(release-3008.0)=
# Salt 3008.0 release notes

<!---
Do not edit this file. This is auto generated.
Edit the templates in doc/topics/releases/templates/
for a given release.
-->


<!--
Add release specific details below
-->

## Salt Resources

Salt 3008.0 introduces **Salt Resources** — a first-class targeting
primitive for things a minion manages on behalf of the master, like SSH
hosts, virtual appliances, API endpoints, or any other "remote thing"
that can't or shouldn't run a minion of its own.

A managing minion can manage many resources of many types. Each
resource is addressable by id, by type, or by per-resource grains —
the same targeting forms (`-G`, `-L`, `-C`, glob, list) work
identically against resources and minions.

Highlights:

- New compound targeting engine `T@<type>[:<id>]` selects resources
  by type, by full SRN, or both. Grain targeting (`-G`, `G@`) and PCRE
  grain targeting (`-P`, `P@`) augment matches with per-resource grain
  dicts the master cached at registration time.
- The master keeps an mmap-backed registry of which minion manages
  which resource (`salt.utils.resource_registry`). Lookups and inserts
  are O(1); the registry survives master restarts.
- A managing minion builds a per-resource execution and state loader
  keyed by resource type. Per-type modules live under
  `salt/resources/<type>/{modules,states,grains}/` (or under any Salt
  extension's `saltext/<ext>/resources/<type>/` tree), with override
  files winning their slot by directory order. Standard Salt modules
  fill any slot a resource type doesn't override.
- Merge-mode `state.apply`/`state.highstate`/`state.sls` against
  resource targets folds per-resource state results into one combined
  block on the managing minion, prefixed by resource id, matching how
  any other minion looks to the master.
- New escape-hatch dunder `__minion__` gives per-resource execution
  and state modules explicit access to the managing minion's loader
  when they need to do something on the host.
- New operator runners: `salt-run resource.list_grains`,
  `salt-run resource.show_grains`, `salt-run resource.refresh`.
- New `salt-call` flags `-r/--resources`, `--tgt`, and `--tgt-type`
  make resource dispatch available from masterless and local
  troubleshooting workflows.

Two reference resource types ship with Salt: `dummy`
(filesystem-backed, for tests and tutorials) and `ssh` (over the salt-ssh
transport). Extension authors can ship their own resource types via a
standard `salt.loader` entry point — no core changes required.

See the [Salt Resources documentation](../resources/index) for the
conceptual overview, the [tutorial](../resources/tutorial) for a
10-minute walk-through, and the [authoring
guide](../resources/authoring/index) for shipping your own resource
type.

<!--
Do not edit the changelog below.
This is auto generated.
-->
## Changelog

### Removed

- Remove commuity extensions from Salt codebase [#65970](https://github.com/saltstack/salt/issues/65970)
- Remove deprecated module search path priority (`features.enable_deprecated_module_search_path_priority`) [#66025](https://github.com/saltstack/salt/issues/66025)
- Remove the __orchestration__ key from salt.runner and salt.wheel return data. [#66151](https://github.com/saltstack/salt/issues/66151)
- Removed linode-python package dependency for retired Linode API v3 [#68871](https://github.com/saltstack/salt/issues/68871)
- Removed legacy ``salt.transport.ipc`` module and unused ``PushChannel`` / ``PullChannel`` factories; local events use ``ipc_publish_client`` / ``ipc_publish_server`` (TCP transport). [#69001](https://github.com/saltstack/salt/issues/69001)


### Deprecated

- Deprecated the use of egrep in favor of grep -E [#65608](https://github.com/saltstack/salt/issues/65608)


### Changed

- Make sure every auth event has the 'act' key set [#56200](https://github.com/saltstack/salt/issues/56200)
- Ansiblegate discover_playbooks was changed to find playbooks as either *.yml or *.yaml files [#66048](https://github.com/saltstack/salt/issues/66048)
- re-work the aptpkg module to remove system libraries that onedir and virtualenvs do not have access. Streamline testing, and code use to needed libraries only. [#66056](https://github.com/saltstack/salt/issues/66056)
- Made gpg modules respect user's GNUPGHOME if set in shell environment [#66313](https://github.com/saltstack/salt/issues/66313)
- Made `gpg.present` attempt to refresh keys if they are expired [#66314](https://github.com/saltstack/salt/issues/66314)
- Made x509_v2 the default x509 modules. Until they are removed in the next major release, you can still revert to the old modules by setting `features: {x509_v2: false}` in the configuration [#66384](https://github.com/saltstack/salt/issues/66384)
- Included Salt extensions in Salt-SSH thin archive [#66559](https://github.com/saltstack/salt/issues/66559)
- Add support for additional options in several mac_brew_pkg methods [#66611](https://github.com/saltstack/salt/issues/66611)
- Make test_pip and test_fileserver tests compatible with venv execution [#66703](https://github.com/saltstack/salt/issues/66703)
- Do not use `ssl.PROTOCOL_TLS` which has been [#66767](https://github.com/saltstack/salt/issues/66767)
- [deprecated](https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLS) in [#66767](https://github.com/saltstack/salt/issues/66767)
- Python 3.10 will be removed in the future. [#66767](https://github.com/saltstack/salt/issues/66767)
- Remove warning when running `slsutil.renderer` on non-SLS files [#67067](https://github.com/saltstack/salt/issues/67067)
- PillarCache: reimplement using salt.cache [#68030](https://github.com/saltstack/salt/issues/68030)
- fix minion data cache organization/move pillar and grains to dedicated cache banks [#68030](https://github.com/saltstack/salt/issues/68030)
- salt.cache: allow cache.store() to set expires per key [#68030](https://github.com/saltstack/salt/issues/68030)
- Provide token storage using the salt.cache interface [#68039](https://github.com/saltstack/salt/issues/68039)
- Update packaged python from 3.10 to 3.11 [#68148](https://github.com/saltstack/salt/issues/68148)
- Added ceph to the specialFSes to match on name for set_fstab [#68207](https://github.com/saltstack/salt/issues/68207)
- Removed `networkx` module dependency by adding MultiDiGraph implementation to `salt.utils.requisite` to avoid extra dependencies. [#68748](https://github.com/saltstack/salt/issues/68748)
- Expanded Thorium documentation with concrete examples and added unit coverage for the documented Thorium workflows. [#68857](https://github.com/saltstack/salt/issues/68857)
- Add stub 3008.0 release notes (and template) so ``tools docs man`` and CI ``prepare-release`` can resolve the current-release doc target.  Exclude ``doc/topics/proposals/*.md`` from Sphinx so stand-alone proposal files do not fail strict man builds. [#68964](https://github.com/saltstack/salt/issues/68964)


