July 2026 - Release-announce - lists.openstack.org

python-magnumclient 4.11.0 (hibiscus)
by no-reply＠openstack.org 03 Jul '26

03 Jul '26

We are jazzed to announce the release of: python-magnumclient 4.11.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/python-magnumclient Download the package from: https://pypi.org/project/python-magnumclient Please report issues through: https://bugs.launchpad.net/python-magnumclient/+bugs For more details, please see below. Changes in python-magnumclient 4.10.0..4.11.0 --------------------------------------------- 0cee961 Add --hidden/--visible flags to cluster template update command b80aea1 Fix tox releasenotes job 1d0385e Add requests-mock to test-requirements.txt e52fee3 Update master for stable/2026.1 Diffstat (except docs and test files) ------------------------------------- magnumclient/osc/v1/cluster_templates.py | 30 ++++++++++-- releasenotes/source/2026.1.rst | 6 +++ releasenotes/source/index.rst | 1 + test-requirements.txt | 1 + tox.ini | 1 + 6 files changed, 89 insertions(+), 3 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index a15caac..b5d097f 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -7,0 +8 @@ osprofiler>=1.4.0 # Apache-2.0 +requests-mock>=1.2.0 # Apache-2.0

1 0

stevedore 5.9.0 (hibiscus)
by no-reply＠openstack.org 02 Jul '26

02 Jul '26

We are happy to announce the release of: stevedore 5.9.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/stevedore Download the package from: https://pypi.org/project/stevedore Please report issues through: https://bugs.launchpad.net/stevedore/+bugs For more details, please see below. 5.9.0 ^^^^^ Upgrade Notes * Support for Python 3.10 has been removed. Now the minimum python version supported is 3.11. Changes in stevedore 5.8.0..5.9.0 --------------------------------- 8550c66 zuul: Use openstack-python3-next-jobs template f3e8756 pre-commit: Bump versions cee643a Do not install code to build release notes 509f705 Drop support for Python 3.10 Diffstat (except docs and test files) ------------------------------------- .pre-commit-config.yaml | 4 ++-- .zuul.yaml | 3 +++ pyproject.toml | 6 +++--- .../notes/drop-python-310-a175ee1330887985.yaml | 5 +++++ stevedore/driver.py | 10 ++------- stevedore/extension.py | 24 ++++++++++------------ stevedore/named.py | 13 +++--------- tox.ini | 9 ++++++-- 8 files changed, 36 insertions(+), 38 deletions(-)

1 0

heat-translator 3.5.0 (hibiscus)
by no-reply＠openstack.org 02 Jul '26

02 Jul '26

We are excited to announce the release of: heat-translator 3.5.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/heat-translator Download the package from: https://pypi.org/project/heat-translator Please report issues through: https://bugs.launchpad.net/heat-translator/+bugs For more details, please see below. 3.5.0 ^^^^^ Upgrade Notes * Support for Python 3.8 and 3.9 has been dropped. Changes in heat-translator 3.4.0..3.5.0 --------------------------------------- 8a1035b tox: Drop basepython 0760eac Drop support for Python 3.8 and 3.9 Diffstat (except docs and test files) ------------------------------------- releasenotes/notes/drop-python-38-and-39.yaml | 4 ++++ setup.cfg | 14 +++++++------- tox.ini | 2 -- 3 files changed, 11 insertions(+), 9 deletions(-)

