Salt 3006.12 and 3007.4 now available

[Shane Lee]

Salt Project has recently released 3006.12 LTS and 3007.4 STS

These releases include multiple CVE fixes. See the blog post for details:

https://saltproject.io/security-announcements/2025-06-12-advisory-3006-12-3007-4/

Thank you all for your contributions

[Sid Young]

I'm encountering errors on 2006.12 on new installs, the minion send a key but once connected generates "Tornado" errors and won't do anything when issued with commands.... had to remove and go back to 3006.10 (RHEL 8.10 platform, minimal OS install, no customisations applied).

Sid

[Sid Young]

Installed 3006.13 and encountered same error as 3006.12 

KeyError: 'Session' - Issue raised in case you also get it.

Sid

--
You received this message because you are subscribed to a topic in the Google Groups "Salt-users" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/salt-users/fsB0GieLxUQ/unsubscribe.
To unsubscribe from this group and all its topics, send an email to salt-users+...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/salt-users/424924d1-3244-4605-8604-9ba0c451774fn%40googlegroups.com.

[Jakub “mick3y” Mikusek]

Just for the record - same issue happens in 3007.5 - we went back to 3007.2 for that reason.
Issues appear on both - master and minion.

> You received this message because you are subscribed to the Google Groups "Salt-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to salt-users+...@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/salt-users/CAEZ%2BgOzT747pV-dACYqxBcxYh_x7vABQ7VUCzp3H5BpG%3D4x2HQ%40mail.gmail.com.

[Phipps, Thomas]

you are upgrading the master first correct? 

--

You received this message because you are subscribed to the Google Groups "Salt-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to salt-users+...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/salt-users/424924d1-3244-4605-8604-9ba0c451774fn%40googlegroups.com.

[Sid Young]

Master is already 3007.1 but I will bring it up to 3007.5 this week and then try a minion up to 3006.13 

Currently all minions are on 3006.10 which appears to be very stable.

Sid

You received this message because you are subscribed to a topic in the Google Groups "Salt-users" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/salt-users/fsB0GieLxUQ/unsubscribe.
To unsubscribe from this group and all its topics, send an email to salt-users+...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/salt-users/CAPaX09jpY06wZ6OS35V1BDkHhoZgM-dvSYsJWFt43Xqv0yZbvg%40mail.gmail.com.

[Phipps, Thomas]

so.... when they say upgrade master first. they mean within the patch set. a 3006.13 minion can't talk to a 3007.1 master. the 3007.1 master does not have the security changes that the 3006.13 minion is expecting. 

it is more about release history than the true version numbers when "newer master" is mentioned. 

To view this discussion visit https://groups.google.com/d/msgid/salt-users/CAEZ%2BgOxwf6k%3D2FCZ8yTodtcuy0DSA45AsoxPntrhp7-deaQO%2BQ%40mail.gmail.com.

[Jeremiah Garmatter]

I experienced the same issue.

How can we view this "patch set" to make sure we upgrade to compatible versions?

[Phipps, Thomas]

pay attention to the releases listed here. 3007.4 was released alongside 3006.12, that normally means they have some changes that are most likely going to break something. honestly you should run masters and minions on the same version. and upgrading the master first. It avoids this a lot easier. I mean why run the LTS release if you are running a STS master? you have no idea what could be happening behind the scenes that makes the LTS break from the masters perspective. 

To view this discussion visit https://groups.google.com/d/msgid/salt-users/c8c99626-0e00-4b6e-b107-3da02adfcc1en%40googlegroups.com.

[Jeremiah Garmatter]

I'm not sure if this will help anyone but it helped clear up confusion for me.

/etc/yum.repos.d/salt.repo had the [salt-repo-3007-sts] enabled=0 and [salt-repo-3006-lts] enabled=1, but my salt-master (and a majority of my minions) have 3007.1 installed.

So at some point the salt 3007 STS repo was enabled but it is not anymore. I do not manage repos that closely so I know I didn't make this change.

Essentially my machines that were on 3007.1 were locked on that version because I couldn't download 3007.4 with the repo disabled.

The machines that didn't have 3007.1 installed were still on 3006.x so they upgraded to 3006.12. The "newer release" of 3006 is not compatible with the "older release" of 3007 so communication broke down between the master and minions.

Now I must either shift the machines with issues onto the 3007 STS branch or rollback the majority to the 3006 LTS branch. Lucky for me it looks like salt-master 3007.5 is capable of communicating with every minion, so I can use salt to correct the salt version and repo mismatch.

[Sid Young]

Just noted that 3007.6 and 3006.14 are out - I updated all my VM's to 3006.13 and the master is currently 3007.5 and this appears stable. I also noted that prior to 3007.5, the .4 version had an odd bug when the salt-minion process was restarted. So if you are on .4I would think going to .5 would be a wise step.

Rather than use a repo, I maintain the RPM files for each release locally on an NGINX server and then have a Salt State to push the required RPM's to root's home directory (wget from minion) and deploy them using DNF, I've found with the repo and install process changing four times over the last 10 years, I get better control if I just deploy RPM's locally.

I've not tested 3007.6 with 3006.14, I will be leaving our 120+ VM's on (Master-=3007.5) and 3006.13 on all the Minion for at least another 3 months and then look at where the releases are at.

Sid

Keep an eye out for my new book "Super Simple Saltstack" - coming soon :)

[Ken Jordan]

Just to add a bit more color to Thomas's note about the "patch set", he's referring to the STS vs LTS releases. 3006.x is the current LTS release of Salt while 3007 is the STS release. See https://docs.saltproject.io/salt/install-guide/en/latest/topics/salt-version-support-lifecycle.html#salt-version-support-lifecycle for more info.