Chapter?6.?New features and enhancements

• Set all values during the installation process.
• Enable the unattended = true field in Kickstart to get a fully unattended installation.
• Inject your own Kickstart by using the Kickstart field.

• Added support for Initial Device Identity (IDevID) and Initial Attestation Key (IAK) for device identity. The following configuration options have been added:

  enable_iak_idevid

  (default: false) Enables the use of IDevID and IAK certificates to identify the device.

  iak_idevid_template

  (default: detect) Specifies the template that sets the algorithms to be used for IDevID and IAK (defined in TPM 2.0 Keys for Identity and Attestation, section 7.3.4). The detect keyword sets the template according to the algorithms used in the configured certificates.

  iak_idevid_name_alg

  (default: sha256) Specifies the digest algorithm used in IDevID and IAK. Used only if the iak_idevid_template option is not set as detect.

  iak_idevid_asymmetric_alg

  (default: rsa) Specifies the signing algorithm used in IDevID and IAK. Used only if the iak_idevid_template option is not set as detect.

  iak_cert

  (default: default) Specifies the path to the file that contains the X509 IAK certificate. The default path is /var/lib/keylime/iak-cert.crt.

  idevid_cert

  (default: default) Specifies the path to the file that contains the X509 IDevID certificate. The default path is /var/lib/keylime/idevid-cert.crt.

• Configurable IMA and measured boot event log locations are supported by using the new ima_ml_path and measuredboot_ml_path configuration options.
• Local DNS name, local IP, and configured contact IP are included as part of the Subject Alternative Name of the generated self-signed X509 certificate.
• IPv6 addresses with or without brackets are supported in the registrar_ip configuration option.
• Hexadecimal encoded values are supported in the tpm_ownerpassword configuration option.
• TLS 1.3 is enabled in connections to the agent.

• Removed a dependency on libxz through libsystemd.
• In IKEv1, default proposals have been set to aes-sha1 for Encapsulating Security Payload (ESP) and sha1 for Authentication Header (AH).
• IKEv1 rejects ESP proposals that combine Authenticated Encryption with Associated Data (AEAD) and non-empty INTEG.
• IKEv1 rejects exchange when a connection has no proposals.

• IKEv1 has a more limited default cryptosuite:

  IKE={AES_CBC,3DES_CBC}-{HMAC_SHA2_256,HMAC_SHA2_512HMAC_SHA1}-{MODP2048,MODP1536,DH19,DH31}
  ESP={AES_CBC,3DES_CBC}-{HMAC_SHA1_96,HMAC_SHA2_512_256,HMAC_SHA2_256_128}-{AES_GCM_16_128,AES_GCM_16_256}
  AH=HMAC_SHA1_96+HMAC_SHA2_512_256+HMAC_SHA2_256_128

  Copy to Clipboard
• Failures of the libcap-ng library are no longer unrecoverable.
• TFC padding is set for AEAD algorithms in the pluto utility.

• Certificate compression in TLS is supported (RFC 8879).
• Optimal Asymmetric Encryption Padding scheme (RSA-OAEP) is supported (RFC 8017).
• API for incremental calculation of SHAKE hashes of arbitrary length across multiple calls has been added.
• RSA encryption and decryption with PKCS #1 v1.5 padding is deprecated and disallowed by default.
• In FIPS mode, gnutls now defaults to exporting PKCS #12 files with Password-Based Message Authentication Code 1 (PBMAC1) as defined in RFC 9579. If you need interoperability with systems running in FIPS mode, use PBMAC1 explicitly.
• GnuTLS now checks all records in an Online Certificate Status Protocol (OCSP) response. Before this update, when multiple records were provided in a single OCSP response, only the first record was checked. This version of GnuTLS examines all records until the server certificate matches.
• The minimum RSA key size for verification to be approved in FIPS mode has been increased to 2048 bits.

• A system for restricting forwarding and use of keys that were added to the ssh-agent program has been added to ssh, sshd, ssh-add, and ssh-agent programs.

• Improvements to the use of the FIDO standard:

  • The verify-required certificate option has been added to ssh-keygen.
  • Fixes to FIDO key handling reduce unnecessary PIN prompts for keys that support intrinsic user verification.
  • A check for existing matching credentials in the ssh-keygen program prompts the user before overwriting the credential.
• New EnableEscapeCommandline option in the ssh_config configuration file enables the command line option in the EscapeChar menu for interactive sessions.
• New ChannelTimeout keyword specifies whether and how quickly the sshd daemon should close inactive channels.
• The ssh-keygen utility generates Ed25519 keys by default except in FIPS mode, where the default is RSA.
• The ssh client performs keystroke timing obfuscation by sending interactive traffic at fixed intervals, every 20 ms by default, when only a small amount of data is being sent. It also sends fake keystrokes for a random interval after the last real keystroke, defined by the ObscureKeystrokeTiming keyword.
• Support for DSA keys has been removed.
• The pam-ssh-agent subcomponent has been removed.
• The ssh-keysign tool is now in a separate subpackage.
• With the new ChannelTimeout type, ssh and sshd close all open channels if all channels lack traffic for a specified interval. This is in addition to the existing per-channel timeouts.
• The sshd server blocks client addresses that repeatedly fail authentication, repeatedly connect without ever completing authentication, or that crash the server.
• The sshd server penalizes client addresses that do not successfully complete authentication. The penalties are controlled by the new PerSourcePenalties keyword in sshd_config.
• The sshd server is split into a listener binary sshd and a per-session binary sshd-session. This reduces the listener binary size that does not need to support the SSH protocol. This also removes support for disabling privilege separation and disabling re-execution of sshd
• In portable OpenSSH, sshd no longer uses argv[0] as the PAM service name. You can select the service name at runtime with the new PAMServiceName directive in the sshd_config file. This defaults to "sshd".
• The HostkeyAlgorithms keyword allows ssh to disable implicit fallback from certificate host key to plain host keys.
• The components have been hardened in general and work better with the PKCS #11 standard.
• As a Technology Preview, OpenSSH supports post-quantum cryptography (PQC).

• The sha* applications have been removed and replaced with a single application called kcapi-hasher. Symlinks to kcapi-hasher with equivalent names as the original sha* applications have been added into the bin and libexec directories. This change does not cause any known regressions.
• The sha3sum command, which prints checksums of files that use SHA-3, has been added.
• The kcapi_md_sha3_* wrapper APIs have been added.

• Better asynchronous SFTP IO
• PKCS #11 provider support for OpenSSL 3.0
• Testing for GSSAPI authentication
• Proxy jump

• Support for recursive attributes has been added to the p11-kit RPC protocol.
• A function to check run time version of the library has been added.
• Version information is no longer accessible through macros.
• With the new --id option, you can assign an ID to key pairs generated with the generate-keypair command or imported with the import-object command.
• With the new --provider option, you can specify a PKCS #11 module when using p11-kit commands.
• Fixed a bug in p11-kit where the EdDSA mechanism was not recognized in generate-keypair.
• p11-kit falls back to the C_GetFunctionList function when the C_GetInterface function is not supported.

• Graphical results for information flow analysis and domain transition analysis have been added to the apol, sedta, and seinfoflow tools.
• Tooltips and detail popups in apol have been added to help cross-referencing query and analyzing results along with context-sensitive help.

• DTLS 1.3 protocol is now supported (RFC 9147).
• PBMAC1 support has been added to PKCS #12 (RFC 9579).
• Experimental support for X25519Kyber768Draft00 hybrid post-quantum key agreement has been added (draft-tls-westerbaan-xyber768d00). It will be removed in a future release.
• lib::pkix is the default validator in RHEL 10.
• RSA certificates with keys shorter than 2048 bits stop working in SSL servers, in accordance with the system-wide cryptographic policy.

• Additional fixes for removing the time side-channel leakage related to the RSA PKCS #1 v1.5 padding removal after decryption
• Unified OpenSSL logging
• Support for the HKDF, RSA OEAP encryption, AES GCM, and AES GMAC mechanisms in the pkcs11-tool utility
• Fixes for CVEs targeting uninitialized memory problems: CVE-2024-45615, CVE-2024-45616, CVE-2024-45617, CVE-2024-45618, CVE-2024-45619, and CVE-2024-45620
• A fix of allocations of aligned memory that caused crashes in the Chromium web browser
• A fix of reading certificates in the TeleSec Chipcard Operating System (TCOS) card driver

• iio-sensor-proxy
• samba-bgqd
• tlshd
• gnome-remote-desktop
• pcm-sensor-server

• Backtrace on CoreOS has been fixed.
• Broken AppStream metadata have been updated.
• The paths of used icons have been fixed to recently updated paths.