1 0

keystone 29.0.2 (gazpacho)
by no-reply＠openstack.org 02 Jul '26

02 Jul '26

We are satisfied to announce the release of: keystone 29.0.2 This release is part of the gazpacho release series. The source is available from: https://opendev.org/openstack/keystone Download the package from: https://tarballs.openstack.org/keystone/ Please report issues through: https://bugs.launchpad.net/keystone/+bugs For more details, please see below. 29.0.2 ^^^^^^ Upgrade Notes ************* * [bug 2148398 (https://bugs.launchpad.net/keystone/+bug/2148398) The "identity:create_trust" policy rule now uses "%(target.trust.trustor_user_id)s" instead of "%(trust.trustor_user_id)s". The trust data from the request body is now passed explicitly via "target_attr" rather than relying on the JSON body merge. This aligns "create_trust" with all other trust policy rules which already use the "target.trust.*" prefix. Deployments that override the "identity:create_trust" policy and reference "%(trust.trustor_user_id)s" must update to "%(target.trust.trustor_user_id)s". * [bug 2150089 (https://launchpad.net/bugs/2150089) Two new "[security_compliance]" options control opt-in insecure behaviour for operators with workflows that break after this upgrade: "allow_insecure_admin_trust_cross_project_credentials_access" (default "False"): set to "True" if admin-role trusts or application credentials need to access credentials across multiple projects (e.g. Mistral cron triggers syncing EC2 credentials system-wide). "allow_insecure_application_credential_trust_escalation" (default "False"): set to "True" if application credentials must create or manage trusts (e.g. Heat stacks authenticated via application credentials). Use OIDC federation flows ("v3oidcclientcredentials", "v3oidcdeviceauthz") as the proper long-term alternative. Both options are intentionally named to signal that enabling them is insecure. Migrate affected workflows away from these options. Critical Issues *************** * [bug 2148398 (https://bugs.launchpad.net/keystone/+bug/2148398) The RBAC enforcer unconditionally merged the raw JSON request body into the policy enforcement dictionary after trusted target data had been set from the database. An attacker could include a "target" key in the JSON body to overwrite database-sourced RBAC target attributes, causing all "%(target.*)s" policy substitutions to evaluate against attacker-controlled values. This affected 88 endpoint/method combinations across all Keystone API resource areas. Any authenticated user could exploit this to read every credential secret in the deployment, create EC2 credentials for arbitrary users, or revoke other users' tokens. A domain administrator could escalate to full cloud admin by creating inherited role grants on other domains. The vulnerability has been present since the Rocky release (14.0.0). Security Issues *************** * [bug 2148398 (https://bugs.launchpad.net/keystone/+bug/2148398) The RBAC policy enforcer now namespaces JSON request body data under a "request_body" key in the policy dictionary instead of merging it at the top level. This prevents user-controlled input from overwriting security-critical keys such as "target" (populated from the database by "build_target" or "target_attr") and URL path parameters like "user_id". All upstream policy rules are unaffected by this change. Deployments with custom policy rules that reference JSON body fields directly via "%(field_name)s" substitutions (not under "target.") will need to update those references to "%(request_body.field_name)s". * [bug 2150089 (https://launchpad.net/bugs/2150089) Delegated tokens (trusts, application credentials, OAuth1 access tokens) are now restricted to credentials whose "project_id" matches the token's project scope. This closes a cross-project lateral movement vector where a delegated token could read, modify, or delete credentials belonging to a different project, including EC2 keys and TOTP/MFA seed bindings. Application credential tokens are now blocked from all trust operations (create, delete, list, get). Allowing an application credential to bootstrap a trust creates a new delegation context whose token can access authentication material outside the delegation chain, breaking the audit trail. The "unrestricted" flag governs credential management, not trust management. Changes in keystone 29.0.1..29.0.2 ---------------------------------- fff1fa516 Add audience mapper to devstack Keycloak client e3fe5cb3e Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999) 4381601f2 Preserve expires_at when rescoping federated tokens (CVE-2026-44394) c2126b0a9 Forbid trust operations using application credentials (CVE-2026-43000) 8c0e2c7a0 Fix user impersonation through application credentials (CVE-2026-42998) 96fae0391 Enforce delegation project boundary for delegated tokens 635914a6a Block app cred tokens from authorizing OAuth1 requests 60770681b Enforce app cred project boundary on EC2 credential paths 60fdde686 Include system scope in rescope guard 88b5d9020 Block app credential token rescoping 4ec1f8a01 Block restricted app creds from creating EC2 credentials via /credentials 8e1cba068 Add tests for restricted app cred guard Diffstat (except docs and test files) ------------------------------------- devstack/tools/oidc/setup_keycloak_client.py | 54 +- keystone/api/_shared/EC2_S3_Resource.py | 14 + keystone/api/credentials.py | 79 ++- keystone/api/os_oauth1.py | 11 + keystone/api/trusts.py | 46 +- keystone/api/users.py | 126 ++++- keystone/auth/plugins/core.py | 7 +- keystone/auth/plugins/mapped.py | 4 + keystone/auth/plugins/token.py | 15 +- keystone/common/policies/base.py | 2 +- keystone/common/rbac_enforcer/enforcer.py | 21 +- keystone/conf/security_compliance.py | 67 +++ .../notes/bug-2148398-e35dd449b3a330e6.yaml | 40 ++ .../notes/bug-2150089-e91b592c948e5771.yaml | 35 ++ 24 files changed, 2075 insertions(+), 60 deletions(-)