### Fixed

- Fixed recursive prereq requisites to report recursive requisite error. [#8210](https://github.com/saltstack/salt/issues/8210)
- Fixed erroneous recursive requisite error when a prereq is used in combination with onchanges_any. [#47154](https://github.com/saltstack/salt/issues/47154)
- Fixed an infinite loop in `requisite_any` when a requisite state was not found. [#50436](https://github.com/saltstack/salt/issues/50436)
- Refactoring the redis code obsoletes this issue as return values are either decoded directly or passed to salt.payload for parsing. [#54734](https://github.com/saltstack/salt/issues/54734)
- Fixed `OSError: The operation completed successfully` raised by `CreateProcessWithTokenW` on Windows when the underlying advapi32 call fails. The error code is now read from `ctypes.get_last_error()` (the ctypes-saved slot) instead of `win32api.GetLastError()` (the live Windows slot, which may be reset to 0 before it is read). [#57848](https://github.com/saltstack/salt/issues/57848)
- Fixed dependency resolution to not be quadratic. [#59123](https://github.com/saltstack/salt/issues/59123)
- Fix regex cache exception during sort in sweep function [#59437](https://github.com/saltstack/salt/issues/59437)
- Fixed requisites by parallel states on parallel states being evaluated synchronously (blocking state execution for other parallel states) [#59959](https://github.com/saltstack/salt/issues/59959)
- Fix bug when specifying template_source using net.load_template [#60515](https://github.com/saltstack/salt/issues/60515)
- During the redis refactor the documentation was updated to reference the Redis Cluster pip package. [#60899](https://github.com/saltstack/salt/issues/60899), [#66193](https://github.com/saltstack/salt/issues/66193)
- firewalld: normalize new rich rules before comparing to old ones [#61235](https://github.com/saltstack/salt/issues/61235)
- Fix regression that prevented salt-minion from running interval-based jobs on startup by default. [#61964](https://github.com/saltstack/salt/issues/61964)
- Fixed performance when state_aggregate is enabled. [#62439](https://github.com/saltstack/salt/issues/62439)
- Fixed LGPO ``get_policy_info`` incorrectly returning a "multiple policies" error when duplicate ADMX policy definitions (e.g. ``TerminalServer.admx`` and ``TerminalServer-Server.admx``) resolve to the same full path. [#62732](https://github.com/saltstack/salt/issues/62732)
- Fixed issue with salt-ssh hanging due to non-exposed host key acceptance prompt [#62782](https://github.com/saltstack/salt/issues/62782)
- Repaired zypper repositories being reconfigured without changes [#63402](https://github.com/saltstack/salt/issues/63402)
- Fix calculation of SLS context vars when trailing dots on targetted state [#63411](https://github.com/saltstack/salt/issues/63411)
- Catch StrictUndefined in salt jinja custom filters. [#64915](https://github.com/saltstack/salt/issues/64915)
- Put default `optimization_order` to LazyLoader to prevent possible fails on testing [#65266](https://github.com/saltstack/salt/issues/65266)
- Fixed aggregation to correctly honor requisites. [#65304](https://github.com/saltstack/salt/issues/65304)
- Fixed some instances of deprecated datetime.datetime.utcnow() [#65604](https://github.com/saltstack/salt/issues/65604)
- Introduce pruning option in file.keyvalue [#65631](https://github.com/saltstack/salt/issues/65631)
- fix 65703 by using OrderedDict instead of a index that breaks. . [#65703](https://github.com/saltstack/salt/issues/65703)
- Simplify timezone.compare_zone to primarily rely get_zone() [#65719](https://github.com/saltstack/salt/issues/65719)
- Handle regular expressions which do not not use grouping [#65722](https://github.com/saltstack/salt/issues/65722)
- fix consul.acl_create rule creation [#65788](https://github.com/saltstack/salt/issues/65788)
- Fix salt-cloud get_cloud_config_value for list objects [#65789](https://github.com/saltstack/salt/issues/65789)
- Prevent exceptions with fileserver.update when called via state [#65819](https://github.com/saltstack/salt/issues/65819)
- Fix granting of privileges on Postgres functions [#65839](https://github.com/saltstack/salt/issues/65839)
- Made Salt Cloud Hetzner module detect image architecture from instance type [#65888](https://github.com/saltstack/salt/issues/65888)
- Optimize async calls with using async wrapped method in thread only if io loop is already running [#65983](https://github.com/saltstack/salt/issues/65983)
- salt.auth.pam: fallback to use running Python in case /usr/bin/python3 is not found [#66035](https://github.com/saltstack/salt/issues/66035)
- Fix file.is_link hangs on paths that are hung mounts [#66096](https://github.com/saltstack/salt/issues/66096)
- Fix file.managed and file.serialize default tmp_dir to relative path [#66098](https://github.com/saltstack/salt/issues/66098)
- Make win_timezone recognize Qyzylorda timezone [#66176](https://github.com/saltstack/salt/issues/66176)
