August 2026 - Release-announce - lists.openstack.org

keystoneauth 5.17.0 (hibiscus)
by no-reply＠openstack.org 28 Aug '26

28 Aug '26

We enthusiastically announce the release of: keystoneauth 5.17.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/keystoneauth Download the package from: https://pypi.org/project/keystoneauth Please report issues through: https://bugs.launchpad.net/keystoneauth/+bugs For more details, please see below. 5.17.0 ^^^^^^ New Features ************ * Added a "v3websso" authentication plugin, "keystoneauth1.identity.v3.WebSSO", which implements the identity service's WebSSO protocol. The plugin opens the WebSSO endpoint in the user's browser and receives the resulting unscoped token on a loopback listener, letting a client authenticate against an external identity provider without holding any credentials of its own. The callback URL, by default "http://localhost:9990/auth/websso/", must be listed in the identity service's "[federation] trusted_dashboard" option. * When two auth plugins register the same "keystoneauth1.plugin" entry-point name with one being an in-tree plugin and one an out-of- tree implementation of the same name, the out-of-tree implementation is now preferred. This lets deployers override a plugin shipped by keystoneauth1 with their own package. * Add support for configuring TLS cipher suites and minimum TLS protocol version on Session objects. Two new parameters are available: "tls_ciphers" accepts an OpenSSL cipher string to restrict the allowed cipher suites, and "tls_min_version" accepts a float ("1.2" or "1.3") to enforce a minimum TLS protocol version. When neither is specified, the default ciphers from the OpenSSL library are used and the highest protocol version supported by both client and server is negotiated. These can be set via the Session constructor, oslo.config options ("tls-ciphers", "tls-min-version"), CLI arguments ("--tls-ciphers", "--tls-min-version"), or environment variables ("OS_TLS_CIPHERS", "OS_TLS_MIN_VERSION"). Security Issues *************** * The "v3websso" plugin's loopback callback is open to login CSRF. While a login is in progress, another page open in the user's browser can submit a form to the callback port and have its own token accepted. The protocol offers no way to prevent this, because the identity service requires the callback's "origin" to match a "trusted_dashboard" entry exactly and so it cannot carry a nonce. The listener binds to loopback only, runs only for the duration of a login, and stops at the first token it accepts. See the plugin documentation for details. Changes in keystoneauth 5.16.0..5.17.0 -------------------------------------- b48226e Add minimum tls version and caller cipher controls 9e083fd Prefer out-of-tree auth plugins on entry-point conflicts c155737 Add a v3websso authentication plugin Diffstat (except docs and test files) ------------------------------------- keystoneauth1/fixture/keystoneauth_betamax.py | 5 +- keystoneauth1/identity/__init__.py | 4 + keystoneauth1/identity/v3/__init__.py | 2 + keystoneauth1/identity/v3/websso.py | 490 +++++++++++++++++ keystoneauth1/loading/_plugins/identity/v3.py | 57 ++ keystoneauth1/loading/base.py | 48 +- keystoneauth1/loading/session.py | 59 ++ keystoneauth1/session.py | 73 ++- pyproject.toml | 1 + .../add-v3websso-plugin-9a1f0c4bd6f8e2a7.yaml | 23 + ...refer-out-of-tree-plugins-9aea996013f5473e.yaml | 7 + .../tls-ciphers-min-version-a1b2c3d4e5f6g7h8.yaml | 16 + requirements.txt | 2 +- 24 files changed, 2033 insertions(+), 9 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index eaeefe6..777ca25 100644 --- a/requirements.txt +++ b/requirements.txt @@ -16 +16 @@ requests>=2.14.2 # Apache-2.0 -stevedore>=1.20.0 # Apache-2.0 +stevedore>=5.9.1 # Apache-2.0