• virt_dbus_t
• virt_hook_unconfined_t
• virt_qmf_t
• virtinterfaced_t
• virtnetworkd_t
• virtnodedevd_t
• virtnwfilterd_t
• virtproxyd_t
• virtqemud_t
• virtsecretd_t
• virtstoraged_t
• virtvboxd_t
• virtvzd_t
• virtxend_t

• A new audit2allow -C option has been added to the CIL output mode.
• The semanage utility allows modifying records on add.
• The semanage utility no longer sorts local fcontext definitions.
• The checkpolicy program supports the CIDR notation for nodecon statements.
• The SELinux sandbox utility supports the Wayland display protocol.
• File context and ownership in the policy store are preserved during SELinux policy rebuild.
• The format of the binary file_contexts.bin file has been changed, and files that use the old format are ignored. The new format is optimized and not architecture-dependent. You can create the binary file_contexts.bin file in the new format by rebuilding the SELinux policy.
• The performance of the selabel_lookup library call has been improved significantly.

• Added the clevis-pin-pkcs11 subpackage which provides the pkcs11 pin for unlocking LUKS-encrypted volumes using a PKCS #11 device (smart card).
• Added two checks to the clevis-udisks2 subpackage.
• Added a fix that prevents "Address in use" errors.

• Improved bound checks for the len function for the oct JWK Type in OpenSSL, as a fix to an error reported by the SAST (Static Application Security Testing) process.
• The protected JSON Web Encryption (JWE) headers no longer contain zip.
• The jose utility avoids potential denial of service (DoS) attacks by using high decompression chunks.

• The new keylime-policy tool integrates all management tasks of Keylime runtime policies and measured boot policies and improves the performance of generating policies.
• The verifier and tenant Keylime components no longer require payloads for the agent component.

• Duplicate --ctlsocket option for the whack command is fixed (RHEL-75605).
• An expectation failure with crossing streams is fixed (RHEL-73236).
• Parsing protoport configuration has been optimized (RHEL-74850).
• Incorrect outputs for the ipsec showhostkey command are fixed (RHEL-75975).
• Crashes on executing ipsec --rereadsecrets are fixed (RHEL-69403).
• The keyingtries and dpd* options are ignored.
• The ipsec-interface-managed=no option for network namespaces has been introduced.

• Linux-specific updates:

  • Added support for packet offload counters in Linux kernel 6.7 and above.
  • Implemented IP-TFS (IP Traffic Flow Security) support according to RFC 9347.
  • Ensured compatibility with Linux kernel 6.10+ by setting the replay window to 0 on outbound SAs.
  • Fixed issues related to the nopmtudisc setting on inbound security associations (SA). IKEv2 enhancements:
  • Introduced support for RFC 5723 IKE Session Resumption, enabling session resumption without re-authentication.
  • Added support for draft-ietf-ipsecme-ikev2-qr-alt-04, enhancing key exchange mechanisms.
  • Implemented PPK (Post-quantum Pre-shared Key) in the INTERMEDIATE exchange to improve security.

• SHA-256 hashing, AES-GCM encryption, and AES decryption in general have gained optimizations on 64-bit PowerPC.
• DRBG-CTR-AES256, a new deterministic random bit generator, has been added.
• SHAKE-128, an arbitrary length hash function of the SHA-3 family, has been added.
• Support for the RSA-OAEP scheme has been added.
• Incremental interface for SHAKE hashing algorithms has been added.

• Fixed the bootc compatibility with rpm-ostree when bootc is available alongside rpm-ostree.
• General bug fix: If bootc is not available, rollback using rpm-ostree.

• Content: Provides access to Red Hat CDN repositories.
• Analytics: Triggers system registration with Red Hat Insights.
• Remote-management: Starts the yggdrasil.service.

• Default compression switched from gz to zstd, which provides smaller metadata that is faster to decompress. Note that the gz compression is still supported.
• To save time and disk space, metadata in the SQLite database format is no longer generated by default. Note that you can still create this metadata by using the --database switch or the sqliterepo_c tool.

• Managing the group.xml metadata has been standardized. Previously, this metadata was present twice, as compressed and uncompressed. With this update, the group metadata is present only once as compressed and has the group metadata type.

  Note

  The group.xml metadata is not compatible with YUM in RHEL 7. If required, you can still create repositories with the old layout by using the modifyrepo_c command.

• Use the dnf --transient command.
• Set the persistence option to transient in the dnf.conf file.

• polkit uses the tmpfiles.d file to store configuration in the /etc/polkit-1 directory.
• polkit now supports syslog-style log levels and LogControl protocol for dynamic loglevel changing.

• The alarm command, a shell built-in part of ksh, is no longer supported and will be removed. The replacement is the cron daemon, a utility for tasks that must run at fixed intervals.
• The ksh shell is now capable of handling more than 32767 simultaneous background jobs, subject to system limitations.
• Fixes a bug that caused an incorrect default exit status for exit within a trap action and a race condition occurring on some systems when running an external command with a redirection from a command substitution.
• Various other bug fixes

• Support for cgroup v1, including legacy and hybrid hierarchies, is now considered obsolete. Now, systemd always uses cgroup v2, even if systemd.legacy_systemd_cgroup_controller=yes is set on the kernel command line.
• Support for System V service scripts is deprecated and will be removed in future versions.
• Default configuration files are now located under the /usr/lib/systemd/ directory instead of /etc/systemd/. The default configuration files can be overridden by a user configuration from /etc or extended by using drop-in files similarly to unit files. For more details, see the CONFIGURATION DIRECTORIES AND PRECEDENCE section in systemd-system.conf(5) man pages of the specific configuration files.

• On IBM Z, the IPL output method is now deprecated. The RAMDISK output method is provided as an alternative. The OUTPUT=RAMDISK functionality is identical on all the supported hardware architectures, unlike the deprecated OUTPUT=IPL functionality, which is specific to IBM System Z.

• The default value of the ISO_VOLID configuration variable, which specifies the label of the resulting ISO image when using the OUTPUT=ISO setting, was changed to REAR-ISO. The default in previous ReaR versions was RELAXRECOVER. If you need to mount the resulting ISO 9660 file system by label, adjust the mount command for the label change. Alternatively, you can set the ISO_VOLID variable in /etc/rear/local.conf to RELAXRECOVER to restore the former behavior.

• CCA token on non-IBM Z platforms (x86_64, ppc64)
• IBM Dilithium
• RSA-OAEP with SHA-224, SHA-384, and SHA-512 on encryption and decryption
• PKCS #11 v3.0 SHA-3 mechanisms
• SHA-2 mechanisms
• SHA-based key derivation mechanisms
• Protecting tokens with a token specific user group
• New libica AES-GCM API using the KMA instruction on z14 and later

• tuned-ppd : The tune-ppd is a replacement of drop-in power-profiles-daemon which uses TuneD as a backend.
• Valkey : Replaces Redis and provides the same features.
• libcpuid : Enables accurate CPU model identification in TuneD.
• dnsconfd : A local DNS cache configuration daemon that simplifies setting up DNS caching, split DNS, DNS over TLS, and other DNS features.

• It is an extensible server solution with module hooks.
• It allows re-configuration through the REST API.
• It has a design that allows separation of data (leases) and execution environment.

• /etc/cups/client.conf: for applications using libcups
• /etc/cups/cupsd.conf: for cupsd daemon

• Added support for multiple devices in JSON format.
• Increased performance when listing tables.
• Added virtual local area network (VLAN) ID match and set support, including the 802.1ad (Q-in-Q) standard.
• Enabled zero burst in byte rate limiter.
• Added egress support for list hooks.
• Fixed listing inconsistencies in the nft list hooks command.

• 1.1.0. upstream release notes.
• 1.1.1. upstream release notes.

• New arptables-translate utility

• ebtables-nft:

  • Print negations (exclamation marks) before the match they invert for consistency with iptables.
  • Support --replace and --list-rules command options.

• iptables-translate:

  • Align protocol name lookups with iptables.
  • Support socket match with TPROXY target.

• iptables:

  • Enable implicit extension lookup for dccp and ipcomp protocols so that no extra -m <proto> command option is needed after -p <proto>.

• iptables-save:

  • Avoid calls to the getprotobynumber() function for consistency and improved performance with huge rule sets.

• arptables-nft:

  • Fixed wrong formatting of --h-type values and --proto-type masks which caused misinterpretation by arptables-restore.
  • Improved ineffective masks when specified in --h-type, --opcode and --proto-type matches.

• iptables-nft:

  • Fixed wrong error messages in corner-case error conditions.
  • Fixed incorrect combination of inverted payload matches.

• Added the StrictForwardPorts (boolean, defaults to "no") configuration option that allows firewalld to be strict about Destination NAT traffic. When enabled, only forward ports explicitly enabled in firewalld are allowed. This means that container-published ports will be blocked. For more information about the feature, see StrictForwardPorts.

• Added support for the following services:

  • client/server on Advanced Linux Sound Architecture (ALSA) sequencer (aseqnet)
  • Music Player Daemon (MPD)
  • Radsec
  • SlimeVR

• Added the xdp-forward utility that enables XDP-accelerated packet forwarding between supported network devices.
• Updated the xdp-trafficgen utility to support specifying User Datagram Protocol (UDP) packet sizes.
• Added a new option-based API for creating XDP sockets (XSK) and user memory (UMEM) objects.