- Remove firing useless events with JID as a tag [#66279](https://github.com/saltstack/salt/issues/66279)
- Made gpg modules create GNUPGHOME if it does not exist [#66312](https://github.com/saltstack/salt/issues/66312)
- Fixed an issue where conflicting top level keys in the static grains file [#66445](https://github.com/saltstack/salt/issues/66445)
- (usually `/etc/salt/grains`) would break all grains states, and prevent static [#66445](https://github.com/saltstack/salt/issues/66445)
- grains from being loaded. [#66445](https://github.com/saltstack/salt/issues/66445)
- Fixed beacon delete not calling the beacon's close function, causing resource [#66449](https://github.com/saltstack/salt/issues/66449)
- leaks (e.g. inotify file descriptors) and CPU spin after deleting beacons at [#66449](https://github.com/saltstack/salt/issues/66449)
- runtime via ``beacons.delete``. Also fixed inotify file descriptor leak during [#66449](https://github.com/saltstack/salt/issues/66449)
- beacon refresh when the Beacon instance is replaced. [#66449](https://github.com/saltstack/salt/issues/66449)
- Fixed a regression where setting ``ipv6: true`` in the minion configuration [#66603](https://github.com/saltstack/salt/issues/66603)
- caused the minion to fail to start on Windows. Three IPC socket paths in the [#66603](https://github.com/saltstack/salt/issues/66603)
- TCP transport hardcoded ``AF_INET`` or ``127.0.0.1`` regardless of the IPv6 [#66603](https://github.com/saltstack/salt/issues/66603)
- setting: the IPC publish server/client addresses in ``salt.transport.base``, [#66603](https://github.com/saltstack/salt/issues/66603)
- the ``TCPPuller`` server socket, and the ``_TCPPubServerPublisher`` client [#66603](https://github.com/saltstack/salt/issues/66603)
- socket. On Windows, mixing an ``AF_INET6`` socket with the IPv4 loopback [#66603](https://github.com/saltstack/salt/issues/66603)
- address (or vice-versa) is rejected by the OS. All three paths now use [#66603](https://github.com/saltstack/salt/issues/66603)
- ``::1`` with ``AF_INET6`` when ``ipv6: true`` is set, and ``127.0.0.1`` [#66603](https://github.com/saltstack/salt/issues/66603)
- with ``AF_INET`` otherwise. [#66603](https://github.com/saltstack/salt/issues/66603)
- Make "status.diskusage" more robust and prevent crashes when stats cannot be obtained [#66646](https://github.com/saltstack/salt/issues/66646)
- Use `--cachedir` parameter for setting `extension_modules` with salt-call. [#66742](https://github.com/saltstack/salt/issues/66742)
- Don't schedule `__master_alive` jobs if `master_alive_interval` is not specified [#66757](https://github.com/saltstack/salt/issues/66757)
- Make x509 module compatible with `cryptography` module newer than `43.0.0` [#66818](https://github.com/saltstack/salt/issues/66818)
- Fixed Python 3.13 compatibility regarding urllib.parse module [#66898](https://github.com/saltstack/salt/issues/66898)
- make salt.channel.server.handle_message codepath more defensive [#66909](https://github.com/saltstack/salt/issues/66909)
- Fix the installation of pip modules with special characters in the module name [#66988](https://github.com/saltstack/salt/issues/66988)
- Repaired mount.fstab_present always returning pending changes [#67065](https://github.com/saltstack/salt/issues/67065)
- dictupdate.update: throw a TypeError when trying to merge a list with a mapping when ``merge_lists=True``. [#67092](https://github.com/saltstack/salt/issues/67092)
- Remove usage of spwd [#67119](https://github.com/saltstack/salt/issues/67119)
- Fixed order chunks not handling a state with both require and order first or last [#67120](https://github.com/saltstack/salt/issues/67120)
- Fixed pkg.install in test mode would not detect FreeBSD packages installed by their origin name [#67126](https://github.com/saltstack/salt/issues/67126)
- Fix virtual grains for VMs running on Nutanix AHV [#67180](https://github.com/saltstack/salt/issues/67180)
- The redis refactor fixed the incorrect handling of the cache.list function. [#67250](https://github.com/saltstack/salt/issues/67250)
- Fixed creating relative directory symlinks on Windows, ensured listing targets of symlinks in file_roots always produces POSIX-style paths [#67766](https://github.com/saltstack/salt/issues/67766)
- Avoid loading `salt.utils.crypt` module instead of `crypt` if it's missing in Python as it was deprecated and removed in Python 3.13. [#67797](https://github.com/saltstack/salt/issues/67797)
- Fixed docstring error in salt/modules/file.py that misnamed an option "user" when it should have been "owner". [#67911](https://github.com/saltstack/salt/issues/67911)
- salt.key: check_minion_cache performance optimization [#68030](https://github.com/saltstack/salt/issues/68030)
- when a file is managed, and the same file is cleaned, an incorrect message is displayed saying "removed: Removed due to clean" when the file isn't actually removed. Now the correct message is returned. [#68052](https://github.com/saltstack/salt/issues/68052)
