* Fix CVE-2026-11332 - prevent role requirements from configuring git (#87070)
* Pass malformed role requirements as positional arguments to prevent arbitrary git configuration
* Add test coverage, checking for specific errors and that git clone is always followed by --
Co-authored-by: 🇺🇦 Sviatoslav Sydorenko (Святослав Сидоренко) <wk.cvs.github@sydorenko.org.ua>
(cherry picked from commit edee59aa15)
* Fix ansible-galaxy-role test isolating stderr (#87085)
Follow up to #87070 to fix the test
Fix ansible-galaxy-role test isolating stder
Remove new feature to backport as-is
(cherry picked from commit bebae770d3)
---------
Co-authored-by: 🇺🇦 Sviatoslav Sydorenko (Святослав Сидоренко) <wk.cvs.github@sydorenko.org.ua>
* also remove unused parameters from inner function
* Ensure no_log does not use subsets
Sort strings before using so the longer ones are processed first
avoiding strings that are subsets of each other creating partial
results.
Co-authored-by: David Shrewsbury <Shrews@users.noreply.github.com>
(cherry picked from commit 5c55372345)
PR #87041
PR #87010 bumped the container used in CI for uploading the coverage
measurements to Codecov and its runtime now uses Python 3.13.
The previously set `.azure-pipelines/scripts/dependencies/codecov.txt`
pip constraints used to lock down the transitive dependencies in that
environment were of older versions and `test-results-parser==0.5.4`
caused pip to trigger building this dependency from an sdist due to
the latest platform-specific wheel available for that version being
tagged for Python 3.12.
The new container does not have enough of the build toolchain and the
build fails being unable to find the `cc` linker [[1]].
This patch mass-upgrades the transitive dependencies in said deptree
to newer versions that also ship platform-specific wheels for Python
3.13 and 3.14.
[1]: https://dev.azure.com/ansible/ansible/_build/results?buildId=181432&view=logs&j=d7668ad9-d7bb-5ae4-c14f-5061b89e467d&s=44856301-4c0b-5572-5f50-eb8e385c84fd&t=7f884d87-6a36-516f-9067-af4cf77c020d&l=93
ci_coverage
ci_complete
(cherry picked from commit d25ac06)
The git module hardcodes 'master' when comparing submodule versions
with track_submodules=yes. This fails for repositories that use a
different default branch (e.g. 'main').
Read the branch from .gitmodules for each submodule, falling back to
the remote HEAD if no branch is configured. This respects the
submodule's configured branch and works regardless of the default
branch name.
Fixes#77691
(cherry picked from commit 44aa5b8)
Signed-off-by: olegnazarov23 <olegnazarov23@users.noreply.github.com>
Co-authored-by: Oleg Nazarov <oleg@web-gravity.net>
* winrm/psrp - apply no_log to stdout/stderr logs
This change censors the raw stdout/stderr logging used on the `winrm`
and `psrp` connection plugins with a verbosity level of 5 being set.
While by default the raw output isn't sensitive if a user has set a task
with `no_log: true` we shouldn't be displaying the raw results of that
task.
* Apply suggestions from code review
---------
(cherry picked from commit 49f1615157)
Co-authored-by: Abhijeet Kasurde <akasurde@redhat.com>
* Add VALIDATE state to IteratingStates and FailedStates instead of overloading cur_regular_task, which marks the --start-at-task location.
fixes#86268
* Fix skipping validate_argspec by not tagging with 'always' when inheriting play-level tags. Now it aligns with play-level gather_facts tag usage.
(cherry picked from commit efb9446769)
* Fixes Parsing for ClearLinux exposed by Gentoo changing os-release, Quoting from " to ', also fixes NA parsing to strip both kinds of quotes
(cherry picked from commit 869088b)
Co-authored-by: RealKelsar <tetja@tetja.de>
* Fix using the server's validate_certs configuration when downloading collections
* Fix validate_certs for verify
There is no GalaxyAPI on the collection object for verify since it wasn't created via the resolver
Remove unit test - would need more convoluted monkeypatching
* Simplify ConcreteArtifactsManager.save_collection_source by passing 2 arguments instead of 6
* Consolidate ConcreteArtifactsManager instance attrs _galaxy_collection_cache/_galaxy_collection_origin_cache
(cherry picked from commit a51536f311)
* Fix powershell method on non-pipelined conns (#86619)
Fixes the action plugin mkdtemp and expand_user calls to fallback to the
original non-pipelined variants when a connection plugin does not
support pipelining. For example a 3rd party Windows connection plugin
may not support pipelining and thus cannot use the user _mkdtemp2 and
_expand_user2 variants exposed by the `powershell` shell plugin as they
require data to be sent over stdin.
(cherry picked from commit 51d5a456ef)
* Testing tweaks for 2.20 compat
* Add deprecated to paramiko_ssh DOCUMENTATION
* Fix deprecation
Rename plugin with prefix _
Fix validate-modules bug introduced in 2.18 for ansible.builtin plugins
* Add 'removed' to the initial definition of main_fields
Fix network module failures on tagged RPC responses
* Zap tags in networking JsonRpcServer before pickling responses.
* Verify with unit test - suboptimal, but avoids a fake network connection plugin.
(cherry picked from commit a287389124)
The local connection plugin is incorrectly passing a bytearray to methods of become plugins that expect bytes. A recent change to the su plugin exposed this by breaking the become plugin for different locale settings (the bytearray was not properly converted to a str for comparison operations). This changes the local connection plugin to send bytes.
(cherry picked from commit 90595736ed)
Fixes the error to only include the command rather than the dataclass
repr. This goes back to how it worked in the past before `_mkdtemp2` was
added.
(cherry picked from commit 2c1fdfe0eb)