1 0

sushy 5.11.1 (hibiscus)
by no-reply＠openstack.org 02 Jul '26

02 Jul '26

We are chuffed to announce the release of: sushy 5.11.1 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/sushy Download the package from: https://tarballs.openstack.org/sushy/ Please report issues through: https://bugs.launchpad.net/sushy/+bugs For more details, please see below. 5.11.1 ^^^^^^ Bug Fixes * The Dell OEM manager extension no longer shells out to the external "ping" binary when waiting for the iDRAC to reboot during "reset_idrac". Reachability is now determined over HTTP(S) using the existing Redfish connection. This removes the dependency on a "ping" executable being present (e.g. in container images) and on ICMP traffic being permitted, and avoids an uncaught "FileNotFoundError" when the binary is missing. See bug 2151783 for details. * Fixes a "TypeError" raised by "Storage.drives_sizes_bytes" when one or more drives report a null "CapacityBytes" in the Redfish API response (e.g. empty drive bays). The property now filters out drives with no reported capacity before sorting, consistent with the existing behaviour of "SimpleStorageCollection.disks_sizes_bytes". See LP#2150858 (https://bugs.launchpad.net/sushy/+bug/2150858) Changes in sushy 5.11.0..5.11.1 ------------------------------- 142fe1c HTTP instead of ping to detect iDRAC reboot state 1621320 filter out drives reporting null size on inspect Diffstat (except docs and test files) ------------------------------------- ...c-reset-http-reachability-0998606718098c21.yaml | 11 +++ .../redfish-inspect-error-e7c0e4da33c02392.yaml | 9 ++ sushy/oem/dell/resources/manager/manager.py | 97 +++++++++++++--------- sushy/resources/system/storage/storage.py | 3 +- .../dell/unit/resources/manager/test_manager.py | 53 +++++++----- 5 files changed, 114 insertions(+), 59 deletions(-)

1 0

python-ironicclient 6.2.0 (hibiscus)
by no-reply＠openstack.org 02 Jul '26

02 Jul '26

We are tickled pink to announce the release of: python-ironicclient 6.2.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/python-ironicclient Download the package from: https://pypi.org/project/python-ironicclient Please report issues through: https://bugs.launchpad.net/python-ironicclient/+bugs For more details, please see below. 6.2.0 ^^^^^ Bug Fixes ********* * Fixes a race condition where running multiple Bare Metal CLI commands concurrently could fail with "[Errno 11] Resource temporarily unavailable" while accessing the cached API version. The on-disk version cache is now best-effort: if it cannot be read or written, the client silently re-negotiates the API version instead of raising an error. Other Notes *********** * Removed classes and helper functions from the apiclient module, which was never a supported API of the ironicclient library but was likely developed to mirror the API surface of some OSLO libraries. Changes in python-ironicclient 6.1.0..6.2.0 ------------------------------------------- 131db9b Treat the API version cache as best-effort cca77c8 Bump openstacksdk lower bound 690424b clean up pyproject.toml deprecated and missing entries 2e87d3b Stop ignoring override in tests 00189fc Stop ignoring list-item in tests 9e6234e Stop ignoring func-returns-value in tests 37b40d1 Stop ignoring dict-item in tests 4c6c397 Stop ignoring index in tests e2b812f remove pbr as runtime dependency 02eec7d Remove dead code in apiclient module 62bdc8c fix incorrect annotation for list_ports method e5f25fd trivial: fix author in latex doc output f7592d7 remove separate codespell job 5896401 switch to using pre-commit for lint checks f14672f remove unused script which does not pep8 bed6cae fix codespell config 6f43de9 simplify is not None check a55d723 switch to new tox constraints syntax 0e5fc9c Stop ignoring `assignment` in tests fae5aac create more specific update method for typing Diffstat (except docs and test files) ------------------------------------- .pre-commit-config.yaml | 61 +++ ironicclient/__init__.py | 5 +- ironicclient/common/apiclient/base.py | 460 +-------------------- ironicclient/common/base.py | 24 ++ ironicclient/common/filecache.py | 19 +- ironicclient/osc/v1/baremetal_chassis.py | 2 +- ironicclient/osc/v1/baremetal_node.py | 2 +- ironicclient/shell.py | 4 +- ironicclient/v1/allocation.py | 2 +- ironicclient/v1/chassis.py | 2 +- ironicclient/v1/deploy_template.py | 2 +- ironicclient/v1/driver.py | 2 +- ironicclient/v1/inspection_rule.py | 2 +- ironicclient/v1/node.py | 7 +- ironicclient/v1/port.py | 2 +- ironicclient/v1/portgroup.py | 2 +- ironicclient/v1/runbook.py | 2 +- ironicclient/v1/volume_connector.py | 2 +- ironicclient/v1/volume_target.py | 2 +- pyproject.toml | 18 +- ...-concurrent-version-cache-22be52e06671451a.yaml | 8 + ...emove-dead-code-apiclient-eb205f724dd45721.yaml | 6 + requirements.txt | 2 +- tools/install_venv_common.py | 200 --------- tox.ini | 31 +- zuul.d/ironicclient-jobs.yaml | 7 - zuul.d/project.yaml | 2 - 47 files changed, 258 insertions(+), 930 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 14ef5b9..d489e0b 100644 --- a/requirements.txt +++ b/requirements.txt @@ -11 +11 @@ keystoneauth1>=3.11.0 # Apache-2.0 -openstacksdk>=0.18.0 # Apache-2.0 +openstacksdk>=4.10.0 # Apache-2.0