- log_beacon - remove verbose minion log output [#68055](https://github.com/saltstack/salt/issues/68055)
- Fix that the state `saltmod.state` can be used on a masterless minion with salt-ssh like `saltmod.function` currently does. [#68116](https://github.com/saltstack/salt/issues/68116)
- Fixed ssh_known_hosts.present failure when ssh host keys changed [#68132](https://github.com/saltstack/salt/issues/68132)
- grains.disks: fix exception with incompatible output of Get-PhysicalDisk [#68184](https://github.com/saltstack/salt/issues/68184)
- Made osfinger report major&minor version for NixOS [#68230](https://github.com/saltstack/salt/issues/68230)
- Fix tests failing on AlmaLinux 10 and other clones [#68246](https://github.com/saltstack/salt/issues/68246)
- Speedup wheel key.finger call by removing redundant processing calls. [#68251](https://github.com/saltstack/salt/issues/68251)
- Fixed cp.cache_file when using Tornado > 6.4 [#68328](https://github.com/saltstack/salt/issues/68328)
- Stop mutating locals, which is unsupported in Py >=3.13 [#68445](https://github.com/saltstack/salt/issues/68445)
- Add `blockdev` state module back in to core [#68465](https://github.com/saltstack/salt/issues/68465)
-  [#68465](https://github.com/saltstack/salt/issues/68465)
- Adds the `blockdev` state module back into the core Salt repo as it is critical functionality that shouldn't have been pulled out in the module migration [#68465](https://github.com/saltstack/salt/issues/68465)
- Adds `mdadm` and `lvm` grains modules back in to core. [#68470](https://github.com/saltstack/salt/issues/68470)
-  [#68470](https://github.com/saltstack/salt/issues/68470)
- Restores the modules that had been removed as part of the community module [#68470](https://github.com/saltstack/salt/issues/68470)
- migration. They are core bits of functionality and the associated execution and [#68470](https://github.com/saltstack/salt/issues/68470)
- states modules had not been removed. [#68470](https://github.com/saltstack/salt/issues/68470)
- Fixed grains.list_present state to correctly handle multiple calls within the same state run. [#68520](https://github.com/saltstack/salt/issues/68520)
- Fixed `salt.utils.platform` to properly handle `__salt_system_encoding__` when synced as an extension module. [#68520](https://github.com/saltstack/salt/issues/68520)
- Improved `network.traceroute` parsing to be more robust across different traceroute versions. [#68520](https://github.com/saltstack/salt/issues/68520)
- Added retry logic to `saltutil.wheel` integration test to improve reliability in CI. [#68520](https://github.com/saltstack/salt/issues/68520)
- Improved architecture detection in `salt-ssh` to better support ARM64 platforms. [#68520](https://github.com/saltstack/salt/issues/68520)
- Fixed `salt-ssh` extension module syncing to avoid accidentally bundling core Salt modules and to correctly load wrapper modules. [#68520](https://github.com/saltstack/salt/issues/68520)
- Ensured `salt-ssh` relenv tests skip gracefully if the relenv tarball is unavailable in the test environment. [#68520](https://github.com/saltstack/salt/issues/68520)
- Fixed `mine.get` runner to correctly handle master's ID when ACLs are enabled. [#68520](https://github.com/saltstack/salt/issues/68520)
- Fixed `win_useradd.get_user_sid` to correctly handle non-string input. [#68520](https://github.com/saltstack/salt/issues/68520)
- Improved reliability of `state.running` integration test for `salt-ssh`. [#68520](https://github.com/saltstack/salt/issues/68520)
- Fixed high CPU usage in minion asynchronous authentication loop when masters are unreachable. [#68520](https://github.com/saltstack/salt/issues/68520)
- Added support for running Salt tools using `python -m tools`. [#68520](https://github.com/saltstack/salt/issues/68520)
- Adds `alias` state module back in to core. [#68574](https://github.com/saltstack/salt/issues/68574)
-  [#68574](https://github.com/saltstack/salt/issues/68574)
- Restores the module that had been removed as part of the [#68574](https://github.com/saltstack/salt/issues/68574)
- community module migration. The associated execution module [#68574](https://github.com/saltstack/salt/issues/68574)
- had not been migrated. [#68574](https://github.com/saltstack/salt/issues/68574)
- Fixed mongodb tops module authentication to be compatible with pymongo v4+ by passing credentials directly to MongoClient instead of using the deprecated authenticate() method [#68659](https://github.com/saltstack/salt/issues/68659)
- Improved the rejected authentication warning message to include the minion ID, [#68671](https://github.com/saltstack/salt/issues/68671)
- making it easier for administrators to identify which minions need upgrading. [#68671](https://github.com/saltstack/salt/issues/68671)