• No SAN validation is performed when set to no
• SAN are validated when set to yes

• Added support for Device Provisioning Protocol (DPP) release 3.
• Added support for GCM-AES-256 cipher suite.
• Added support for Basic Service Set (BSS) Color updates.
• Implemented OpenSSL 3.0 API changes.

• Enjoy the deployment flexibility, where older RHEL versions can get newer versions of rteval.
• Create an isolated environment to ensure the performance evaluations do not disrupt other system processes or consume excessive resources.
• Run multiple rteval instances on the same or multiple hosts.
• Allocate specific system resources to rteval, ensuring better resource usage control.

• timerlat-interval INTV_US
• cyclictest-interval INTV_US

New option to disable idle states locally on latency testing with cyclictest

• The cyclictest tool sets /dev/cpu_dma_latency to 0 by default to avoid increased latency when waking up from idle, which disables idle states on all CPUs.
• The new deepest-idle-state option only disables idle states on CPUs which are selected for the testing. The argument specifies the deepest allowed idle state, setting it to -1 disables all idle states on the measured CPUs.
• Tuning with the cyclictest is supposed to reflect the real-time workload testing, and thus using the deepest-idle-state instead of using the /dev/cpu_dma_latency to disable the CPU idle states reflects a use case where the real-time workload only disables idle states on the CPU where it is running.
• As a result, the cyclictest coverage of addressing all use cases is increased, and power consumption decreases.

• GCC 13 support.
• clang 14 support.
• binutils 2.38 support.
• Support for dynamic GRUB runtime memory addition using firmware calls.
• PCI and MMIO UARTs support.
• SDL2 support.
• LoongArch support.
• TPM driver fixes.
• Many filesystems fixes.
• Many CVE and Coverity fixes.
• Debugging support improvements.
• Tests improvements.
• Documentation improvements.
• VLAN support

• Removed support for Python 2.
• Support for adding disks to the existing Stratis pool.
• Support for Stratis encryption with Clevis or Tang.
• Support for semi-automatic resizing of the lvmpv format to fill underlying block devices.

• Improvements for the libcryptsetup package to support LUKS encrypted devices in the kdump enabled systems.
• Critical fixes for LUKS2 SED OPAL feature.
• Avoids known or already fixed issues with LUSK2 SED OPAL feature.

• The multipathd.socket systemd unit is no longer enabled by default. multipathd continues to run automatically on boot. However, if stopped, it does not restart automatically if there is a block device uevent or certain multipath commands are run. To keep it enabled, restart manually or uncomment the following in the multipathd.socket systemd file:

• multipathd now attempts to run as a real-time process with a moderate priority (10) by default. If unsuccessful, it continues to run as a normal process, but with an increased priority. You can control this, by modifying the standard systemd options, for example, LimitRTPRIO and CPUWeight in the multipathd.service systemd file.
• systemctl reload multipathd.service or multipathd reconfigure commands now reload a device only if something has changed, instead of reloading every multipath device including the ones that are unchanged. To force a reload of all devices, run :

• The following multipath.conf options were deprecated and are not recognized in RHEL 10. multipath triggers a warning message if they are included in the multipath file:

  • RHEL 9:

    • multipath_dir
    • config_dir
    • bindings_file
    • wwids_file
    • prkeys_file
    • getuid_callout
    • disable_changed_wwids

  • RHEL 8:

    • default_selector
    • default_path_grouping_policy
    • default_uid_attribute
    • default_getuid_callout
    • default_features
    • default_path_checker
• Path grouping policy, group_by_tpg, is introduced to group paths by their ALUA target port group. This ensures that all paths with the same target port group belong to the same pathgroup. It functions similar to the group_by_prio policy, but prevents misgrouping when paths change priorities.

• Configuration settings detect_pgpolicy and detect_pgpolicy_use_tpg are introduced which can be set in overrides, devices, and defaults sections.

  • If detect_pgpolicy is enabled, multipath sets path_grouping_policy to group_by_prio or group_by_tpg for alua or sysfs prioritizer. If it is disabled, path_grouping_policy configuration set for the device is used. detect_pgpolicy is enabled by default.
  • If detect_pgpolicy_use_tpg is enabled, detect_pgpolicy sets path_grouping_policy to group_by_tpg. If it is disabled, detect_pgpolicy sets path_grouping_policy to group_by_prio. detect_pgpolicy_use_tpg is disabled by default.

• New wildcards for formatted output in multipathd:

  • New maps format wildcard:

    • k: max_sectors_kb

  • New paths format wildcards:

    • I: init state
    • L: LUN hex
    • A: alua target port group
    • k: max_sectors_kb

• To discover SED Opal locking features:

• To initialize an SED Opal device for locking:

• To lock a SED Opal device:

• To unlock a SED Opal device:

• To change the SED Opal device password:

• To revert an SED Opal device from locking:

• To reset an SED Opal device to disable locking with destructive revert:

• Initialize, lock, and unlock an NVMe disk, and verify that data on the disk remains unchanged after unlocking:

• the existence of the resource
• the type of the resource
• the state of the resource
• various information about the members of a collective resource
• on which nodes the resource is running

• Specifying --output-format=text displays the configured resource defaults or operation defaults in plain text format, which is the default value for this option.
• Specifying --output-format=cmd displays the pcs resource defaults or pcs resource op defaults commands created from the current cluster defaults configuration. You can use these commands to re-create configured resource defaults or resource operation defaults on a different system.
• Specifying --output-format=json displays the configured resource defaults or resource operation defaults in JSON format, which is suitable for machine parsing.

• Displaying the configured text in plain text format by specifying --output-format=text. This is the default value for this option.
• Displaying the commands created from the current cluster tags configuration by specifying --output-format=cmd. You can use these commands to re-create configured tags on a different system.
• Displaying the configured tags in JSON format by specifying --output-format=json, which is suitable for machine parsing.

• Specifying --output-format=cmd displays the pcs commands created from the current cluster configuration that configure fencing levels. You can use these commands to re-create configured fencing levels on a different system.
• Specifying --output-format=json displays the fencing level configuration in JSON format, which is suitable for machine parsing.

• Invalid duration options: monthdays, moon, weekdays, weekyears, yearsdays
• Invalid date-spec options: moon, yearsdays

• The supported duration options are now seconds, minutes, hours, days, weeks, months, and years.
• The supported date-spec options are now seconds, minutes, hours, monthdays, weekdays, yeardays, months, weeks, years, and weekyears.

• pcs resource defaults
• pcs stonith defaults
• pcs resource op defaults
• pcs stonith op defaults
• pcs constraint location

• When you set the placement-strategy cluster property to default, the HA Cluster Management application displays a warning near the utilization attributes for nodes and resources. This warning notes that the utilization has no effect due to placement-strategy configuration.
• The HA Cluster Management application supports dark mode, which you can set through the user menu in the masthead.

• Python introduces a new type statement and new type parameter syntax for generic classes and functions.
• Formatted string literal (f-strings) have been formalized in the grammar and can now be integrated into the parser directly.
• Python now provides a unique per-interpreter global interpreter lock (GIL).
• You can now use the buffer protocol from Python code.
• Dictionary, list, and set comprehensions in CPython are now inlined. This significantly increases the speed of a comprehension execution.
• CPython now supports the Linux perf profiler.
• CPython now provides stack overflow protection on supported platforms.
• Python 3.12 is compiled with GCC’s -O3 optimization flag, which has been used by default in upstream. As a result, you can observe increased performance of your Python applications and the interpreter.

• Core enhancements:

  • Perl now supports Unicode 15.0.
  • You can now use a new -g command-line option, which is an alias for the umask option -0777.
  • The -M command-line option now accepts a space.
  • A new builtin module now provides documentation for new always-present functions.
  • A new try/catch feature has been added.
  • Deprecation warnings now have specific subcategories to provide finer-grained control. Note that you can still disable all deprecation warnings in a single statement.
  • The @INC hooks have been enhanced, including the $INC variable and the new INCDIR method.
  • Forbidden control flow out of the defer and finally modules is now detected at compile-time.
  • The use of (?{ …? }) and (??{ …? }) in a pattern now disables various optimisations globally in that pattern.
  • The limit for the REG_INF regex engine quantifier has been increased from 65,536 to 2,147,483,647.
  • A new regexp variable ${^LAST_SUCCESSFUL_PATTERN} allows access to the last successful pattern that matched in the current scope.
  • A new __CLASS__ keyword has been introduced.
  • Perl now supports a new ^^ logical XOR operator.

• Incompatible changes:

  • A physically empty sort function now triggers a compile-time error.
  • The readline() function no longer clears the stream error and EOF flags.
  • INIT blocks no longer run after an exit() function inside a BEGIN block.
  • Calling the import method on an unknown package now produces a warning.
  • The return function no longer allows an indirect object.
  • Changes in errors and warnings can now cause failures in tests.