1 0

keystone 28.0.2 (flamingo)
by no-reply＠openstack.org 02 Jul '26

02 Jul '26

We contentedly announce the release of: keystone 28.0.2 This release is part of the flamingo release series. The source is available from: https://opendev.org/openstack/keystone Download the package from: https://tarballs.openstack.org/keystone/ Please report issues through: https://bugs.launchpad.net/keystone/+bugs For more details, please see below. 28.0.2 ^^^^^^ Upgrade Notes ************* * [bug 2148398 (https://bugs.launchpad.net/keystone/+bug/2148398) The "identity:create_trust" policy rule now uses "%(target.trust.trustor_user_id)s" instead of "%(trust.trustor_user_id)s". The trust data from the request body is now passed explicitly via "target_attr" rather than relying on the JSON body merge. This aligns "create_trust" with all other trust policy rules which already use the "target.trust.*" prefix. Deployments that override the "identity:create_trust" policy and reference "%(trust.trustor_user_id)s" must update to "%(target.trust.trustor_user_id)s". * [bug 2150089 (https://launchpad.net/bugs/2150089) Two new "[security_compliance]" options control opt-in insecure behaviour for operators with workflows that break after this upgrade: "allow_insecure_admin_trust_cross_project_credentials_access" (default "False"): set to "True" if admin-role trusts or application credentials need to access credentials across multiple projects (e.g. Mistral cron triggers syncing EC2 credentials system-wide). "allow_insecure_application_credential_trust_escalation" (default "False"): set to "True" if application credentials must create or manage trusts (e.g. Heat stacks authenticated via application credentials). Use OIDC federation flows ("v3oidcclientcredentials", "v3oidcdeviceauthz") as the proper long-term alternative. Both options are intentionally named to signal that enabling them is insecure. Migrate affected workflows away from these options. Critical Issues *************** * [bug 2148398 (https://bugs.launchpad.net/keystone/+bug/2148398) The RBAC enforcer unconditionally merged the raw JSON request body into the policy enforcement dictionary after trusted target data had been set from the database. An attacker could include a "target" key in the JSON body to overwrite database-sourced RBAC target attributes, causing all "%(target.*)s" policy substitutions to evaluate against attacker-controlled values. This affected 88 endpoint/method combinations across all Keystone API resource areas. Any authenticated user could exploit this to read every credential secret in the deployment, create EC2 credentials for arbitrary users, or revoke other users' tokens. A domain administrator could escalate to full cloud admin by creating inherited role grants on other domains. The vulnerability has been present since the Rocky release (14.0.0). Security Issues *************** * [bug 2148398 (https://bugs.launchpad.net/keystone/+bug/2148398) The RBAC policy enforcer now namespaces JSON request body data under a "request_body" key in the policy dictionary instead of merging it at the top level. This prevents user-controlled input from overwriting security-critical keys such as "target" (populated from the database by "build_target" or "target_attr") and URL path parameters like "user_id". All upstream policy rules are unaffected by this change. Deployments with custom policy rules that reference JSON body fields directly via "%(field_name)s" substitutions (not under "target.") will need to update those references to "%(request_body.field_name)s". * [bug 2150089 (https://launchpad.net/bugs/2150089) Delegated tokens (trusts, application credentials, OAuth1 access tokens) are now restricted to credentials whose "project_id" matches the token's project scope. This closes a cross-project lateral movement vector where a delegated token could read, modify, or delete credentials belonging to a different project, including EC2 keys and TOTP/MFA seed bindings. Application credential tokens are now blocked from all trust operations (create, delete, list, get). Allowing an application credential to bootstrap a trust creates a new delegation context whose token can access authentication material outside the delegation chain, breaking the audit trail. The "unrestricted" flag governs credential management, not trust management. Changes in keystone 28.0.1..28.0.2 ---------------------------------- 98b2c8dea Fix stable/2025.2 CI: nodeset, test skip, Keycloak audience mapper 96466c221 Fix project policy allowing unauthorized access to root domains a1854ec56 Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999) 98359b2bb Preserve expires_at when rescoping federated tokens (CVE-2026-44394) 68f480777 Forbid trust operations using application credentials (CVE-2026-43000) 8e1ec7d6a Fix user impersonation through application credentials (CVE-2026-42998) fda177eb5 Enforce delegation project boundary for delegated tokens 549a70428 Include system scope in rescope guard 50436db57 Block app credential token rescoping d9e18a378 Enforce app cred project boundary on EC2 credential paths 3f87f9149 Block app cred tokens from authorizing OAuth1 requests 5dedd4d8a Block restricted app creds from creating EC2 credentials via /credentials ad8b17c7f Add tests for restricted app cred guard Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 9 +- devstack/tools/oidc/setup_keycloak_client.py | 54 +- keystone/api/_shared/EC2_S3_Resource.py | 14 + keystone/api/credentials.py | 79 ++- keystone/api/os_oauth1.py | 11 + keystone/api/trusts.py | 46 +- keystone/api/users.py | 126 ++++- keystone/auth/plugins/core.py | 7 +- keystone/auth/plugins/mapped.py | 4 + keystone/auth/plugins/token.py | 15 +- keystone/common/policies/base.py | 2 +- keystone/common/policies/project.py | 9 +- keystone/common/rbac_enforcer/enforcer.py | 21 +- keystone/conf/security_compliance.py | 67 +++ .../notes/bug-2148398-e35dd449b3a330e6.yaml | 40 ++ .../notes/bug-2150089-e91b592c948e5771.yaml | 35 ++ 26 files changed, 2088 insertions(+), 66 deletions(-)