- This PR fixes a bug where corrupted grains cache files cause unhandled [#68678](https://github.com/saltstack/salt/issues/68678)
- `SaltDeserializationError` exceptions, resulting in CRITICAL errors. [#68678](https://github.com/saltstack/salt/issues/68678)
- The fix adds proper exception handling to gracefully recover from corrupted [#68678](https://github.com/saltstack/salt/issues/68678)
- cache by regenerating grains. [#68678](https://github.com/saltstack/salt/issues/68678)
- Fix ansible.playbooks extra_vars quoting to prevent passing broken variables to ansible-playbook. [#68787](https://github.com/saltstack/salt/issues/68787)
- Make `x86_64_v2` to be handled properly with `salt.modules.yumpkg` module as a possible package architecture. [#68789](https://github.com/saltstack/salt/issues/68789)
- Make `salt-ssh` work without issues using `domain\user` notation for remote user with SSH. [#68790](https://github.com/saltstack/salt/issues/68790)
- Fixed source package builds (DEB/RPM) failing with ``LookupError: hatchling is already being built`` by adding ``hatchling`` to the ``--only-binary`` allow-list so pip uses its universal wheel instead of attempting a circular source build. [#68858](https://github.com/saltstack/salt/issues/68858)
- Use a 30 second ``salt`` CLI timeout in the reauth scenario tests so Windows CI does not time out on ``test.ping`` after master/minion restart (default was often 5s). [#68924](https://github.com/saltstack/salt/issues/68924)
- Fix logging in potentially dead process in reap_stray_processes fixture [#68927](https://github.com/saltstack/salt/issues/68927)
- Fix dynamic version discovery on a new release branch before the first ``v<major>*`` tag exists: ``git describe`` still anchored on the previous line (e.g. ``v3007.13``) is lifted to the unreleased codename baseline (e.g. ``3008.0``) while keeping the commit offset and SHA. [#68964](https://github.com/saltstack/salt/issues/68964)
- Remove deprecations. [#68985](https://github.com/saltstack/salt/issues/68985)
- - salt/auth/pki.py (removed) [#68985](https://github.com/saltstack/salt/issues/68985)
- - salt/features.py (removed) [#68985](https://github.com/saltstack/salt/issues/68985)
- - salt/modules/nxos.py (modified) [#68985](https://github.com/saltstack/salt/issues/68985)
- debpkg include 0/1 as valid options when parsing bool values in deb822 [#68996](https://github.com/saltstack/salt/issues/68996)
- Drain cancelled tasks on PublishClient close so the TCP transport no longer prints `[ERROR ] Task was destroyed but it is pending!` at the end of every salt command. [#68998](https://github.com/saltstack/salt/issues/68998)
- Upgrade packaged python to 3.14 [#69014](https://github.com/saltstack/salt/issues/69014)
- ``LoadAuth.get_tok`` now distinguishes between corrupt token blobs (removed from the store) and transient backend errors such as Redis connection drops or NFS hangs (token kept, request treated as not-authenticated). Previously a single backend hiccup could log every authenticated user out by deleting valid tokens. [#69073](https://github.com/saltstack/salt/issues/69073)
- Fix pip install -e salt [#69101](https://github.com/saltstack/salt/issues/69101)
- * Relenv 0.22.11 [#69129](https://github.com/saltstack/salt/issues/69129)
- - Update python 3.14 to 3.14.5 [#69129](https://github.com/saltstack/salt/issues/69129)
- - Update sqlite to 3.53.1.0 (CVE-2025-70873) [#69129](https://github.com/saltstack/salt/issues/69129)
- - Update expat to 2.8.1 (CVE-2026-41080 and CVE-2026-45186) [#69129](https://github.com/saltstack/salt/issues/69129)
- Fix master crash when `presence_events: True` is set on Python 3.14 by skipping the shared `secrets` dict during `iter_transport_opts` deepcopy. [#69146](https://github.com/saltstack/salt/issues/69146)
- Fixed ``lgpo_reg.value_absent`` failing when the Registry.pol entry was already absent but the registry value still existed. ``lgpo_reg.delete_value`` was returning early before reaching the registry cleanup code, causing the state to see no changes and report failure. The registry value is now removed regardless of whether the pol entry was present. [#69203](https://github.com/saltstack/salt/issues/69203)
- Fixed `!!binary` YAML tag failing with "Incorrect padding" when base64 padding characters are omitted. Salt's YAML loader now tolerates unpadded base64 values, restoring behavior that worked on Salt 3006 (Python 3.10). [#69207](https://github.com/saltstack/salt/issues/69207)
- Fixed the ``yaml`` Jinja filter returning ``NULL`` when applied to Pillar [#69218](https://github.com/saltstack/salt/issues/69218)
- lists or dicts. Pillar containers are wrapped in ``MaskedDict`` / [#69218](https://github.com/saltstack/salt/issues/69218)
- ``MaskedList`` for repr redaction; representers are now registered so the [#69218](https://github.com/saltstack/salt/issues/69218)
- YAML dumper serializes them as their underlying list / dict. [#69218](https://github.com/saltstack/salt/issues/69218)