1 0

python-manilaclient 6.3.0 (hibiscus)
by no-reply＠openstack.org 28 Aug '26

28 Aug '26

We high-spiritedly announce the release of: python-manilaclient 6.3.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/python-manilaclient Download the package from: https://pypi.org/project/python-manilaclient Please report issues through: https://bugs.launchpad.net/python-manilaclient/+bugs For more details, please see below. 6.3.0 ^^^^^ New Features ************ * The "openstack share list" command now accepts an "--availability- zone" option to filter shares by their availability zone. This filter is available with manila API version "2.97" and beyond. * Updated the "migration_get_progress" method to use the new GET endpoint "GET /v2/shares/{share_id}/migration-progress" when called with API microversion >= "2.98". For older microversions the prior POST action is still used. Bug #2108851 (https://bugs.launchpad.net/manila/+bug/2108851) * API requests to the Manila service now use the keystoneauth1 session instead of a custom HTTP client when a session is available. This provides automatic token renewal, standardized logging, and consistent behavior with other OpenStack clients. Security Issues *************** * Auth tokens are now redacted (SHA256 hashed) in debug log output to prevent credential exposure (bug 2125625 (https://bugs.launchpad.net /python-manilaclient/+bug/2125625)). * Auth tokens are automatically redacted in debug logs by keystoneauth1 session-based request handling, preventing credential exposure when "--debug" is enabled. Bug Fixes ********* * Fixed resource lock list filtering by project or user by adding the missing domain options. * Fixed a bug where the "properties" field in several show commands (share show, share snapshot show, share replica show, share network subnet show, and share export location show) was unconditionally wrapped in "DictColumn", causing a JSON serialization error when using the "-f json" formatter. Changes in python-manilaclient 6.2.0..6.3.0 ------------------------------------------- 870fccd Add availability_zone filter to share list (2.97) c1ff711 Use keystoneauth session for API requests eca7df2 Fix resource lock project and user filters 3304ea9 bindep: Remove stale markers 1d89e5b Update migration_get_progress to use GET at microversion 2.98 9b2462a pre-commit: autoupdate 218d5a5 Redact auth token in debug log output bc91886 Direct repository urls to opendev.org b3eaef2 Fix dead link, removed CLI reference and typo in contributing.rst 64af6a5 Add missing share backup and share transfer sections to CLI docs e17b00d Improve --share-type help text for share create cefc28b Add test for share type unset single spec 0e2c2af Add missing unit tests for share_export_locations metadata methods 5f77952 Fix DictColumn JSON serialization error fb40b7f Mock sleep in ClientTest to reduce unit test runtime Diffstat (except docs and test files) ------------------------------------- .pre-commit-config.yaml | 4 +- README.rst | 10 +- bindep.txt | 3 +- manilaclient/api_versions.py | 2 +- manilaclient/common/constants.py | 1 + manilaclient/common/httpclient.py | 120 +++++++++++- manilaclient/osc/v2/resource_locks.py | 2 + manilaclient/osc/v2/share.py | 34 +++- manilaclient/osc/v2/share_network_subnets.py | 7 +- manilaclient/osc/v2/share_networks.py | 7 +- manilaclient/osc/v2/share_replicas.py | 7 +- manilaclient/osc/v2/share_snapshots.py | 7 +- manilaclient/v2/client.py | 102 +++++----- manilaclient/v2/shares.py | 41 +++- ...one-filter-for-share-list-d4ac16f4c54749a7.yaml | 7 + ...get-progress-get-endpoint-c3d4e5f6a7b89012.yaml | 8 + ...-auth-token-in-debug-logs-a1b2c3d4e5f6g7h8.yaml | 6 + ...773-resource-lock-filters-57e728b1c64034fb.yaml | 5 + ...column-json-serialization-d51ea8bbf8e01078.yaml | 8 + ...-session-for-api-requests-b3c4d5e6f7a8b9c0.yaml | 12 ++ 32 files changed, 869 insertions(+), 168 deletions(-)

1 0

python-watcherclient 4.11.0 (hibiscus)
by no-reply＠openstack.org 28 Aug '26

28 Aug '26

We are satisfied to announce the release of: python-watcherclient 4.11.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/python-watcherclient Download the package from: https://pypi.org/project/python-watcherclient Please report issues through: https://bugs.launchpad.net/watcher/+bugs For more details, please see below. 4.11.0 ^^^^^^ New Features ************ * Added support for the "default_parameters" field on Audit Templates. When creating a template with a strategy, operators can now pre- configure strategy parameter values using the "--default- parameter" option: $ openstack optimize audittemplate create <name> <goal> -s <strategy> -p threshold=0.5 -p period=300 Audits created from a template that has "default_parameters" set will inherit those values automatically. Explicitly provided audit parameters take precedence over template defaults. The field is shown in "audittemplate show" and "audittemplate list --detail" responses. This feature requires Watcher API microversion 1.7 or higher. Upgrade Notes ************* * The maximum supported API version has been increased to 1.7 to support the new "default_parameters" field on Audit Templates. Changes in python-watcherclient 4.10.0..4.11.0 ---------------------------------------------- 36952b4 Add default_parameters support to Audit Template c5edfd9 Ignore eventlet deprecation warning messages Diffstat (except docs and test files) ------------------------------------- ...parameters-audit-template-55af5f94331a59c7.yaml | 22 +++++++ tox.ini | 4 ++ watcherclient/common/api_versioning.py | 10 ++++ .../client_functional/v1/test_audit_template.py | 53 +++++++++++++++++ watcherclient/v1/audit_template.py | 3 +- watcherclient/v1/audit_template_shell.py | 19 ++++++ watcherclient/v1/resource_fields.py | 6 +- 9 files changed, 189 insertions(+), 7 deletions(-)

