* fix bcrypt salt string formatting on musl libc by ensuring it is always zero-padded to 2 digits
Fixes: #87180
(cherry picked from commit 78c337b827)
Signed-off-by: Abhijeet Kasurde <Akasurde@redhat.com>
The async_wrapper now stops the module process before writing the timeout result to the async job file. This ensures a valid JSON file that async_status can parse.
Improve gather_facts parallel=true timeout responsiveness when gather_timeout is less than 10.
Fix integration tests.
(cherry picked from commit 3d3afdb34b)
When the ansible-test timeout is enabled, a callback plugin is injected
into ansible-playbook that uses faulthandler.dump_traceback_later to
write all thread stacks to a file shortly before the deadline. This
provides diagnostic information for intermittent CI hangs where the
process stops producing output with no traceback or error.
Also fixes collection/setup.sh to handle multiple colon-separated
paths in ANSIBLE_COLLECTIONS_PATH.
(cherry picked from commit 5e5d863173)
Assisted-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Fix IndexError in free strategy when hosts become unreachable
Fixes an IndexError crash in the free strategy plugin when hosts
become unreachable during playbook execution.
The bug occurred when:
- last_host index persists across outer loop iterations
- hosts_left is regenerated each iteration via get_hosts_left()
- Some hosts become unreachable between iterations
- hosts_left shrinks but last_host retains its previous value
- Accessing hosts_left[last_host] raises IndexError
The fix adds a bounds check after regenerating hosts_left to reset
last_host to 0 if it's out of bounds. This preserves the round-robin
fairness algorithm while preventing the IndexError.
Assisted-by: Claude Sonnet 4.5 <noreply@anthropic.com>
* integration test
* review comment fixes
* ci_complete
(cherry picked from commit 08a71d148e)
* Fix CVE-2026-11332 - prevent role requirements from configuring git (#87070)
* Pass malformed role requirements as positional arguments to prevent arbitrary git configuration
* Add test coverage, checking for specific errors and that git clone is always followed by --
Co-authored-by: 🇺🇦 Sviatoslav Sydorenko (Святослав Сидоренко) <wk.cvs.github@sydorenko.org.ua>
(cherry picked from commit edee59aa15)
* Fix ansible-galaxy-role test isolating stderr (#87085)
Follow up to #87070 to fix the test
Fix ansible-galaxy-role test isolating stder
Remove new feature to backport as-is
(cherry picked from commit bebae770d3)
---------
Co-authored-by: 🇺🇦 Sviatoslav Sydorenko (Святослав Сидоренко) <wk.cvs.github@sydorenko.org.ua>
* also remove unused parameters from inner function
* Ensure no_log does not use subsets
Sort strings before using so the longer ones are processed first
avoiding strings that are subsets of each other creating partial
results.
Co-authored-by: David Shrewsbury <Shrews@users.noreply.github.com>
(cherry picked from commit 5c55372345)
* winrm/psrp - apply no_log to stdout/stderr logs
This change censors the raw stdout/stderr logging used on the `winrm`
and `psrp` connection plugins with a verbosity level of 5 being set.
While by default the raw output isn't sensitive if a user has set a task
with `no_log: true` we shouldn't be displaying the raw results of that
task.
* Apply suggestions from code review
---------
(cherry picked from commit 49f1615157)
Co-authored-by: Abhijeet Kasurde <akasurde@redhat.com>
PR #87041
PR #87010 bumped the container used in CI for uploading the coverage
measurements to Codecov and its runtime now uses Python 3.13.
The previously set `.azure-pipelines/scripts/dependencies/codecov.txt`
pip constraints used to lock down the transitive dependencies in that
environment were of older versions and `test-results-parser==0.5.4`
caused pip to trigger building this dependency from an sdist due to
the latest platform-specific wheel available for that version being
tagged for Python 3.12.
The new container does not have enough of the build toolchain and the
build fails being unable to find the `cc` linker [[1]].
This patch mass-upgrades the transitive dependencies in said deptree
to newer versions that also ship platform-specific wheels for Python
3.13 and 3.14.
[1]: https://dev.azure.com/ansible/ansible/_build/results?buildId=181432&view=logs&j=d7668ad9-d7bb-5ae4-c14f-5061b89e467d&s=44856301-4c0b-5572-5f50-eb8e385c84fd&t=7f884d87-6a36-516f-9067-af4cf77c020d&l=93
ci_coverage
ci_complete
(cherry picked from commit d25ac06)
* Bogus auto-import of sqlite.NotSupportedError instead of stdlib NotImplementedError
* No meaningful external visibility
(cherry picked from commit 30260d8e55)
The git module hardcodes 'master' when comparing submodule versions
with track_submodules=yes. This fails for repositories that use a
different default branch (e.g. 'main').
Read the branch from .gitmodules for each submodule, falling back to
the remote HEAD if no branch is configured. This respects the
submodule's configured branch and works regardless of the default
branch name.
Fixes#77691
(cherry picked from commit 44aa5b8)
Signed-off-by: olegnazarov23 <olegnazarov23@users.noreply.github.com>
Co-authored-by: Oleg Nazarov <oleg@web-gravity.net>
* Add WORKER_SESSION_ISOLATION config for TTY sharing
* Worker should always be new PG leader
* Use non-deprecated os.setpgid for non-session-isolates case
* Validate session-isolated and not in signal_propagation integration test
(cherry picked from commit 5a2d53c6c6)
* Add VALIDATE state to IteratingStates and FailedStates instead of overloading cur_regular_task, which marks the --start-at-task location.
fixes#86268
* Fix skipping validate_argspec by not tagging with 'always' when inheriting play-level tags. Now it aligns with play-level gather_facts tag usage.
(cherry picked from commit efb9446769)
Currently when the editor returns a failure exit code in `ansible-vault edit`,
the original file is still being overwritten by whatever is in the temporary
file. This is undesirable when some process already made edits to the temporary
file and then later fails for some reason, since the file might only be
partially modified and thus corrupt.
Fix this by using `check_call()` instead of `call()` to throw an Exception when
the exit code is non-zero.
Co-authored-by: Matt Clay <matt@mystile.com>
* Register projections and action plugin variable API
Co-authored-by: Matt Clay <matt@mystile.com>
Co-authored-by: Patrick Kingston <pkingsto@redhat.com>