1 0

keystone 27.0.2 (epoxy)
by no-reply＠openstack.org 02 Jul '26

02 Jul '26

We are pleased to announce the release of: keystone 27.0.2 This release is part of the epoxy release series. The source is available from: https://opendev.org/openstack/keystone Download the package from: https://tarballs.openstack.org/keystone/ Please report issues through: https://bugs.launchpad.net/keystone/+bugs For more details, please see below. 27.0.2 ^^^^^^ Upgrade Notes ************* * [bug 2148398 (https://bugs.launchpad.net/keystone/+bug/2148398) The "identity:create_trust" policy rule now uses "%(target.trust.trustor_user_id)s" instead of "%(trust.trustor_user_id)s". The trust data from the request body is now passed explicitly via "target_attr" rather than relying on the JSON body merge. This aligns "create_trust" with all other trust policy rules which already use the "target.trust.*" prefix. Deployments that override the "identity:create_trust" policy and reference "%(trust.trustor_user_id)s" must update to "%(target.trust.trustor_user_id)s". * [bug 2150089 (https://launchpad.net/bugs/2150089) Two new "[security_compliance]" options control opt-in insecure behaviour for operators with workflows that break after this upgrade: "allow_insecure_admin_trust_cross_project_credentials_access" (default "False"): set to "True" if admin-role trusts or application credentials need to access credentials across multiple projects (e.g. Mistral cron triggers syncing EC2 credentials system-wide). "allow_insecure_application_credential_trust_escalation" (default "False"): set to "True" if application credentials must create or manage trusts (e.g. Heat stacks authenticated via application credentials). Use OIDC federation flows ("v3oidcclientcredentials", "v3oidcdeviceauthz") as the proper long-term alternative. Both options are intentionally named to signal that enabling them is insecure. Migrate affected workflows away from these options. Critical Issues *************** * [bug 2148398 (https://bugs.launchpad.net/keystone/+bug/2148398) The RBAC enforcer unconditionally merged the raw JSON request body into the policy enforcement dictionary after trusted target data had been set from the database. An attacker could include a "target" key in the JSON body to overwrite database-sourced RBAC target attributes, causing all "%(target.*)s" policy substitutions to evaluate against attacker-controlled values. This affected 88 endpoint/method combinations across all Keystone API resource areas. Any authenticated user could exploit this to read every credential secret in the deployment, create EC2 credentials for arbitrary users, or revoke other users' tokens. A domain administrator could escalate to full cloud admin by creating inherited role grants on other domains. The vulnerability has been present since the Rocky release (14.0.0). Security Issues *************** * [bug 2148398 (https://bugs.launchpad.net/keystone/+bug/2148398) The RBAC policy enforcer now namespaces JSON request body data under a "request_body" key