July 2026 brought 17 Puppetlabs module releases, headlined by a fairly large Continuous Delivery release. cd4peadm 5.16.0 added external PostgreSQL database support and a configurable image pull policy, and closes 11 CVEs, alongside a breaking change to commit status contexts.
More modules dropped Puppet 7 support, some others picked up stdlib 10, and Windows Server 2025 support started rolling out into the modules.
This roundup pulls the most important changes into one place.
Highlighted Updates Continuous Delivery Adds External Databases, Configurable Image Pull Policies, and Closes 11 CVEs cd4peadm 5.16.0 is the biggest release of the month.
It adds support for pointing Continuous Delivery at an externally managed PostgreSQL database.
That could be a self-managed instance, Amazon RDS for PostgreSQL, or Amazon Aurora.
This externally managed db can be used instead of the database CD manages internally, giving operators control over durability, backups, and high availability.
It also adds a configurable option for job templates (//) and removes the fallback when using Podman; the matching cd4pe_jobs 1.7.4 release adds the same task parameter and fallback removal, so upgrade both together.
BREAKING: Commit status contexts now include the pipeline name ( instead of ).
Review any branch protection rules or required status checks that reference the old format.
This release also closed 11 CVEs across opentelemetry, NGINX, jetty, jackson, log4j, postgresql, golang.org/x/sys, and react-router.
Puppet 7 Support Dropped Five modules dropped Puppet 7 support in major version bumps: haproxy, iis, mount_iso, scheduled_task, sslcertificate.
There were all released as major version bumps to ensure that users still working on upgrading from Puppet 7 can stay pinned on the previous major version releases.
In related news, postgresql 10.6.3 restored the Puppet 7 support that 10.6.2 broke in a previous release; see its entry below. stdlib 10.x Rollout Continues Following June's stdlib 10.x rollout, four more modules now allow the puppetlabs-stdlib dependency to move to 10.x: haproxy, mount_iso, puppet_authorization, and sslcertificate. haproxy also widens its concat constraint to 10.x.
Affected modules: haproxy, mount_iso, puppet_authorization, sslcertificate.
Windows Server 2025 Support Added Three Windows-focused modules added support for Windows Server 2025 this month: scheduled_task, windows_env, and windows_eventlog.
These now all run acceptance testing against the 2025 version of the OS, in addition to other supported Windows versions.
What Updates Happened to Puppetlabs Modules in July 2026?
The following is an alphabetical listing of modules which received updates in July
2026.
If a module had multiple versions released, the updates are collected together, numbered with the "latest" version available. apache 13.3.0 📅 Latest release: 2026-07-23 (🌐 View on the Forge) Added OWASP CRS v4 support on modern Enterprise Linux (EL10) while preserving existing EL7/8/9 behaviour. (MODULES-11857) Scaffold OWASP CRS v4 support on EL10 via crs_source enum #2637 (SugatD) cd4pe_jobs 1.7.4 📅 Latest release: 2026-07-28 (🌐 View on the Forge) Adds the same configurable task parameter and Podman fallback removal shipping in cd4peadm 5.16.0 — upgrade both together to get matching behavior.
A new optional task parameter controls whether the container image is pulled before a job runs: (the default, and the previous behavior) pulls on every run; pulls only when the image is absent from the local runtime; skips the pull entirely and relies on the locally present image.
Presence is checked with / .
Omitting the parameter keeps the existing pull-every-run behavior.
The module no longer retries a failed image pull against .
Image names are now pulled exactly as given.
If you rely on unqualified image names (e.g. , ) on a Podman host, add to in , or use a fully-qualified name. cd4peadm 5.16.0 📅 Latest release: 2026-07-29 (🌐 View on the Forge) The changes this month added external PostgreSQL database support, a configurable image pull policy, source control token management improvements, and closed 11 CVEs.
There is also a breaking change to commit status contexts — see below (and the linked release notes).
Added support for external databases.
You can now point Continuous Delivery at a PostgreSQL instance you operate yourself, Amazon RDS for PostgreSQL, Amazon Aurora (PostgreSQL-compatible), or a self-managed PostgreSQL server, instead of the database CD manages for you.
This gives you control over durability, backups, and high availability.
You can configure external mode on a fresh install or migrate an existing managed install.
Added a feature to Continuous Delivery job templates so you can set an image pull policy per job (, , or ).
In an air-gapped environment, for example, setting the policy to stops Continuous Delivery's attempts to reach out to the internet for the image.
Updated the Source Control settings page to show when a configured Personal Access Token (PAT) expires on each connected GitHub, GitHub Enterprise, and GitLab integration card.
Tokens that have already expired or will expire within 30 days are clearly flagged so you can renew them before they cause failures.
BREAKING: Commit status contexts now include the pipeline name ( instead of ), which prevents collisions when multiple pipelines report status for the same commit.
Review any branch protection rules or required status checks that reference the old format. 11 CVEs addressed, including opentelemetry, NGINX, jetty, jackson, log4j, postgresql, golang.org/x/sys, and react-router.
Check the official release notes for cd4peadm 5.16.0 for the full details. comply 3.8.1 📅 Latest release: 2026-07-03 (🌐 View on the Forge) A Security Compliance Management maintenance release that did not have any new CVE fixes this time and was mostly operational and licensing improvements.
Increased the CIS-CAT Pro Assessor license expiry time; licenses are now good for a full year.
Added a parameter to update the CIS-CAT Pro Assessor license without upgrading SCM.
Added an option to control the task timeout for Windows 2022 domain controllers.
Added a background scan sweeper that detects and cancels scans stuck in a "running" state.
Increased the default Max graphql requests limit to 300 requests per window; use the Bolt plan to customize.
Check the official release notes for comply 3.8.1 for the full details. haproxy 9.1.0 📅 Latest release: 2026-07-28 (🌐 View on the Forge) Two releases this month: 9.0.0 dropped Puppet 7 support (BREAKING) and added resource support, while 9.1.0 removed a sensitive-data workaround and allows both stdlib and concat to move to their 10.x releases.
Includes monthly releases: 9.1.0 (2026-07-28), 9.0.0 (2026-07-20).
Eliminate Workaround for Sensitive Data; raises minimum requirement to #607 (cocker-cc) Add support for running programs #604 (deric) Pass install_options to package installer #603 (deric) examples: disable default stats listener #640 (bastelfreak) make picking haproxy::globals::sort_options_alphabetic work #573 (trefzer) Remove Puppet 7 support (BREAKING); the module now requires #631 (gavindidrichsen) Add support for resource, extra backend options, and docs #626 (matejzero) (MODULES-11840) Allow puppetlabs/stdlib 10.x #642 (imaqsood) Allow puppetlabs/concat 10.x #641 (bastelfreak) dependency: create mapfile before configfile #572 (trefzer) iis 11.0.0 📅 Latest release: 2026-07-01 (🌐 View on the Forge) Dropped Puppet 7 support (BREAKING) as part of ongoing modernization efforts, and marked the password parameter as sensitive so it no longer leaks into Puppet reports. (CAT-2374) Puppet Core update (BREAKING) — drops Puppet 7 support #414 (LukasAud) (MODULES-11595) Mark iis_application_pool password as sensitive to stop report leak #418 (imaqsood) mount_iso 5.0.0 📅 Latest release: 2026-07-22 (🌐 View on the Forge) Dropped Puppet 7 support (BREAKING) and allowed the stdlib dependen