Puppet Core 8.22.0 and 9.1.0 Are Now Available

[Puppet Product Updates]

Puppet Core 8.22.0 and 9.1.0 are released, with matching security fixes and reliability improvements across both version tracks.

What's changing and why it matters

Both releases ship the same set of changes, applied separately to the 8.x and 9.x tracks:

• New platform support: Puppet agent now supports Debian 12 ARM V7L — useful if you're deploying to 32-bit ARM hardware.
• Security updates: OpenSSL, curl, libxml2, RubyGems, and the Ruby resolv gem are patched against recently disclosed CVEs — over a dozen in total. If you're running a supported version, upgrading closes that exposure.
• hiera-eyaml fix: Encrypted Hiera values now decrypt correctly when Puppet Server uses Bouncy Castle 1.85+, resolving a real decrypt failure some users were hitting.
• JSON dependency fix: Puppet's JSON dependency is now constrained (>= 2.0, < 4), preventing version conflicts that could break Puppet runs in Bundler-managed environments.
• PuppetDB: New builds (8.10.12 / 9.0.8) shipped alongside these releases to support the release process. No customer-facing changes.

What to do next

1.   Review the full release notes for your track before upgrading:

• Puppet Core 8.22.0 release notes
• Puppet Core 9.1.0 release notes

2.   Check the security advisories if you need CVE-level detail for your own vulnerability tracking.

3.   Plan your upgrade window — no breaking changes are introduced in either release, so this should be a standard patch upgrade.

4.   Upgrade your agents and servers to the version matching your current track.

 

The Puppet Team

This e-mail may contain information that is privileged or confidential. If you are not the intended recipient, please delete the e-mail and any attachments and notify us immediately.