 26.04 (ARM)
Primary server platform additions: Ubuntu 26.04
Platform removals: Ubuntu 20.04 amd64 is removed for the primary server, and several older agent platforms are removed.
Manual installation: Debian 12 armhf requires manual installation.

Security Updates

All three releases include dependency updates that reduce your security exposure.

Release	Security updates
PE 2026.0	The broadest refresh: Git tooling used by r10k, nginx, Jetty, logging, FIPS cryptography, the toolchain used to build PE client tools, and many other components, including fixes for critical-severity vulnerabilities. Default PE deployments were assessed as not exploitable for the nginx vulnerabilities addressed.
PE 2025.12.0	Carries forward many of the same updates, including the Git tooling, nginx, Jetty, and client tools toolchain, plus additional dependency updates.
PE 2023.8.12	Updates the FIPS cryptography components (resolving ten vulnerabilities), the Git tooling used by r10k, and related components. Does not include the logging library fixes (see the note for LTS customers above).

For complete details, specific CVE identifiers, and component versions, see the release notes:

If you have questions about upgrading, contact Puppet Support or your account team.

Thank you for being a Puppet Enterprise customer.

The Puppet Enterprise Team

Strengthening Open Source Facter: Ensuring Compatibility and Essential Maintenance

Gavin Patton — Tue, 02 Dec 2025 15:33:32 +0000

Over the course of 2025, the Puppet Core team has been committed to developing secure, hardened Puppet code that our customers can rely on. As part of that shift, many Puppet platform components, including Facter, were brought under the Puppet Core model and were moved into private repositories.

While this helps us deliver reliable, secure hardened binaries for our Puppet Core customers, it also means that Open Source Facter received fewer essential updates that it needed to stay compatible with other Puppet components.

Here at Perforce Puppet, we are committed to our open source community, which is why when we received feedback around compatibility concerns of Open Source Facter, we listened: Facter needs active care to ensure interoperability between Open Source and Puppet Core versions.

What's Changed

We have committed to maintaining the interoperability of Open Source Facter with Puppet Core Facter by:

Backporting essential maintenance updates (e.g. critical bug fixes, dependency updates, etc) from Puppet Core Facter into Open Source Facter.
Ensuring ongoing compatibility with Puppet Core Facter by mirroring any Fact additions, updates or removals in Open Source Facter.

This effort has not added new features or security fixes from Puppet Core Facter into open-source Facter but has ensured that the Open Source project remains compatible and usable in your Puppet workflows.

You can review the updates we’ve brought over in the Open Source Facter GitHub repository.

Why We're Doing This

Facter is at the heart of Puppet. It provides the system facts which drive how configurations are applied. Even small compatibility gaps between Open Source and Puppet Core Facter can have a large impact downstream. By committing to Open Source Facter’s compatibility, we’re making sure the entire Puppet community can rely on a maintained, stable version of Facter.

Where You Can Fit In

Community input and feedback is essential to ensuring that the Puppet code we all use and depend on is robust and reliable. We want to keep that collaboration going. You can help by:

Filing issues: If you find any bugs, please file an issue in the Facter Github repo.
Contributing fixes: Pull requests are welcome! You can suggest features, essential updates and bug fixes in the Facter Github repo.
Staying engaged: Join the conversation in the Puppet Community Slack.

We want to thank everyone who raised concerns and helped us shape this path forward. Your feedback ensures Puppet stays stronger together.

DEV Community: Gavin Patton