### Added

- Added proxy option to `gitfs`, `git_pillar` and `winrepo` for specifying a proxy server used to connect to git repositories [#30990](https://github.com/saltstack/salt/issues/30990)
- Added ``shadow.verify_password`` to ``salt.modules.win_shadow``, which [#41347](https://github.com/saltstack/salt/issues/41347)
- validates a Windows user's password via ``LogonUser`` with [#41347](https://github.com/saltstack/salt/issues/41347)
- ``LOGON32_LOGON_NETWORK`` (Microsoft's recommended approach per [#41347](https://github.com/saltstack/salt/issues/41347)
- `KB180548 <https://support.microsoft.com/en-us/help/180548>`_) without [#41347](https://github.com/saltstack/salt/issues/41347)
- creating an interactive session. If the check causes an account lockout, [#41347](https://github.com/saltstack/salt/issues/41347)
- the account is automatically unlocked. Updated ``user.present`` on Windows [#41347](https://github.com/saltstack/salt/issues/41347)
- to use ``shadow.verify_password`` so the password is only changed when it [#41347](https://github.com/saltstack/salt/issues/41347)
- differs from the current value, matching the idempotent behaviour on other [#41347](https://github.com/saltstack/salt/issues/41347)
- platforms. [#41347](https://github.com/saltstack/salt/issues/41347)
- Added support for limiting the number of parallel states executing at the same time via `state_max_parallel` [#49301](https://github.com/saltstack/salt/issues/49301)
- Added metalink to mod_repo in yumpkg and documented in pkgrepo state [#58931](https://github.com/saltstack/salt/issues/58931)
- Add 'show_changes' arg for file.append and file.prepend states to hide output [#59329](https://github.com/saltstack/salt/issues/59329)
- Added ssl and verify_ssl arguments to mongodb module and states. [#59927](https://github.com/saltstack/salt/issues/59927)
- Added two new options, ``win_delay_start`` and ``win_install_dir``, to pass to [#61318](https://github.com/saltstack/salt/issues/61318)
- the Windows installer in salt-cloud [#61318](https://github.com/saltstack/salt/issues/61318)
- Add context aware change handling for file state module [#63328](https://github.com/saltstack/salt/issues/63328)
- Added the ability to access already compiled pillar data during the pillar rendering process via the `__pillar__` global in templates and matchers. [#64043](https://github.com/saltstack/salt/issues/64043)
- Allow salt-call arguments --file-root, --pillar-root and --states-dir to be specified multiple times [#64486](https://github.com/saltstack/salt/issues/64486)
- Adds documentation notes to clarify that Salt's file module only supports numeric mode specifications and does not support symbolic modes. [#64624](https://github.com/saltstack/salt/issues/64624)
- Added management of SSH keys and certificates [#65197](https://github.com/saltstack/salt/issues/65197)
- Add option (auth_events_autosign_grains) to add autosign_grains to auth events [#65426](https://github.com/saltstack/salt/issues/65426)
- Added `use_os_truststore` configuration option (default `False`) that instructs Salt to use the native operating system certificate store (Windows Certificate Store, macOS Keychain, or Linux system trust) for SSL/TLS verification instead of the bundled certifi CA bundle. Requires the `truststore` package (Python 3.10+). Also adds the `ca_truststore` grain that reports which store is active (`certifi` or `os`). [#65439](https://github.com/saltstack/salt/issues/65439)
- Enable "KeepAlive" probes for Salt SSH executions [#65488](https://github.com/saltstack/salt/issues/65488)
- Add ability to show diff for new files in file.managed [#65546](https://github.com/saltstack/salt/issues/65546)
- Added Virtuozzo Linux to Redhat os_family [#65600](https://github.com/saltstack/salt/issues/65600)
- Pillar dunder is now available in extension modules during pillar render. [#65724](https://github.com/saltstack/salt/issues/65724)
- Added x509_v2 SSH wrapper module. In addition to the regular calls, it provides a function for statefully managing remote certificates, even when access to the event bus is required [#65728](https://github.com/saltstack/salt/issues/65728)
- Introduce fibre_channel_host grain [#65750](https://github.com/saltstack/salt/issues/65750)
- Make `salt-run jobs.master` return runner jobs that are currently running on a master. [#66007](https://github.com/saltstack/salt/issues/66007)
- Added file and plaintext sources to `gpg.present`, allowed to skip keyserver queries [#66173](https://github.com/saltstack/salt/issues/66173)
- added pkg.which to aptpkg, for finding which package installed a file. [#66201](https://github.com/saltstack/salt/issues/66201)
- Allow pre-connection scripts to be run on host before any ssh commands [#66210](https://github.com/saltstack/salt/issues/66210)
- Added port, tls, username and password to the `smtp` configuration of the highstate returner. [#66251](https://github.com/saltstack/salt/issues/66251)
- Improve macOS defaults support [#66466](https://github.com/saltstack/salt/issues/66466)
- Added support for specifying different signature verification backends in `file.managed`/`archive.extracted` [#66527](https://github.com/saltstack/salt/issues/66527)
- Added an `asymmetric` execution module for signing/verifying data using raw asymmetric algorithms [#66528](https://github.com/saltstack/salt/issues/66528)