• Deprecations:

  • The use of the ' character as a package name separator is deprecated.
  • The switch feature and the smartmatch operator ~~ are deprecated.
  • Using the goto function to jump from an outer scope into an inner scope is deprecated.

• Internal changes:

  • Multiple deprecated C functions have been removed.
  • Internal C API functions are now hidden with the __attribute__((hidden)) attribute on the platforms that support it. This means they are no longer callable from XS modules on those platforms.

• Modules:

  • The Term::Table and Test2::Suite modules have been added to Perl Core.
  • Most modules have been updated.

• You can use the new Prism parser instead of Ripper. Prism is a portable, error tolerant, and maintainable recursive descent parser for the Ruby language.
• YJIT, the Ruby just-in-time (JIT) compiler implementation, is no longer experimental and it provides major performance improvements.
• The Regexp matching algorithm has been improved to reduce the impact of potential Regular Expression Denial of Service (ReDoS) vulnerabilities.
• The new experimental RJIT (a pure-Ruby JIT) compiler replaces MJIT. Use YJIT in production.
• A new M:N thread scheduler is now available.

• You must now use the Lrama LALR parser generator instead of Bison.
• Several deprecated methods and constants have been removed.
• The Racc gem has been promoted from a default gem to a bundled gem.

• The V8 JavaScript engine has been upgraded to version 12.4.
• The V8 Maglev compiler is now enabled by default on architectures where it is available (AMD and Intel 64-bit architectures and the 64-bit ARM architecture).
• Maglev improves performance for short-lived CLI programs.
• The npm package manager has been upgraded to version 10.8.1.
• The node --watch mode is now considered stable. In watch mode, changes in watched files cause the Node.js process to restart.
• The browser-compatible implementation of WebSocket is now considered stable and enabled by default. As a result, a WebSocket client to Node.js is available without external dependencies.
• Node.js now includes an experimental feature for execution of scripts from package.json. To use this feature, run the node --run <script-in-package.json> command.

• The enhanced bulk loading improves the performance.
• The new load_balance_hosts option in the libpq library supports more efficient load balancing.
• Configuration files in the /var/lib/pgsql/data/ directory support including custom pg_hba.conf and pg_ident.conf files.
• The /var/lib/pgsql/data/pg_hba.conf file supports regular expression matching on database and role entries.

• Absence of the postmaster binary. Use the postgres binary instead. This change affects only user who use postmaster to start the service.
• Absence of the PDF documentation within the package. Use the upstream documentation instead.

• The deprecated mysql_native_password authentication plugin is no longer enabled by default.
• When upgrading to MySQL 8.4, user accounts or roles that have the BINLOG_ADMIN privilege are automatically granted the TRANSACTION_GTID_TAG privilege.
• When you install MySQL 8.4, the mysql_upgrade_history file is created or updated in the server’s data directory. The file is in JSON format and includes information about the version installed, date and time of installation, and whether the release was part of a Long-Term Support (LTS series) or an Innovation series.
• The use of the % and _ characters as wildcards in database grants has been deprecated, and the wildcard functionality will be removed in a future MySQL release. These characters will be treated as literals. They are already treated as literals when the partial_revokes server system variable is set to ON.
• The treatment of the % character by the server as a synonym for localhost when checking privileges has been deprecated.
• The deprecated --ssl and --admin-ssl server options and have_ssl and have_openssl server system variables have been removed. Use the --tls-version and --admin-tls-version server system variables instead.
• The deprecated default_authentication_plugin system variable has been removed. Use the authentication_policy server system variable instead.
• The deprecated SET_USER_ID privilege has been removed. Instead, you can use the SET_ANY_DEFINER privilege for definer object creation and the ALLOW_NONEXISTENT_DEFINER privileges for orphan object protection.
• The deprecated mysql_upgrade utility has been removed.

• A new sys_schema feature.
• Atomic Data Definition Language (DDL) statements.
• A new GRANT …? TO PUBLIC privilege.
• Separate SUPER and READ ONLY ADMIN privileges.
• A new UUID database data type.
• Support for the Secure Socket Layer (SSL) protocol version 3; the MariaDB server now requires correctly configured SSL to start.
• Support for the natural sort order through the natural_sort_key() function.
• A new SFORMAT function for arbitrary text formatting.
• Changes to the UTF-8 charset and the UCA-14 collation.
• systemd socket activation files available in the /usr/share/ directory. Note that they are not a part of the default configuration in RHEL as opposed to upstream.
• Error messages containing the MariaDB string instead of MySQL.
• Error messages available in the Chinese language.
• Changes to the default logrotate file.
• For MariaDB and MySQL clients, the connection property specified on the command line (for example, --port=3306), now forces the protocol type of communication between the client and the server, such as tcp, socket, pipe, or memory.

• Optimization and diagnostic improvements
• A new -fhardened umbrella option, which enables a set of hardening flags
• A new -fharden-control-flow-redundancy option to detect attacks that transfer control into the middle of functions
• A new strub type attribute to control stack scrubbing properties of functions and variables
• A new -finline-stringops option to force inline expansion of certain mem* functions
• Support for new OpenMP 5.1, 5.2, and 6.0 features
• Several new C23 features
• Multiple new C++23 and C++26 features
• Several resolved C++ defect reports
• New and improved experimental support for C++20, C++23, and C++26 in the C++ library
• Support for new CPUs in the 64-bit ARM architecture
• Multiple new instruction set architecture (ISA) extensions in the 64-bit Intel architecture, for example: AVX10.1, AVX-VNNI-INT16, SHA512, and SM4
• New warnings in the GCC’s static analyzer
• Certain warnings changed to errors; for details, see Porting to GCC 14
• Various bug fixes

• Updated tools to build and work with newer versions of the GCC, Clang, LLVM, and Go compilers
• Recording and testing for the use of the GCC command-line options -Wimplicit-int and -Wimplicit-function-declaration
• Improved support for LLVM
• New tests
• A new check to identify if the deprecated OpenSSL Engine code is used
• Multiple --debug-rpm options are now supported
• Various bug fixes

• binutils tools support architecture extensions in the 64-bit Intel and ARM architectures.
• The linker now accepts the --remap-inputs <PATTERN>=<FILE> command-line option to replace any input file that matches <PATTERN> with <FILE>. In addition, you can use the --remap-inputs-file=<FILE> option to specify a file containing any number of these remapping directives.
• For ELF targets, you can use the linker command-line option --print-map-locals to include local symbols in a linker map.
• For most ELF-based targets, you can use the --enable-linker-version option to insert the version of the linker as a string into the .comment section.
• The linker script syntax has a new command for output sections, ASCIZ "<string>", which inserts a zero-terminated string at the current location.
• You can use the new -z nosectionheader linker command-line option to omit ELF section header.

• The info breakpoints command now displays enabled breakpoint locations of disabled breakpoints as in the y- state.
• Added support for debug sections compressed with Zstandard (ELFCOMPRESS_ZSTD) for ELF.
• The Text User Interface (TUI) no longer styles the source and assembly code highlighted by the current position indicator by default. To re-enable styling, use the new command set style tui-current-position.
• A new $_inferior_thread_count convenience variable contains the number of live threads in the current inferior.
• For breakpoints with multiple code locations, GDB now prints the code location using the <breakpoint_number>.<location_number> syntax.
• When a breakpoint is hit, GDB now sets the $_hit_bpnum and $_hit_locno convenience variables to the hit breakpoint number and code location number. You can now disable the last hit breakpoint by using the disable $_hit_bpnum command, or disable only the specific breakpoint code location by using the disable $_hit_bpnum.$_hit_locno command.
• Added support for the NO_COLOR environment variable.
• Added support for integer types larger than 64 bits.
• You can use new commands for multi-target feature configuration to configure remote target feature sets (see the set remote <name>-packet and show remote <name>-packet in Commands).
• Added support for the Debugger Adapter Protocol.
• You can now use the new inferior keyword to make breakpoints inferior-specific (see break or watch in Commands).
• You can now use the new $_shell() convenience function to run a shell command during expression evaluation.

• break, watch

  • Using the thread or task keywords multiple times with the break and watch commands now results in an error instead of using the thread or task ID of the last instance of the keyword.
  • Using more than one of the thread, task, and inferior keywords in the same break or watch command is now invalid.

• printf, dprintf

  • The printf and dprintf commands now accept the %V output format, which formats an expression the same way as the print command. You can also modify the output format by using additional print options in brackets […?] following the command, for example: printf "%V[-array-indexes on]", <array>.

• list

  • You can now use the . argument to print the location around the point of execution in the current frame, or around the beginning of the main() function if the inferior has not started yet.
  • Attempting to list more source lines in a file than are available now issues a warning, referring the user to the . argument.