1 0

python-swiftclient 4.11.0 (hibiscus)
by no-reply＠openstack.org 28 Aug '26

28 Aug '26

We are chuffed to announce the release of: python-swiftclient 4.11.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/python-swiftclient Download the package from: https://pypi.org/project/python-swiftclient Please report issues through: https://bugs.launchpad.net/python-swiftclient/+bugs For more details, please see below. Changes in python-swiftclient 4.10.0..4.11.0 -------------------------------------------- 7486fb7 Remove unused fallback to pipes module 52ffa51 Remove unused executable script d3bfd6a Enable H904 check dbdd685 Bump upper cap of hacking 9752e22 Add minimum pyproject.toml 77e4ac9 Update master for stable/2026.1 Diffstat (except docs and test files) ------------------------------------- bin/swift | 24 ------------------------ pyproject.toml | 4 ++-- releasenotes/source/2026.1.rst | 6 ++++++ releasenotes/source/index.rst | 1 + swiftclient/shell.py | 25 ++++++++++--------------- test-requirements.txt | 2 +- tox.ini | 3 ++- 7 files changed, 22 insertions(+), 43 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index 9049f52..1196910 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -1 +1 @@ -hacking>=3.2.0,<6.2.0 # Apache-2.0 +hacking>=3.2.0,<8.2.0 # Apache-2.0