- Added support in service Beacon for only fire matching configured running state [#66809](https://github.com/saltstack/salt/issues/66809)
- Add --relenv Option to salt-ssh for Using a Onedir Bundled Salt+Python [#66877](https://github.com/saltstack/salt/issues/66877)
- Add support for state.sls_exists when using salt-ssh [#66894](https://github.com/saltstack/salt/issues/66894)
- Add detection for OS grains when running in [AlmaLinux Kitten](https://wiki.almalinux.org/release-notes/kitten-10.html) [#66991](https://github.com/saltstack/salt/issues/66991)
- Added a `merge` option to `file.recurse`, which merges subpaths from all existing `source`s before managing the directory. Handy when using different saltenvs or the TOFS pattern. [#67072](https://github.com/saltstack/salt/issues/67072)
- Add `_auth` calls to the master stats [#67746](https://github.com/saltstack/salt/issues/67746)
- Added possibility to load data from multiple inventories with `ansible.targets`. [#67776](https://github.com/saltstack/salt/issues/67776)
- Detect openEuler as RedHat family OS. [#67796](https://github.com/saltstack/salt/issues/67796)
- refactored server-side PKI to support cache interface [#67799](https://github.com/saltstack/salt/issues/67799)
- optimization: check_compound_minions: defer _pki_minions fetch [#67799](https://github.com/saltstack/salt/issues/67799)
- refactor: push salt.utils.minions bits into salt.key / optimize matching [#67799](https://github.com/saltstack/salt/issues/67799)
- Add deb822 apt source format support to aptpkg module [#67956](https://github.com/saltstack/salt/issues/67956)
- Add subsystem filter to "udev.exportdb" execution module function [#68047](https://github.com/saltstack/salt/issues/68047)
- Implement SL Micro 6.2 detection to fill the grains with proper values. [#68247](https://github.com/saltstack/salt/issues/68247)
- Added booleans argument to selinux.booleans [#68323](https://github.com/saltstack/salt/issues/68323)
- Added mod_aggregate to selinux to combine boolean [#68323](https://github.com/saltstack/salt/issues/68323)
- Added some type hints to selinux module and made some minor changes to improve readability and performance slightly [#68323](https://github.com/saltstack/salt/issues/68323)
- Add support for minion_id in log formats [#68410](https://github.com/saltstack/salt/issues/68410)
-  [#68410](https://github.com/saltstack/salt/issues/68410)
- Adds support for including `%(minion_id)s` in log formats. Where id is available log messages on the master will have that data added to allow easier correlation of messages to minions. [#68410](https://github.com/saltstack/salt/issues/68410)
- Added feature parity for relenv and thin dir with salt-ssh. All salt-ssh tests pass with both thin dir and relenv. [#68531](https://github.com/saltstack/salt/issues/68531)
- Added tunable worker pools: partition the master's MWorkers into named pools [#68532](https://github.com/saltstack/salt/issues/68532)
- and route specific commands (for example `_auth`) to dedicated pools so a [#68532](https://github.com/saltstack/salt/issues/68532)
- slow workload cannot starve time-critical traffic. Controlled by the new [#68532](https://github.com/saltstack/salt/issues/68532)
- `worker_pools` and `worker_pools_enabled` master settings; see the "Tunable [#68532](https://github.com/saltstack/salt/issues/68532)
- Worker Pools" topic guide for details. Existing `worker_threads` [#68532](https://github.com/saltstack/salt/issues/68532)
- configurations remain fully backward compatible. [#68532](https://github.com/saltstack/salt/issues/68532)
- Added TLS encryption optimization via disable_aes_with_tls config option that eliminates redundant AES encryption when TLS with mutual authentication is active, improving performance while maintaining security through certificate identity verification. [#68536](https://github.com/saltstack/salt/issues/68536)
- utils.dictdiffer: support diffing of dicts in lists [#68726](https://github.com/saltstack/salt/issues/68726)
- Add support for nix package manager. [#68752](https://github.com/saltstack/salt/issues/68752)
- Added a centralized, declarative system for managing Salt's optional dependencies and their version-specific requirements in ``salt/utils/versions.py``. [#68894](https://github.com/saltstack/salt/issues/68894)
- Pillar data is now wrapped in SafeDict/SafeList with Pydantic SecretStr/SecretBytes for safer logging and output; optional state `no_log` and automatic redaction of pillar literals in state returns and minion job logs. [#68907](https://github.com/saltstack/salt/issues/68907)
- Added a fast memory-mapped cache backend (``salt.cache.mmap_cache``): [#68936](https://github.com/saltstack/salt/issues/68936)
- an O(1) hash-table store with a segmented heap, durable and multi-process [#68936](https://github.com/saltstack/salt/issues/68936)
- safe, usable as a drop-in for ``localfs`` via the ``cache`` master setting. [#68936](https://github.com/saltstack/salt/issues/68936)
- A specialised variant (``salt.cache.mmap_key``) replaces linear ``pki_dir`` [#68936](https://github.com/saltstack/salt/issues/68936)
- scans for the master's minion-key store; select it with [#68936](https://github.com/saltstack/salt/issues/68936)
- ``keys.cache_driver: mmap_key``. Migrate existing data with [#68936](https://github.com/saltstack/salt/issues/68936)