in the policy dictionary instead of merging it at the top level. This prevents user-controlled input from overwriting security-critical keys such as "target" (populated from the database by "build_target" or "target_attr") and URL path parameters like "user_id". All upstream policy rules are unaffected by this change. Deployments with custom policy rules that reference JSON body fields directly via "%(field_name)s" substitutions (not under "target.") will need to update those references to "%(request_body.field_name)s". * [bug 2150089 (https://launchpad.net/bugs/2150089) Delegated tokens (trusts, application credentials, OAuth1 access tokens) are now restricted to credentials whose "project_id" matches the token's project scope. This closes a cross-project lateral movement vector where a delegated token could read, modify, or delete credentials belonging to a different project, including EC2 keys and TOTP/MFA seed bindings. Application credential tokens are now blocked from all trust operations (create, delete, list, get). Allowing an application credential to bootstrap a trust creates a new delegation context whose token can access authentication material outside the delegation chain, breaking the audit trail. The "unrestricted" flag governs credential management, not trust management. Changes in keystone 27.0.1..27.0.2 ---------------------------------- 1a19e7230 [CI][stable-only] Use already defined upper constraints 3626fdaf0 Add audience mapper to devstack Keycloak client d8cdc340c Fix project policy allowing unauthorized access to root domains 2743acbcb Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999) 7846c2375 Preserve expires_at when rescoping federated tokens (CVE-2026-44394) 50c30d169 Forbid trust operations using application credentials (CVE-2026-43000) 90fe79c82 Fix user impersonation through application credentials (CVE-2026-42998) 1b27d289f Enforce delegation project boundary for delegated tokens f4e498d33 Temporarily make grenade non-voting 52c167fb2 Use branch constraints for tempest venv on stable/2025.1 f62dd2caf Enforce app cred project boundary on EC2 credential paths 33744fef6 Block app cred tokens from authorizing OAuth1 requests c33033594 Block restricted app creds from creating EC2 credentials via /credentials 52e474396 Add tests for restricted app cred guard Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 27 +- devstack/tools/oidc/setup_keycloak_client.py | 54 +- keystone/api/_shared/EC2_S3_Resource.py | 14 + keystone/api/credentials.py | 79 ++- keystone/api/os_oauth1.py | 11 + keystone/api/trusts.py | 46 +- keystone/api/users.py | 126 ++++- keystone/auth/plugins/core.py | 7 +- keystone/auth/plugins/mapped.py | 4 + keystone/common/policies/base.py | 2 +- keystone/common/policies/project.py | 9 +- keystone/common/rbac_enforcer/enforcer.py | 21 +- keystone/conf/security_compliance.py | 67 +++ .../notes/bug-2148398-e35dd449b3a330e6.yaml | 40 ++ .../notes/bug-2150089-e91b592c948e5771.yaml | 35 ++ 25 files changed, 2047 insertions(+), 61 deletions(-)