• document user-defined

  • It is now possible to document user-defined aliases.

• set print nibbles [on|off] (default: off), show print nibbles - controls whether the print/t command displays binary values in groups of four bits (nibbles).
• set debug infcall [on|off] (default: off), show debug infcall - prints additional debug messages about inferior function calls.
• set debug solib [on|off] (default: off), show debug solib - prints additional debug messages about shared library handling.
• set print characters <LIMIT>, show print characters, print -characters <LIMIT> - controls how many characters of a string are printed.
• set debug breakpoint [on|off] (default: off), show debug breakpoint - prints additional debug messages about breakpoint insertion and removal.
• maintenance print record-instruction [ N ] - prints the recorded information for a given instruction.
• maintenance info frame-unwinders - lists the frame unwinders currently in effect in the order of priority (highest first).
• maintenance wait-for-index-cache - waits until all pending writes to the index cache are completed.
• info main - prints information on the main symbol to identify an entry point into the program.
• set tui mouse-events [on|off] (default: on), show tui mouse-events - controls whether mouse click events are sent to the TUI and Python extensions (when on), or the terminal (when off).

• MI version 1 has been removed.
• MI now reports no-history when reverse execution history is exhausted.
• The thread and task breakpoint fields are no longer reported twice in the output of the -break-insert command.
• Thread-specific breakpoints can no longer be created on non-existent thread IDs.
• The --simple-values argument to the -stack-list-arguments, -stack-list-locals, -stack-list-variables, and -var-list-children commands now considers reference types as simple if the target is simple.
• The -break-insert command now accepts a new -g thread-group-id option to create inferior-specific breakpoints.
• Breakpoint-created notifications and the output of the -break-insert command can now include an optional inferior field for the main breakpoint and each breakpoint location.
• The async record stating the breakpoint-hit stopped reason now contains an optional field locno giving the code location number in case of a multi-location breakpoint.

• Events

  • A new gdb.ThreadExitedEvent event.
  • A new gdb.executable_changed event registry, which emits the ExecutableChangedEvent objects that have progspace and reload attributes.
  • New gdb.events.new_progspace and gdb.events.free_progspace event registries, which emit the NewProgpspaceEvent and FreeProgspaceEvent event types. Both of these event types have a single attribute progspace to specify the gdb.Progspace program space that is being added to or removed from GDB.

• The gdb.unwinder.Unwinder class

  • The name attribute is now read-only.
  • The name argument of the __init__ function must be of the str type, otherwise a TypeError is raised.
  • The enabled attribute now accepts only the bool type.

• The gdb.PendingFrame class

  • New methods: name, is_valid, pc, language, find_sal, block, and function, which mirror similar methods of the gdb.Frame class.
  • The frame-id argument of the create_unwind_info function can now be either an integer or a gdb.Value object for the pc, sp, and special attributes.
• A new gdb.unwinder.FrameId class, which can be passed to the gdb.PendingFrame.create_unwind_info function.
• The gdb.disassembler.DisassemblerResult class can no longer be sub-classed.
• The gdb.disassembler module now includes styling support.
• A new gdb.execute_mi(COMMAND, [ARG]…?) function, which invokes a GDB/MI command and returns result as a Python dictionary.
• A new gdb.block_signals() function, which returns a context manager that blocks any signals that GDB needs to handle.
• A new gdb.Thread subclass of the threading.Thread class, which calls the gdb.block_signals function in its start method.
• The gdb.parse_and_eval function has a new global_context parameter to restrict parsing on global symbols.

• The gdb.Inferior class

  • A new arguments attribute, which holds the command-line arguments to the inferior, if known.
  • A new main_name attribute, which holds the name of the inferior’s main function, if known.
  • New clear_env, set_env, and unset_env methods, which can modify the inferior’s environment before it is started.

• The gdb.Value class

  • A new assign method to assign a value of an object.
  • A new to_array method to convert an array-like value to an array.

• The gdb.Progspace class

  • A new objfile_for_address method, which returns the gdb.Objfile object that covers a given address (if exists).
  • A new symbol_file attribute holding the gdb.Objfile object that corresponds to the Progspace.filename variable (or None if the filename is None).
  • A new executable_filename attribute, which holds the string with a filename that is set by the exec-file or file commands, or None if no executable file is set.

• The gdb.Breakpoint class

  • A new inferior attribute, which contains the inferior ID (an integer) for breakpoints that are inferior-specific, or None if no such breakpoints are set.

• The gdb.Type class

  • New is_array_like and is_string_like methods, which reflect whether a type might be array- or string-like regardless of the type’s actual type code.
• A new gdb.ValuePrinter class, which can be used as the base class for the result of applying a pretty-printer.
• A newly implemented gdb.LazyString.__str__ method.

• The gdb.Frame class

  • A new static_link method, which returns the outer frame of a nested function frame.
  • A new gdb.Frame.language method that returns the name of the frame’s language.

• The gdb.Command class

  • GDB now reformats the doc string for the gdb.Command class and the gdb.Parameter sub-classes to remove unnecessary leading whitespace from each line before using the string as the help output.

• The gdb.Objfile class

  • A new is_file attribute.
• A new gdb.format_address(ADDRESS, PROGSPACE, ARCHITECTURE) function, which uses the same format as when printing address, symbol, and offset information from the disassembler.
• A new gdb.current_language function, which returns the name of the current language.
• A new Python API for wrapping GDB’s disassembler, including gdb.disassembler.register_disassembler(DISASSEMBLER, ARCH), gdb.disassembler.Disassembler, gdb.disassembler.DisassembleInfo, gdb.disassembler.builtin_disassemble(INFO, MEMORY_SOURCE), and gdb.disassembler.DisassemblerResult.
• A new gdb.print_options function, which returns a dictionary of the prevailing print options, in the form accepted by the gdb.Value.format_string function.

• The gdb.Value.format_string function

  • gdb.Value.format_string now uses the format provided by the print command if it is called during a print or other similar operation.
  • gdb.Value.format_string now accepts the summary keyword.
• A new gdb.BreakpointLocation Python type.
• The gdb.register_window_type method now restricts the set of acceptable window names.

• AMD and Intel 64-bit architectures

  • Added support for disassembler styling using the libopcodes library, which is now used by default. You can modify how the disassembler output is styled by using the set style disassembler * commands. To use the Python Pygments styling instead, use the new maintenance set libopcodes-styling off command.

• The 64-bit ARM architecture

  • Added support for dumping memory tag data for the Memory Tagging Extension (MTE).
  • Added support for the Scalable Matrix Extension 1 and 2 (SME/SME2). Some features are still considered experimental or alpha, for example, manual function calls with ZA state or tracking Scalable Vector Graphics (SVG) changes based on DWARF.
  • Added support for Thread Local Storage (TLS) variables.
  • Added support for hardware watchpoints.

• The 64-bit IBM Z architecture

  • Record and replay support for the new arch14 instructions on IBM Z targets, except for the specialized-function-assist instruction NNPA.

• IBM Power Systems, Little Endian

  • Added base enablement support for POWER11.

• Changes in the libdw library:

  • The dwarf_addrdie function now supports binaries lacking a debug_aranges section.
  • Support for DWARF package files has been improved.
  • A new dwarf_cu_dwp_section_info function has been added.
• Caching eviction logic in the debuginfod server has been enhanced to improve retention of small, frequent, or slow files, such as vdso.debug.
• The eu-srcfiles utility can now fetch the source files of a DWARF/ELF file and place them into a zip archive.

• An experimental --build-as=USER flag to reduce privileges during script compilation.
• Improved support for probing processes running in containers, identified by host PID.
• New probes for userspace hardware breakpoints and watchpoints.
• Support for the --remote operation of --runtime=bpf mode.
• Improved robustness of kernel-user transport.

• The --track-fds=yes option now warns against double closing of file descriptors, generates suppressible errors, and supports XML output.
• The --show-error-list=no|yes option now accepts a new value, all, to also print the suppressed errors.
• On the 64-bit IBM Z architecture, Valgrind now supports neural network processing assist (NNPA) facility vector instructions: VCNF, VCLFNH, VCFN, VCLFNL, VCRNF, and NNPA (z16/arch14).
• On the 64-bit ARM architecture, Valgrind now supports dotprod instructions (sdot/udot).
• On the AMD and Intel 64-bit architectures, Valgrind now provides more accurate instruction support for the x86_64-v3 microarchitecture.
• Valgrind now provides wrappers for the wcpncpy, memccpy, strlcat, and strlcpy functions that can detect memory overlap.
• Valgrind now supports the following Linux syscalls: mlock2, fchmodat2, and pidfd_getfd.

• The debugedit utility now uses the faster xxhash algorithm to generate the buildid.
• The find-debuginfo utility supports the following new options:
• -v and --verbose to add more output for all files processed
• -q and --quiet to silence all non-error output
• The find-debuginfo utility now passes the -j option also to the dwz tool, which enables parallelized processing.
• The debugedit utility now handles compressed DWARF debugging ELF sections.
• The debugedit utility now handles more DWARF5 constructs as used by the clang compiler.