1 0

python-magnumclient 5.0.0 (hibiscus)
by no-reply＠openstack.org 28 Aug '26

28 Aug '26

We are stoked to announce the release of: python-magnumclient 5.0.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/python-magnumclient Download the package from: https://pypi.org/project/python-magnumclient Please report issues through: https://bugs.launchpad.net/python-magnumclient/+bugs For more details, please see below. 5.0.0 ^^^^^ New Features ************ * The "openstack coe nodegroup update" command gained "--node- labels" and "--node-taints" flags for updating the Kubernetes node labels and node taints on an existing nodegroup, e.g.: openstack coe nodegroup update \ --node-labels workload=gpu \ --node-taints workload=gpu:NoSchedule \ <cluster> <nodegroup> Each flag replaces the corresponding field in full and may be repeated. Passing an empty value (e.g. "--node-labels ''") clears the field. * "openstack coe cluster set", "openstack coe nodegroup set", and "openstack coe cluster template set" now accept named flags instead of the previous JSON Patch positional arguments ("<op> <path=value>"). "coe cluster set" gains "--name", "--node-count", "--master-count", "--label <key=value>" (repeatable, adds or replaces a single label), "--no-label <key>" (repeatable, removes a single label), and "-- rollback". The "--rollback" flag is also now correctly forwarded to the API, fixing a pre-existing silent bug. "coe nodegroup set" gains "--min-nodes" and "--max-nodes" (the only fields the Magnum API permits patching on a nodegroup; node count changes go through the resize action). "coe cluster template set" gains a full set of named flags matching the create command, including "--label"/"--no-label" for per-key label operations, "--tag" for tags, and boolean "--X"/"--no-X" pairs for toggles such as "--public"/"--private", "--hidden"/"--visible", "--tls-disabled"/"--tls-enabled", etc. Upgrade Notes ************* * The "openstack coe cluster set", "openstack coe nodegroup set", and "openstack coe cluster template set" commands no longer accept the positional "<op>" and "<path=value>" arguments. Callers must migrate to the new named flags described in the features section above. Changes in python-magnumclient 4.11.0..5.0.0 -------------------------------------------- 43fc0de Replace deprecated datetime.datetime.utcnow e202ee5 Add node label and taint support to nodegroups 9d2b5bd Support microversion 1.13: replace stack_id with cluster_id in clusters c7a8439 CI: Bump hacking to 8.1.0 a59102e Fix --os-container-infra-api-version with microversion strings e4084c0 Migrate setup configuration to pyproject.toml 456dced Rework coe cluster/nodegroup/template set 173364f Move display attribute lists to v1 manager modules 16fedd9 Remove deprecated apiclient indirection layer 4d37f9e Remove legacy magnum CLI and shell infrastructure 3a584aa Remove backward-compatibility shims from Client and legacy shell 276bfea Add test certs from unit testing to ignore d06edd0 Drop support for Python 3.8, 3.9 and 3.10 28bc029 Add pyproject.toml to support pip 23.1 cceec79 Remove url tags from README 2198458 Remove legacy 'container' service type fallback 6b3ea3f Remove deprecated docker storage driver warning in OSC cluster template e2ca7ab Remove deprecated CLI argument aliases from legacy shell commands 8238115 Add option to set driver in cluster_template e56f296 CI: Use magnum Zuul queue Diffstat (except docs and test files) ------------------------------------- .gitignore | 6 + .zuul.yaml | 1 + README.rst | 16 +- magnumclient/common/apiclient/__init__.py | 0 magnumclient/common/apiclient/base.py | 108 --- magnumclient/common/apiclient/exceptions.py | 471 ------------ magnumclient/common/base.py | 62 +- magnumclient/common/cliutils.py | 166 +---- magnumclient/common/utils.py | 35 + magnumclient/exceptions.py | 458 +++++++++++- magnumclient/osc/plugin.py | 13 +- magnumclient/osc/v1/cluster_templates.py | 298 ++++++-- magnumclient/osc/v1/clusters.py | 112 +-- magnumclient/osc/v1/nodegroups.py | 135 ++-- magnumclient/osc/v1/quotas.py | 10 +- magnumclient/shell.py | 648 ----------------- magnumclient/v1/certificates_shell.py | 95 --- magnumclient/v1/client.py | 32 +- magnumclient/v1/cluster_templates.py | 38 + magnumclient/v1/cluster_templates_shell.py | 336 --------- magnumclient/v1/clusters.py | 52 ++ magnumclient/v1/clusters_shell.py | 288 -------- magnumclient/v1/mservices_shell.py | 27 - magnumclient/v1/nodegroups.py | 28 +- magnumclient/v1/quotas.py | 9 + magnumclient/v1/quotas_shell.py | 148 ---- magnumclient/v1/shell.py | 30 - magnumclient/v1/stats_shell.py | 29 - pyproject.toml | 78 ++ ...roup-update-labels-taints-0d8c4b6e2f1a3c5d.yaml | 14 + ...rework-coe-cluster-set-ux-ddcbb30dfa0d336f.yaml | 28 + requirements.txt | 3 +- setup.cfg | 68 -- setup.py | 4 +- test-requirements.txt | 2 +- 53 files changed, 1585 insertions(+), 4554 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 1eeff66..5426d1c 100644 --- a/requirements.txt +++ b/requirements.txt @@ -4 +4,2 @@ -pbr!=2.1.0,>=2.0.0 # Apache-2.0 + +pbr>=6.1.1 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index b5d097f..4e1218a 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -1 +1 @@ -hacking>=6.1.0,<6.2.0 # Apache-2.0 +hacking>=8.1.0,<8.2.0 # Apache-2.0

1 0

osc-placement 4.9.1 (hibiscus)
by no-reply＠openstack.org 28 Aug '26

28 Aug '26

We are happy to announce the release of: osc-placement 4.9.1 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/osc-placement Download the package from: https://pypi.org/project/osc-placement Please report issues through: https://bugs.launchpad.net/placement-osc-plugin/+bugs For more details, please see below. Changes in osc-placement 4.9.0..4.9.1 ------------------------------------- bcb19c3 tox: Fix outdated functional test environments 8045248 [tox] Use constraints for requirements in docs job a288a3d Update master for stable/2025.2 bfc1385 reno: Update master for unmaintained/2024.1 f51d9c8 Exclude tests directory from coverage calculation Diffstat (except docs and test files) ------------------------------------- .coveragerc | 1 + releasenotes/source/2024.1.rst | 2 +- releasenotes/source/2025.2.rst | 6 ++++++ releasenotes/source/index.rst | 1 + tox.ini | 17 +++++++++-------- 5 files changed, 18 insertions(+), 9 deletions(-)