1 0

nova 31.3.1 (epoxy)
by no-reply＠openstack.org 01 Jul '26

01 Jul '26

We high-spiritedly announce the release of: nova 31.3.1 This release is part of the epoxy release series. The source is available from: https://opendev.org/openstack/nova Download the package from: https://tarballs.openstack.org/nova/ Please report issues through: https://bugs.launchpad.net/nova/+bugs For more details, please see below. 31.3.1 ^^^^^^ Bug Fixes * Bug #2105896: Fix error when multiple security groups in a project share the same name. The security group resolution now checks UUIDs before names, ensuring that a request using a specific UUID is never blocked by a naming collision. When a security group is requested by name and multiple groups share that name, a "NoUniqueMatch" error is raised prompting the user to use a UUID instead. (https://launchpad.net/bugs/2105896) Changes in nova 31.3.0..31.3.1 ------------------------------ 355edcbbc6 Strip internal _nova-prefixed scheduler hints on create f79983f4c6 [CI][stable-only] nova-grenade-multinode fix dbe586bc2f Fix error when multiple security group in a project with same name 05a81e5f67 Add reproducer test for bug 2105896 6b109f597d Fix resize to unpermitted flavors f238590686 fix: device_by_alias should respect config type 80551125dd api: Handle empty imageRef alongside null for local BDM check 456a57c020 Cache [pci]alias parsing b5dffede7d Validate [pci]alias at service startup 2ca6c939d3 Validated that PCI alias has proper ids 265f4926c8 Multiple spec per PCI alias limitation f0a1ee5a88 Return HTTP400 for multi spec pci alias if PCI in Placement c0bc2d09f3 Add functional reproducer for bug 2102038 Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 4 + nova/api/openstack/compute/servers.py | 5 +- nova/api/openstack/wsgi_app.py | 6 ++ nova/compute/api.py | 6 +- nova/compute/manager.py | 4 + nova/conf/pci.py | 5 +- nova/network/neutron.py | 41 ++++---- nova/pci/request.py | 60 ++++++++++- nova/test.py | 9 ++ .../functional/regressions/test_bug_2077980.py | 49 +++++++++ .../functional/regressions/test_bug_2102038.py | 59 +++++++++++ .../functional/regressions/test_bug_2111440.py | 48 +++++++++ nova/virt/libvirt/guest.py | 2 +- .../notes/bug-2105896-2bebad3d9eacd346.yaml | 11 ++ 22 files changed, 597 insertions(+), 42 deletions(-)

1 0

nova 32.2.1 (flamingo)
by no-reply＠openstack.org 01 Jul '26

01 Jul '26

We are excited to announce the release of: nova 32.2.1 This release is part of the flamingo release series. The source is available from: https://opendev.org/openstack/nova Download the package from: https://tarballs.openstack.org/nova/ Please report issues through: https://bugs.launchpad.net/nova/+bugs For more details, please see below. 32.2.1 ^^^^^^ Bug Fixes * Bug #2105896: Fix error when multiple security groups in a project share the same name. The security group resolution now checks UUIDs before names, ensuring that a request using a specific UUID is never blocked by a naming collision. When a security group is requested by name and multiple groups share that name, a "NoUniqueMatch" error is raised prompting the user to use a UUID instead. (https://launchpad.net/bugs/2105896) Changes in nova 32.2.0..32.2.1 ------------------------------ 0e969c5246 Strip internal _nova-prefixed scheduler hints on create 2f1149c5ae [CI][stable-only] Remove grenade-skip-level bf6e39e5b3 Fix error when multiple security group in a project with same name 5e0a988636 Add reproducer test for bug 2105896 07deedd552 Fix resize to unpermitted flavors b6ca54481c fix: device_by_alias should respect config type Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 4 - nova/compute/api.py | 6 +- nova/network/neutron.py | 41 +++++----- nova/virt/libvirt/guest.py | 2 +- .../notes/bug-2105896-2bebad3d9eacd346.yaml | 11 +++ 9 files changed, 215 insertions(+), 31 deletions(-)

1 0