• debuginfod:

  • Added per-file signature verification for integrity checking, by using the RPM IMA scheme from Fedora and RHEL.
  • New API for metadata queries: file name buildid.
  • The server-side extraction of files from kernel debuginfo packages is significantly faster. It takes now less than 0.25 seconds, down from ~50 seconds.

• libdw:

  • New functions dwfl_set_sysroot, dwfl_frame_unwound_source, and dwfl_unwound_source_str.

• stacktrace:

  • Experimental new tool that can process a stream of stack samples from the Sysprof profiler and unwind them into call chains. Enable on x86 with --enable-stacktrace. See the README.eu-stacktrace file in the development branch for detailed usage instructions.
  • The eu-stacktrace utility is available as a Technology Preview. For details, see eu-stacktrace available as a Technology Preview.

• Better support for Linux kernel module analysis by using the BPF Type Format (BTF) and Common Trace Format (CTF).
• Improved internal type comparison algorithms in the middle end.
• Improved logging in abipkgdiff, abidw, and abilint utilities
• Numerous bug fixes.

• The --track-fds=yes option now shows suppressible errors when using bad file descriptors, and the errors are written to the XML output. The warnings shown, if you do not use the option, are deprecated and will be removed in a future version.
• Error messages now support Ada name demangling.
• The deflate-conversion facility (z15/arch13) now supports the deflate compression call (DFLTCC) instruction on the IBM Z platform.
• On the IBM Z platform, valgrind now supports the instructions provided by the message security assist (MSA) facility and its 1-9 extensions.

• Valgrind now supports the following new Linux system calls:

  • open_tree
  • move_mount
  • fsopen
  • fsconfig
  • fsmount
  • fspick
  • landlock_create_ruleset
  • landlock_add_rule
  • landlock_restrict_self

• The for-range loop accepts iterator functions of the following types:

  • func(func() bool)
  • func(func(K) bool)

  • func(func(K, V) bool)

    Calls of the iterator argument function create the iteration values for the for-range loop. For reference links, see the upstream release notes.

• The Go Toolchain can collect usage and breakage statistics to help the Go team to understand how the Go Toolchain is used and working. By default, Go Telemetry does not upload telemetry data and stores it only locally. For further information, see the upstream Go Telemetry documentation.
• The go vet subcommand includes the stdversion analyzer which flags references to symbols that are too new for the version of Go you use in the referring file.
• The cmd and cgo features support the -ldflags option to pass flags to the C linker. The go command uses this flag automatically to avoid argument list too long errors when you use a very large CGO_LDFLAGS environment variable.
• The trace utility tolerates partially broken traces and attempts to recover the trace data. This is especially useful in case of crashes, because you can get the trace leading up to the crash.
• The traceback printed by the runtime after an unhandled panic or other unrecoverable error carries indentation to distinguish the stack trace of the goroutine from the first goroutine.
• The compiler build time overhead of using profile-guided optimization was reduced to single-digit percentage.
• The new -bindnow linker flag enables immediate function binding when building a dynamically-linked ELF binary.
• The //go:linkname linker directive no longer refer to internal symbols in the standard library and the runtime that are not marked with //go:linkname on their definition.
• If a program no longer refers to a Timer or Ticker, garbage collection cleans them up immediately even if their Stop method has not been called. The timer channel associated with a Timer or Ticker is now unbuffered with capacity 0. This ensures that, every time a Reset or Stop method is called, no stale values are not sent or received after the call.
• The new unique package provides facilities for canonicalizing values, such as interning or hash-consing.
• The new iter package provides the basic definitions to work with user-defined iterators.
• The slices and maps packages introduce several new functions that work with iterators.
• The new structs package provides types for struct fields that modify properties of the containing struct type, such as memory layout.

• Minor changes are made in the following packages:

  • archive/tar
  • crypto/tls
  • crypto/x509
  • database/sql
  • debug/elf
  • encoding/binary
  • go/ast
  • go/types
  • math/rand/v2
  • net
  • net/http
  • net/http/httptest
  • net/netips
  • path/filepath
  • reflect
  • runtime/debug
  • runtime/pprof
  • runtime/trace
  • slices
  • sync
  • sync/atomic
  • syscall
  • testing/fstest
  • text/template
  • time
  • unicode/utf16

• LLVM now uses debug records, a more efficient representation for debug information.

• C++14 sized deallocation is now enabled by default.
• C++17 support has been completed.
• Improvements to C++20 support, especially around modules, concepts, and Class Template Argument Deduction (CTAD) have been added.
• Improvements to C++23, C++2c, C23, and C2y support have been added.

• The new LazyCell and LazyLock types delay the initialization until the first use. These extend the earlier OnceCell and OnceLock types with the initialization function included in each instance.
• The new sort implementations in the standard library improve the runtime performance and compile times. They also try to detect cases where a comparator is not producing a total order, making that panic instead of returning unsorted data.
• Precise capturing for opaque return types have been added. The new use<..> syntax specifies the generic parameters and lifetimes used in an impl Trait return type.

• Many new features for const code have been added, for example:

  • Floating point support
  • const immediates for inline assembly
  • References to statics
  • Mutable reference and pointers

• Many new features for unsafe code have been added, for example:

  • Strict provenance APIs
  • &raw pointer syntax
  • Safely addressing statics
  • Declaring safe items in unsafe extern blocks
• The Cargo dependency resolver is now version aware. If a dependency crate specifies its minimum supported Rust version, Cargo uses this information when it resolves the dependency graph instead of using the latest semver-compatible crate version.

• The WebAssembly System Interface (WASI) target is changed from rust-std-static-wasm32-wasi to rust-std-static-wasm32-wasip1. You can select the WASI target also by using the --target wasm32-wasip1 parameter on the command line. For more information, see the Changes to Rust’s WASI targets upstream blog post.
• The split panic hook and panic handler arguments core::panic::PanicInfo and std::panic::PanicInfo are now different types.
• extern "C" functions stops on uncaught panics. Use extern "C-unwind" instead to allow unwinding across ABI boundaries.

• pcp2openmetrics: a new tool to push PCP metrics in Open Metrics format to remote end points
• pcp-geolocate: a new tool to report latitude and longitude metric labels
• pmcheck: a new tool to interrogate and control PCP components
• pmdauwsgi: a new PCP agent that exports instrumentation from uWSGI servers

• pmdalinux: added new kernel metrics (hugepages, filesystems, TCP, softnet, virtual machine balloon)
• pmdalibvirt: added support for metric labels, added new balloon, vCPU, and domain info metrics
• pmdabpf: improved eBPF networking metrics for use with the pcp-atop utility

• Support for zooming in on the y axis of time series and candlestick visualizations by holding shift while clicking and dragging.
• Streamlined data source selection when creating a dashboard.
• Updated User Interface, including updates to navigation and the command palette.
• Various improvements to transformations, including the new unary operation mode for the Add field from calculation transformation.
• Various improvements to dashboards and data visualizations, including a redesigned empty dashboard and dashboard panel.
• New geomap and canvas panels.

• Various improvements to users, access, authentication, authorization, and security.
• Alerting improvements along with new alerting features.
• Public dashboards now available.

• The plugin now uses Valkey as a data source instead of Redis. As a consequence, the PCP Redis data source was renamed to PCP Valkey.

• New dashboards:

  • PCP Vector Top Consumers
  • PCP Vector UWSGI overview
• The metric search is unavailable until a replacement for the RediSearch module is available for the Valkey data source.

• Python Standard Template Library (STL) container wrappers now use the Python Iterator Protocol.

• SWIG now supports:

  • Python stable Application Binary Interface (ABI)
  • Python 3.12 and Python 3.13
  • Ruby 3.2 and Ruby 3.3
  • Tcl 9.0
  • PHP 8; support for PHP 7 has been removed.
• Support for the C++14 auto variable without trailing return type for the C++11 auto variable has been added.
• Constructors, destructors, and assignment operators have been fixed, including implicit, default, and deleted, and related non-assignable variable wrappers.
• A new Javascript generator targeting Node.js binary stable ABI Node-API is now available.
• Multiple deprecated features have been removed.
• Experimental support for C as a target language has been added.
• Handling of namespaces when using the nspace feature has been enhanced.
• The STL wrapper has been enhanced for the std::unique_ptr, std::string_view, std::filesystem objects.
• Support for C++17 fold expressions and C++11 trailing return types has been added.
• Handling of string and character literals has been improved.

• Language:

  • Generic type aliases are now fully supported, allowing type aliases to be parameterized for increased flexibility with generics.

• Tools:

  • The Go module system supports tool directives in go.mod files, enabling direct management of executable dependencies.
  • The go build, go install, and go test commands now support the -json flag for structured output.
  • The new GOAUTH environment variable provides enhanced authentication for private modules.