- ``salt-run cache.migrate`` and ``salt-run pki.migrate_to_mmap``. [#68936](https://github.com/saltstack/salt/issues/68936)
- Batch mode now uses a single JID for the entire batch run instead of generating [#68941](https://github.com/saltstack/salt/issues/68941)
- a separate JID per batch iteration. This enables unified job tracking via [#68941](https://github.com/saltstack/salt/issues/68941)
- ``salt-run jobs.lookup_jid`` and consistent ``--show-jid`` output across all [#68941](https://github.com/saltstack/salt/issues/68941)
- batch slices. The job cache merges minion lists from each iteration so that [#68941](https://github.com/saltstack/salt/issues/68941)
- ``get_load`` returns the complete set of targeted minions. [#68941](https://github.com/saltstack/salt/issues/68941)
- Added OpenTelemetry distributed-tracing support across all Salt [#68999](https://github.com/saltstack/salt/issues/68999)
- inter-process hops (network and IPC).  When `tracing.enabled` is true in the [#68999](https://github.com/saltstack/salt/issues/68999)
- master/minion config, salt emits W3C-TraceContext-propagated spans via an [#68999](https://github.com/saltstack/salt/issues/68999)
- OTLP exporter, covering the CLI, channel layer, master workers, minion [#68999](https://github.com/saltstack/salt/issues/68999)
- command execution, event bus, reactor, syndic forwarding, salt-ssh, and [#68999](https://github.com/saltstack/salt/issues/68999)
- salt-api.  Trace context travels inside the AES-encrypted Salt envelope so [#68999](https://github.com/saltstack/salt/issues/68999)
- it remains opaque on the wire.  Tracing is opt-in and a complete no-op when [#68999](https://github.com/saltstack/salt/issues/68999)
- disabled. [#68999](https://github.com/saltstack/salt/issues/68999)
- Added a per-job ``start_event`` opt-in (CLI flag ``--start-event``) that asks [#69019](https://github.com/saltstack/salt/issues/69019)
- targeted minions to fire a ``salt/job/<jid>/start/<minion_id>`` event the [#69019](https://github.com/saltstack/salt/issues/69019)
- moment they accept the published job, before the function runs. The payload [#69019](https://github.com/saltstack/salt/issues/69019)
- mirrors the master's ``salt/job/<jid>/new`` event minus the function [#69019](https://github.com/saltstack/salt/issues/69019)
- arguments, letting orchestrators confirm reachability without waiting for [#69019](https://github.com/saltstack/salt/issues/69019)
- the full return. [#69019](https://github.com/saltstack/salt/issues/69019)
- Added `state.graph` and `state.graph_highstate` execution modules and runners to generate a DOT representation of the state dependency graph. [#69091](https://github.com/saltstack/salt/issues/69091)
- Migrate Salt documentation to the PyData Sphinx theme. This update modernizes the documentation UI, improves navigation with a persistent sidebar tree, and fixes issues with embedded video playback. [#69185](https://github.com/saltstack/salt/issues/69185)
- Added OpenTelemetry metrics support alongside the existing tracing [#69200](https://github.com/saltstack/salt/issues/69200)
- integration.  When ``metrics.enabled`` is true in the master/minion [#69200](https://github.com/saltstack/salt/issues/69200)
- config, salt daemons emit counters (``salt.jobs.published``, [#69200](https://github.com/saltstack/salt/issues/69200)
- ``salt.jobs.completed``, ``salt.auth.attempts``, ``salt.events.fired``, [#69200](https://github.com/saltstack/salt/issues/69200)
- ``salt.returners.calls``), histograms (``salt.job.duration``, [#69200](https://github.com/saltstack/salt/issues/69200)
- ``salt.minion.exec.duration``), and observable gauges [#69200](https://github.com/saltstack/salt/issues/69200)
- (``salt.master.connected_minions.count``, [#69200](https://github.com/saltstack/salt/issues/69200)
- ``salt.master.workers.queue.depth``, ``salt.process.open_fds``) via [#69200](https://github.com/saltstack/salt/issues/69200)
- OTLP push or a Prometheus pull endpoint.  Metrics are opt-in and a [#69200](https://github.com/saltstack/salt/issues/69200)
- complete no-op when disabled.  See ``doc/topics/metrics/index.rst`` [#69200](https://github.com/saltstack/salt/issues/69200)
- for the full configuration surface and instrument inventory. [#69200](https://github.com/saltstack/salt/issues/69200)
- Restore the ``pillarstack`` ext_pillar module (``salt.pillar.stack``) that was [#69201](https://github.com/saltstack/salt/issues/69201)
- removed when community extensions were purged. The module is reinstated as a [#69201](https://github.com/saltstack/salt/issues/69201)
- core ext_pillar so existing PillarStack-based pillar trees continue to work on [#69201](https://github.com/saltstack/salt/issues/69201)
- 3008.x. [#69201](https://github.com/saltstack/salt/issues/69201)
- Added ``lgpo_reg.get_rsop_value`` to query the Resultant Set of Policy (RSoP) for a registry key/value and detect whether it is managed by a Domain Group Policy Object. The ``lgpo_reg`` module functions ``set_value``, ``disable_value``, and ``delete_value`` now log a warning when a Domain GPO is detected for the target value. The ``lgpo_reg`` state functions ``value_present``, ``value_disabled``, and ``value_absent`` append the same warning to the state comment so it is visible in state output. [#69205](https://github.com/saltstack/salt/issues/69205)