1 0

python-troveclient 8.11.0 (hibiscus)
by no-reply＠openstack.org 28 Aug '26

28 Aug '26

We are happy to announce the release of: python-troveclient 8.11.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/python-troveclient Download the package from: https://pypi.org/project/python-troveclient Please report issues through: https://bugs.launchpad.net/python-troveclient/+bugs For more details, please see below. Changes in python-troveclient 8.10.0..8.11.0 -------------------------------------------- 5e0f1d3 SSL management feature support ef64581 Update master for stable/2026.1 89cd63a reno: Update master for unmaintained/2024.1 00461c5 Use unversioned environment by default 71614cf Drop environments for nose 256f199 Add note about requirements lower bounds Diffstat (except docs and test files) ------------------------------------- releasenotes/source/2024.1.rst | 2 +- releasenotes/source/2026.1.rst | 6 ++ releasenotes/source/index.rst | 1 + requirements.txt | 4 + setup.cfg | 4 + tox.ini | 10 +-- troveclient/osc/v1/database_ssl.py | 164 ++++++++++++++++++++++++++++++++++++ troveclient/v1/instances.py | 39 +++++++++ 9 files changed, 313 insertions(+), 10 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 8321d6a..a742f0c 100644 --- a/requirements.txt +++ b/requirements.txt @@ -0,0 +1,4 @@ +# Requirements lower bounds listed here are our best effort to keep them up to +# date but we do not test them so no guarantee of having them all correct. If +# you find any incorrect lower bounds, let us know or propose a fix. +

1 0

python-barbicanclient 7.6.0 (hibiscus)
by no-reply＠openstack.org 28 Aug '26

28 Aug '26

We high-spiritedly announce the release of: python-barbicanclient 7.6.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/python-barbicanclient Download the package from: https://tarballs.openstack.org/python-barbicanclient/ Please report issues through: https://bugs.launchpad.net/python-barbicanclient/+bugs For more details, please see below. 7.6.0 ^^^^^ Upgrade Notes * Support for Python 3.10 has been removed. Now the minimum python version supported is 3.11. Changes in python-barbicanclient 7.5.0..7.6.0 --------------------------------------------- 17aa5ab Add openstack-python3-next-jobs 0ec35fd Remove Python 3.10 support 184c12e Declare Python 3.13 support 6c77e0d Drop options for old documentation build 0278502 Drop direct import from the base client module 6473f49 Delay string interpolations at logging calls Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 1 + barbicanclient/client.py | 48 +++------------------- barbicanclient/v1/acls.py | 16 ++++---- barbicanclient/v1/cas.py | 4 +- barbicanclient/v1/containers.py | 25 ++++++----- barbicanclient/v1/orders.py | 7 ++-- barbicanclient/v1/secrets.py | 36 ++++++++-------- .../notes/remove-py310-e48ca151c8e9e473.yaml | 5 +++ setup.cfg | 13 ++---- tox.ini | 4 +- 10 files changed, 61 insertions(+), 98 deletions(-)

1 0

python-zunclient 5.5.0 (hibiscus)
by no-reply＠openstack.org 28 Aug '26

28 Aug '26

We exuberantly announce the release of: python-zunclient 5.5.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/python-zunclient Download the package from: https://pypi.org/project/python-zunclient Please report issues through: https://bugs.launchpad.net/python-zunclient/+bugs For more details, please see below. Changes in python-zunclient 5.4.0..5.5.0 ---------------------------------------- cf86d6a Update master for stable/2026.1 Diffstat (except docs and test files) ------------------------------------- releasenotes/source/2026.1.rst | 6 ++++++ releasenotes/source/index.rst | 1 + 2 files changed, 7 insertions(+)

1 0

python-novaclient 18.13.1 (hibiscus)
by no-reply＠openstack.org 28 Aug '26

28 Aug '26

We are amped to announce the release of: python-novaclient 18.13.1 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/python-novaclient Download the package from: https://pypi.org/project/python-novaclient Please report issues through: https://bugs.launchpad.net/python-novaclient/+bugs For more details, please see below. Changes in python-novaclient 18.13.0..18.13.1 --------------------------------------------- 3cdb7f59 bindep: Remove stale marker f10d8ea8 Use the new variable to enable the RBAC new defaults Diffstat (except docs and test files) ------------------------------------- .pre-commit-config.yaml | 2 +- .zuul.yaml | 2 +- bindep.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)

1 0