• Runtime and Performance:

  • Runtime improvements reduce CPU overhead by 2–3% on average.
  • Notable changes include a new map implementation based on Swiss Tables and more efficient memory allocation.

• Standard Library:

  • The new os.Root type enables directory-limited filesystem access.
  • The testing.B.Loop method improves benchmarking.
  • The runtime.AddCleanup function provides a more flexible finalization mechanism.
  • The new weak package introduces weak pointers.

• Cryptography:

  • New packages for ML-KEM post-quantum key exchange (crypto/mlkem), HKDF, PBKDF2, and SHA-3 are now available.
  • The Go Cryptographic Module is now under review for FIPS 140-3 certification.

• Additional updates:

  • The vet tool includes a new analyzer for detecting common mistakes in tests and examples.
  • The objdump tool now supports more architectures.
  • Cgo introduces annotations for improved performance and correctness.

• You can use module_defaults to define variables for multiple ansible-freeipa tasks

  The freeipa.ansible_freeipa collection now provides the module_defaults action group that simplifies the use of ansible-freeipa modules. By using module_defaults, you can set default values to be applied to all modules of the collection used in a playbook. To do so, use the action_group named freeipa.ansible_freeipa.modules. For example:

  - name: Test
     hosts: localhost
     module_defaults:
       group/freeipa.ansible_freeipa.modules:
         ipaadmin_password: Secret123
     tasks:
  …

  Copy to Clipboard

  As a result, the playbook is more concise.

• Multiple IdM sudo rules can now be managed in a single Ansible task

  With this enhancement in ansible-freeipa, you can add, modify, and delete multiple Identity Management (IdM) sudo rules by using a single Ansible task. To do this, use the sudorules option of the ipasudorule module. As a result, you can define your sudo rules more easily, and execute them more efficiently.

  Using the sudorules option, you can specify multiple sudo rule parameters that apply to a particular sudo rule. This sudo rule is defined by the name variable, which is the only mandatory variable for the sudorules option. 

• Removing external members by using the ipagroup module now works correctly

  Previously, attempting to ensure the absence of an external member from an IdM group by using the ansible-freeipa ipagroup module with the externalmember parameter did not remove the members from the group, even though Ansible presented the result of the task as changed. With this fix, using the ipagroup module with externalmember correctly ensures the absence of an external member from an IdM group. The fix also allows the use of either DOM\name or name@domain to identify AD users.

• Read and analyze existing ranges from LDAP.
• Search for users and groups outside of ipa-local ranges.
• Propose new ipa-local ranges to cover the identified users and groups.
• Prompt the user to apply the proposed changes.

• Support of Python 3.13
• Removed support of Python 2.7, 3.6, 3.7
• Improved error handling and consistency
• Runtime deprecation of tagMap and typeMap aliases
• Support of the previously missing RELATIVE-OID construct

• Enhanced handling of new certificates in the internal token and improved the removal process on renewal.
• Removed restrictions on tokens for CKM_RSA_X_509 cryptographic mechanism.
• Fixed the documentation for the getcert add-scep-ca, --ca-cert, and --ra-cert options.
• Renamed the D-Bus service and configuration files to match canonical name.
• Added missing .TP tags in the getcert-resubmit man page.
• Migrated to the SPDX license format.
• Included owner and permissions information in the getcert list output.
• Removed the requirement for an NSS database in the cm_certread_n_parse function.
• Added translations using Webplate for Simplified Chinese, Georgian, and Russian.

• Log buffering for the error log
• An option to write the audit log in JSON format
• An option to defer updating group members when the group is updated
• An option to configure a number of PBKDF2 iterations
• The logconv.py log analyzer tool

• LMDB is highly optimized for read operations.
• LMDB avoids memory allocations and memory-to-memory copies.
• LMDB requires minimal configuration.
• LMDB supports multi-threaded and multi-process environments with no deadlocks.
• Readers never block writers, and vice versa.
• LMDB does not require transaction logs.

• nsslapd-mdb-max-size sets the database maximum size in bytes.

  Important: Make sure that nsslapd-mdb-max-size is large enough to store all intended data. However, the parameter value must not be too high to impact the performance because the database file is memory-mapped.

• nsslapd-mdb-max-readers sets the maximum number of read operations that can be opened at the same time. Directory Server autotunes this setting.
• nsslapd-mdb-max-dbs sets the maximum number of named database instances that can be included within the memory-mapped database file.

• Handling of TLS connections has been improved.
• Kerberos SASL works with STARTTLS even when the Active Directory certificate is an Elliptic Curve Cryptography (ECC) certificate and SASL_CBINDING is set to tls-endpoint.

• nsslapd-errorlog-logbuffering for the error log. Disabled by default.
• nsslapd-auditlog-logbuffering for the audit and audit fail log. Enabled by default.

• Old passwords have an old hashing iterations setting until the passwords are updated.
• An increased number of iterations can impact BIND operation performance.

• A supported HSM.
• The HSM Public-Key Cryptography Standard (PKCS) #11 library.
• An available slot, token, and the token password.

• If an authselect configuration already exists, authselect apply-changes automatically updates the configuration to the latest version. If there was no previous authselect configuration on your system, no changes are made.
• On systems managed by authselect, any non-authselect configurations are now forcefully overwritten without a prompt during the next authselect call. The --force option is no longer required.

• dyndns_dns_over_tls
• dyndns_tls_ca_cert
• dyndns_tls_cert
• dyndns_tls_key

• The GNOME default fonts have changed to Red Hat fonts (previously Abattis Cantarell for Sans and Adobe Source Code Pro for Mono).
• The default core fonts have changed from Deja Vu to the Google Noto VF family for most languages.
• The default installed Chinese, Japanese, and Korean Noto fonts are now VF, though the static fonts are still available.
• The default fonts for Indic (India), Thai, and Khmer have changed to Noto VF which also have the Serif face.
• The default Malayalam fonts have been improved.
• The default-fonts meta-packages have been introduced to pull in the appropriate default fonts for each language, making it easier to install default font coverage for particular languages. These meta-packages are installed by default for GNOME desktop.

• Indic input methods for India follow the newer Inscript 2 Government standard.
• New bash-color-prompt package sets up a default colored Bash shell prompt.

• Mozilla Firefox
• Flatpak Runtime
• SDK
• Mozilla Thunderbird

• Displaying signatures.
• Modernized user interface (UI) with the GTK4 toolkit and the libadwaita library to handle desktop and mobile use cases.
• Signing of PDF files.

• Browse files and directories on file systems you can access
• Sort files and directories by various criteria
• Filter displayed files by a sub-string
• Copy, move, delete, and rename files and directories
• Create directories
• Upload files
• Bookmark file paths
• Use keyboard shortcuts for the actions

• Configuring utilization attributes for node and primitive resources.
• Configuring node addresses and SBD options by using the ha_cluster_node_options variable. If both ha_cluster_node_options and ha_cluster variables are defined, their values are merged, with values from ha_cluster_node_options having precedence.
• Configuring access control lists (ACLs).
• Configuring Pacemaker alerts to take an external action when a cluster event such as node failure or resource starting or stopping occurs.
• Easy installation of agents for cloud environments by setting the ha_cluster_install_cloud_agents variable to true.

• Create a new encrypted and unencrypted Stratis pool
• Add new volumes to the existing Stratis pool
• Add new disks to the Stratis pool

• podman_registry_certificates (list of dictionary elements): Enables you to manage TLS certificates and keys used to connect to the specified container image registry.
• podman_validate_certs (boolean, defaults to null): Controls whether pulling images from container image registries will validate TLS certificates or not. The default null value means that it is used whatever the default configured by the containers.podman.podman_image module is. You can override the podman_validate_certs variable on a per-specification basis with the validate_certs variable.

• podman_registry_username (string, defaults to unset): Configures the username for authentication with the container image registry. You must also set the podman_registry_password variable. You can override podman_registry_username on a per-specification basis with the registry_username variable. Each operation involving credentials would then be performed according to the detailed rules and protocols defined in that specification.
• podman_registry_password (string, defaults to unset): Configures the password for authentication with the container image registry. You must also set the podman_registry_username variable. You can override podman_registry_password on a per-specification basis with the registry_password variable. Each operation involving credentials would then be performed according to the detailed rules and protocols defined in that specification. For security, encrypt the password using the Ansible Vault feature.

• journald_rate_limit_interval_sec (integer, defaults to 30): Configures a time interval in seconds, within which only the journald_rate_limit_burst log messages are handled. The journald_rate_limit_interval_sec variable corresponds to the RateLimitIntervalSec setting in the journald.conf file.
• journald_rate_limit_burst (integer, defaults to 10 000): Configures the upper limit of log messages, which are handled within the time defined by journald_rate_limit_interval_sec. The journald_rate_limit_burst variable corresponds to the RateLimitBurst setting in the journald.conf file.

• ObscureKeystrokeTiming (yes|no|interval specifier, defaults to 20): Configures whether the ssh utility should obscure the inter-keystroke timings from passive observers of network traffic.
• ChannelTimeout: Configures whether and how quickly the ssh utility should close inactive channels.

• Initial RAM disk
• NetworkManager flush module
• Dracut flush module

• mode (raw, defaults to null): Configures the FileCreateMode parameter associated with the omfile module in the rsyslog service.
• owner (string, defaults to null): Configures the fileOwner or fileOwnerNum parameter associated with the omfile module in rsyslog. If the value is an integer, it sets fileOwnerNum. Otherwise, it sets fileOwner.
• group (string, defaults to null): Configures the fileGroup or fileGroupNum parameter associated with the omfile module in rsyslog. If the value is an integer, it sets fileGroupNum. Otherwise, it sets fileGroup.
• dir_mode (defaults to null): Configures the DirCreateMode parameter associated with the omfile module in rsyslog.
• dir_owner (defaults to null): Configures the dirOwner or dirOwnerNum parameter associated with the omfile module in rsyslog. If the value is an integer, it sets dirOwnerNum. Otherwise, it sets dirOwner.
• dir_group (defaults to null): Configures the dirGroup or dirGroupNum parameter associated with the omfile module in rsyslog. If the value is an integer, it sets dirGroupNum. Otherwise, it sets dirGroup.

• Installing the packages necessary for configuring a GFS2 file system in a Red Hat high availability cluster
• Setting up the dlm and lvmlockd cluster resources
• Creating the LVM volume groups and logical volumes required by the GFS2 file system
• Creating the GFS2 file system and cluster resources with the necessary resource constraints

• mssql_tools_versions (list, defaults to version 18): Enables you to install different versions of mssql-tools.
• mssql_tls_self_sign (boolean): Specifies whether the certificates that you use are self-signed or not. Applicable when you also set the mssql_tls_enable: true variable.

• sudo_check_if_configured (boolean): Provides a semantic check of an already configured sudoers file in case the Ansible setup is not needed and is skipped.

• systemd_units_user (dictionary): Each key is a name of a user given in one of the lists passed to the role, and root (even if root is not given). Each value is a dictionary of systemd units for that user, or system units for root.

• Install the aide package on the managed node.
• Generate the /etc/aide.conf file and template it out to the managed node.
• Initialize the (Advanced Intrusion Detection Environment) AIDE database.
• Run AIDE integrity checks on the managed node.

• any: The system considers the connection activated once any IP stack is configured.
• ipv4: The system waits until IPv4 is configured.
• ipv6: The system waits until IPv6 is configured.
• ipv4+ipv6: The system waits until both IPv4 and IPv6 are configured.

• Storing and retrieving user session data.
• Real-time communication between different application parts.
• Providing fast data access for analytics and monitoring.

• logging_custom_templates: A list of custom template definitions. You can use it with the logging_outputs variable when its option is type: files or type: forwards. You can specify this custom template for each output by setting the template option in a particular logging_outputs specification. Alternatively, you can set this custom template to be used by default for all files and forwards outputs by using the logging_files_template_format and logging_forwards_template_format global options.

• Block size advertising has been enhanced and a new read-only filter has been added.
• The Python and OCaml bindings support more features of the server API.
• Internal struct integrity checks have been added to make the server more robust.

• virtio-net
• virtio-blk
• virtio-scsi/cdrom

• Migrating VMs between 64-bit ARM hosts. Note, however, that the migration currently only works when both hosts use the same CPU type and memory page size.
• The Trusted Platform Module (TPM) Interface Specification (TIS) hardware interface
• Non-volatile dual inline memory module (NVDIMM) memory device
• The virtio-iommu device

• WSL instances of RHEL might work incorrectly in a graphical interface. Using a text user interface is recommended instead.

• To use podman, you must add the following lines to the /etc/containers/containers.conf file, in addition to the standard configuration steps:

  [network]
  firewall_driver="iptables"

  Copy to Clipboard

• To use cloud-init, you must create the /etc/cloud/cloud.cfg.d/99_wsl.cfg file and add the following content to it, in addition to the standard configuration steps:

  datasource_list: [WSL]
  network: {config: disabled}

  Copy to Clipboard
• It is not possible to set SELinux to enforcing mode.
• FIPS mode is not available in WSL instances of RHEL.

• the --artifact option to create artifact manifests
• the --artifact-type, --artifact-config-type, --artifact-layer-type, --artifact-exclude-titles, and --subject options to configure the contents of the artifact manifests it creates.

• the --index option to set annotations on the index itself instead of a one of the entries in the image index
• the --subject option for setting the subject field of an image index.

• Build an image on all nodes in a farm.
• Bundle an image on all nodes in a farm up into a manifest list.
• Run the podman build command on all the farm nodes.
• Push the images to the registry specified by using the --tag option.
• Locally create a manifest list.
• Push the manifest list to the registry.

• The isManifest boolean field to determine if the target is a manifest or not. The libpod endpoint returns both images and manifest lists.
• The os and arch fields for image listing.

• cgroups v2 is used by default instead of cgroups v1
• pasta is the default network used by rootless containers instead of slirp4netns

• The podman update command supports a wide variety of options related to health checks: the --health-cmd to define a new health check and --no-healthcheck to disable an existing health check. These options make it easier to add, modify, or disable health checks on running containers. For more information, see the podman-update(5) man page.
• The --mount type=volume option for the podman run, podman create, and podman volume create commands supports a new option, subpath=, to make only a subset of the volume visible in the container.
• The --userns=keep-id option for the podman run, podman create, and podman pod create commands supports a new option, --userns=keep-id:size=, to configure the size of the user namespace.
• The podman kube play command supports Container Device Interface (CDI) devices.
• The podman run, podman create, and podman pod create commands support a new option, --hosts-file, to define the base file used for /etc/hosts in the container.
• The podman run, podman create, and podman pod create commands support a new option, --no-hostname, which disables the creation of /etc/hostname in the container.
• The podman network create command supports a new option for bridge networks, --opt mode=unmanaged, which allows Podman to use an existing network bridge on the system without changes.
• The --network option for podman run, podman create, and podman pod create accepts a new option for bridge networks, host_interface_name, which specifies a name for the network interface created outside the container.
• The podman manifest rm command supports a new option,--ignore, to proceed successfully when removing manifests that do not exist.
• The podman system prune command supports a new option, --build, to remove build containers leftover from prematurely terminated builds.
• Podman passes container hostnames to Netavark, which uses them for any DHCP requests for the container.
• Packagers can set the BUILD_ORIGIN environment variable when building podman from the Makefile. This provides information on who built the Podman binary, and this information is displayed in the podman version and podman info commands. Including this information can assist with bug reports by helping maintainers to identify the source and method of the build and installation.
• The podman kube generate and podman kube play commands can create and run Kubernetes Job YAML.
• The podman kube generate command includes information on the user namespaces for pods and containers in the generated YAML. The podman kube play command uses this information to duplicate the user namespace configuration when creating new pods based on the YAML.
• The podman kube play command supports Kubernetes volumes of type image.
• The service name of systemd units generated by Quadlet can be set with the ServiceName key in all supported Quadlet files.
• Quadlets can disable their implicit dependency on network-online.target by using a new key, DefaultDependencies, supported by all Quadlet files.
• Quadlet .container and .pod files support a new key, AddHost, to add hosts to the container or pod.
• The PublishPort key in Quadlet .container and .pod files can accept variables in its value.
• Quadlet .container files support two new keys, CgroupsMode and StartWithPod, to configure control groups for the container and whether the container will be started with the pod that it is part of.
• Quadlet .container files can use the network of another container by specifying the .container file of the container to share within the Network key.
• Quadlet .container files can mount images managed by .image files into the container by using the Mount=type=image key with an .image target.
• Quadlet .pod files support six new keys, DNS, DNSOption, DNSSearch, IP, IP6, and UserNS, to configure DNS, static IPs, and user namespace settings for the pod.
• Quadlet .image files can give an image multiple times by specifying the ImageTag key multiple times.
• Quadlets can be placed in the /run/containers/systemd directory as well as existing directories, such as $HOME/containers/systemd and /etc/containers/systemd/users.
• Quadlet properly handles subdirectories of a unit directory that is a symlink.
• The podman manifest inspect command includes the manifest’s annotations in its output.
• The --add-host option for podman create, podman run, and podman pod create supports specifying multiple hostnames, semicolon-separated (for example podman run --add-host test1;test2:192.168.1.1).
• The podman run and podman create commands support three new options for configuring health check logging: --health-log-destination (specifies where logs are stored), --health-max-log-count (specifies how many health checks worth of logs are stored), and --health-max-log-size (specifies the maximum size of the health check log).

• Pull the supplied image to set up SSH keys or access the system.
• Run the bootc install to-existing-root command with all the bind mounts and SSH keys configured.