Skip to content

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Aug 28, 2025

Bumps salt from 3004.2 to 3005.5.

Release notes

Sourced from salt's releases.

v3005.5

Version 3005.5

v3005.4

No release notes provided.

v3005.3

No release notes provided.

v3005.2

No release notes provided.

v3005.1-2

No release notes provided.

v3005.1

No release notes provided.

v3005

Version 3005

v3005rc2

No release notes provided.

v3005rc1

No release notes provided.

Changelog

Sourced from salt's changelog.

Salt 3005.5 (2024-01-19)

Security

  • Fix CVE-2024-22231 Prevent directory traversal when creating syndic cache directory on the master.
  • Fix CVE-2024-22232 Prevent directory traversal attacks in the master's serve_file method.

These vulnerablities were discovered and reported by: Yudi Zhao(Huawei Nebula Security Lab),Chenwei Jiang(Huawei Nebula Security Lab) (#565)

Salt v3005.4 (2023-10-16)

Removed

  • Tech Debt - support for pysss removed due to functionality addition in Python 3.3 #65029

Fixed

  • Improved error message when state arguments are accidentally passed as a string #38098

  • Allow pip.install to create a log file that is passed in if the parent directory is writeable #44722

  • Fixed merging of complex pillar overrides with salt-ssh states #59802

  • Fixed gpg pillar rendering with salt-ssh #60002

  • Made salt-ssh states not re-render pillars unnecessarily #62230

  • Made Salt maintain options in Debian package repo definitions #64130

  • Migrated all invoke tasks to python-tools-scripts.

    • tasks/docs.py -> tools/precommit/docs.py
    • tasks/docstrings.py -> tools/precommit/docstrings.py
    • tasks/loader.py -> tools/precommit/loader.py
    • tasks/filemap.py -> tools/precommit/filemap.py #64374
  • Fix salt user login shell path in Debian packages #64377

  • Fill out lsb_distrib_xxxx (best estimate) grains if problems with retrieving lsb_release data #64473

  • Fixed an issue in the file.directory state where the children_only keyword argument was not being respected. #64497

  • Move salt.ufw to correct location /etc/ufw/applications.d/ #64572

  • Fixed salt-ssh stacktrace when retcode is not an integer #64575

  • Fixed SSH shell seldomly fails to report any exit code #64588

  • Fixed some issues in x509_v2 execution module private key functions #64597

  • Fixed grp.getgrall() in utils/user.py causing performance issues #64888

  • Fix user.list_groups omits remote groups via sssd, etc. #64953

  • Ensure sync from _grains occurs before attempting pillar compilation in case custom grain used in pillar file #65027

  • Moved gitfs locks to salt working dir to avoid lock wipes #65086

  • Only attempt to create a keys directory when --gen-keys is passed to the salt-key CLI #65093

  • Fix nonce verification, request server replies do not stomp on eachother. #65114

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [salt](https://github.com/saltstack/salt) from 3004.2 to 3005.5.
- [Release notes](https://github.com/saltstack/salt/releases)
- [Changelog](https://github.com/saltstack/salt/blob/master/CHANGELOG.md)
- [Commits](saltstack/salt@v3004.2...v3005.5)

---
updated-dependencies:
- dependency-name: salt
  dependency-version: '3005.5'
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 28, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants