ssh connection: fix sshpass pipe fd leaks (#86141)

When using sshpass the file descriptors leaks would happen in the reset
method that used _build_command that creates the pipe but the command
would not go through _bare_run which closes the pipe.

Another scenario would be _bare_run failing and not all code path would
properly close the pipe.

This patch fixes the issues by:
* move creating the pipe from _build_command closer to where it is used
  in _bare_run
* wrap _bare_run with closing the pipe in case of a failure
* no need to re-create pipe in the retry code
* unrelated but simplify the reset method

.azure-pipelines/azure-pipelines.yml

@@ -31,7 +31,7 @@ variables:
   - name: fetchDepth
     value: 500
   - name: defaultContainer
-    value: quay.io/ansible/azure-pipelines-test-container:6.0.0
+    value: quay.io/ansible/azure-pipelines-test-container:7.0.0
 
 pool: Standard
 
@@ -54,12 +54,12 @@ stages:
           nameFormat: Python {0}
           testFormat: units/{0}
           targets:
-            - test: 3.8
             - test: 3.9
             - test: '3.10'
             - test: 3.11
             - test: 3.12
             - test: 3.13
+            - test: 3.14
   - stage: Windows
     dependsOn: []
     jobs:
@@ -78,36 +78,40 @@ stages:
               test: 2022/psrp/http
             - name: 2022 SSH Key
               test: 2022/ssh/key
+            - name: 2025 PSRP HTTP
+              test: 2025/psrp/http
+            - name: 2025 SSH Key
+              test: 2025/ssh/key
   - stage: Remote
     dependsOn: []
     jobs:
       - template: templates/matrix.yml  # context/target
         parameters:
           targets:
-            - name: macOS 14.3
+            - name: macOS 15.3
-              test: macos/14.3
+              test: macos/15.3
-            - name: RHEL 9.4 py39
+            - name: RHEL 9.6 py39
-              test: rhel/9.4@3.9
+              test: rhel/9.6@3.9
-            - name: RHEL 9.4 py312
+            - name: RHEL 9.6 py312
-              test: rhel/9.4@3.12
+              test: rhel/9.6@3.12
-            - name: FreeBSD 13.3
+            - name: RHEL 10.0
-              test: freebsd/13.3
+              test: rhel/10.0
-            - name: FreeBSD 14.1
+            - name: FreeBSD 13.5
-              test: freebsd/14.1
+              test: freebsd/13.5
+            - name: FreeBSD 14.3
+              test: freebsd/14.3
           groups:
             - 1
             - 2
       - template: templates/matrix.yml  # context/controller
         parameters:
           targets:
-            - name: macOS 14.3
+            - name: macOS 15.3
-              test: macos/14.3
+              test: macos/15.3
-            - name: RHEL 9.4
+            - name: RHEL 9.6
-              test: rhel/9.4
+              test: rhel/9.6
-            - name: FreeBSD 13.3
+            - name: RHEL 10.0
-              test: freebsd/13.3
+              test: rhel/10.0
-            - name: FreeBSD 14.1
-              test: freebsd/14.1
           groups:
             - 3
             - 4
@@ -115,12 +119,14 @@ stages:
       - template: templates/matrix.yml  # context/controller (ansible-test container management)
         parameters:
           targets:
-            - name: Alpine 3.20
+            - name: Alpine 3.22
-              test: alpine/3.20
+              test: alpine/3.22
-            - name: Fedora 40
+            - name: Fedora 42
-              test: fedora/40
+              test: fedora/42
-            - name: RHEL 9.4
+            - name: RHEL 9.6
-              test: rhel/9.4
+              test: rhel/9.6
+            - name: RHEL 10.0
+              test: rhel/10.0
             - name: Ubuntu 24.04
               test: ubuntu/24.04
           groups:
@@ -132,10 +138,10 @@ stages:
         parameters:
           testFormat: linux/{0}
           targets:
-            - name: Alpine 3.20
+            - name: Alpine 3.22
-              test: alpine320
+              test: alpine322
-            - name: Fedora 40
+            - name: Fedora 42
-              test: fedora40
+              test: fedora42
             - name: Ubuntu 22.04
               test: ubuntu2204
             - name: Ubuntu 24.04
@@ -147,16 +153,24 @@ stages:
         parameters:
           testFormat: linux/{0}
           targets:
-            - name: Alpine 3.20
+            - name: Alpine 3.22
-              test: alpine320
+              test: alpine322
-            - name: Fedora 40
+            - name: Fedora 42
-              test: fedora40
+              test: fedora42
             - name: Ubuntu 24.04
               test: ubuntu2404
           groups:
             - 3
             - 4
             - 5
+      - template: templates/matrix.yml  # context/target (dnf-oldest, dnf-latest)
+        parameters:
+          testFormat: linux/{0}
+          targets:
+            - name: Fedora 42
+              test: fedora42
+          groups:
+            - 7
   - stage: Galaxy
     dependsOn: []
     jobs:
@@ -165,9 +179,9 @@ stages:
           nameFormat: Python {0}
           testFormat: galaxy/{0}/1
           targets:
-            - test: 3.11
             - test: 3.12
             - test: 3.13
+            - test: 3.14
   - stage: Generic
     dependsOn: []
     jobs:
@@ -176,9 +190,9 @@ stages:
           nameFormat: Python {0}
           testFormat: generic/{0}/1
           targets:
-            - test: 3.11
             - test: 3.12
             - test: 3.13
+            - test: 3.14
   - stage: Incidental_Windows
     displayName: Incidental Windows
     dependsOn: []
@@ -198,15 +212,10 @@ stages:
               test: 2022/psrp/http
             - name: 2022 SSH Key
               test: 2022/ssh/key
-  - stage: Incidental
+            - name: 2025 PSRP HTTP
-    dependsOn: []
+              test: 2025/psrp/http
-    jobs:
+            - name: 2025 SSH Key
-      - template: templates/matrix.yml
+              test: 2025/ssh/key
-        parameters:
-          testFormat: i/{0}/1
-          targets:
-            - name: IOS Python
-              test: ios/csr1000v/
   - stage: Summary
     condition: succeededOrFailed()
     dependsOn:
@@ -218,6 +227,5 @@ stages:
       - Galaxy
       - Generic
       - Incidental_Windows
-      - Incidental
     jobs:
       - template: templates/coverage.yml

.azure-pipelines/commands/generic.sh

@@ -13,6 +13,9 @@ else
     target="shippable/generic/"
 fi
 
+stage="${S:-prod}"
+
 # shellcheck disable=SC2086
 ansible-test integration --color -v --retry-on-error "${target}" ${COVERAGE:+"$COVERAGE"} ${CHANGED:+"$CHANGED"} ${UNSTABLE:+"$UNSTABLE"} \
+    --remote-terminate always --remote-stage "${stage}" \
     --docker default --python "${python}"

.azure-pipelines/commands/incidental/ios.sh

@@ -1 +0,0 @@
-network.sh

.azure-pipelines/commands/incidental/network.sh

@@ -1,40 +0,0 @@
-#!/usr/bin/env bash
-
-set -o pipefail -eux
-
-declare -a args
-IFS='/:' read -ra args <<< "$1"
-
-platform="${args[0]}"
-version="${args[1]}"
-python_version="${args[2]}"
-
-target="shippable/${platform}/incidental/"
-
-stage="${S:-prod}"
-provider="${P:-default}"
-
-# python versions to test in order
-# all versions run full tests
-IFS=' ' read -r -a python_versions <<< \
-    "$(PYTHONPATH="${PWD}/test/lib" python -c 'from ansible_test._internal import constants; print(" ".join(constants.CONTROLLER_PYTHON_VERSIONS))')"
-
-if [ "${python_version}" ]; then
-    # limit tests to a single python version
-    python_versions=("${python_version}")
-fi
-
-for python_version in "${python_versions[@]}"; do
-    # terminate remote instances on the final python version tested
-    if [ "${python_version}" = "${python_versions[-1]}" ]; then
-        terminate="always"
-    else
-        terminate="never"
-    fi
-
-    # shellcheck disable=SC2086
-    ansible-test network-integration --color -v --retry-on-error "${target}" ${COVERAGE:+"$COVERAGE"} ${CHANGED:+"$CHANGED"} ${UNSTABLE:+"$UNSTABLE"} \
-        --platform "${platform}/${version}" \
-        --docker default --python "${python_version}" \
-        --remote-terminate "${terminate}" --remote-stage "${stage}" --remote-provider "${provider}"
-done

.azure-pipelines/scripts/dependencies/.pip-tools.toml

@@ -0,0 +1,6 @@
+[tool.pip-tools]
+allow-unsafe = true  # weird outdated default
+annotation-style = "line"  # put the source tracking comments inline
+generate-hashes = false  # pip bug https://github.com/pypa/pip/issues/9243
+resolver = "backtracking"  # modern depresolver
+strip-extras = true  # so that output files are true pip constraints

.azure-pipelines/scripts/dependencies/codecov.in

@@ -0,0 +1 @@
+codecov-cli

.azure-pipelines/scripts/dependencies/codecov.txt

@@ -0,0 +1,18 @@
+#
+# This file is autogenerated by pip-compile with Python 3.13
+# by the following command:
+#
+#    pip-compile --allow-unsafe --annotation-style=line --output-file=codecov.txt --strip-extras codecov.in
+#
+certifi==2025.8.3         # via requests, sentry-sdk
+charset-normalizer==3.4.3  # via requests
+click==8.2.1              # via codecov-cli
+codecov-cli==11.2.3       # via -r codecov.in
+idna==3.10                # via requests
+ijson==3.4.0              # via codecov-cli
+pyyaml==6.0.2             # via codecov-cli
+requests==2.32.5          # via responses
+responses==0.21.0         # via codecov-cli
+sentry-sdk==2.38.0        # via codecov-cli
+test-results-parser==0.5.4  # via codecov-cli
+urllib3==2.5.0            # via requests, responses, sentry-sdk

.azure-pipelines/scripts/publish-codecov.py

@@ -9,11 +9,15 @@ from __future__ import annotations
 import argparse
 import dataclasses
 import pathlib
-import shutil
+import shlex
 import subprocess
 import tempfile
 import typing as t
-import urllib.request
+import venv
+
+
+SCRIPTS_DIR = pathlib.Path(__file__).parent.resolve()
+DEPS_DIR = SCRIPTS_DIR / 'dependencies'
 
 
 @dataclasses.dataclass(frozen=True)
@@ -43,6 +47,49 @@ def parse_args() -> Args:
     return Args(**kwargs)
 
 
+def run(
+    *args: str | pathlib.Path,
+    dry_run: bool = False,
+) -> None:
+    """
+    Log and run given command.
+
+    The command is not actually executed if ``dry_run`` is truthy.
+    """
+    cmd = [str(arg) for arg in args]
+
+    dry_prefix = '[would run] ' if dry_run else ''
+    print(f'==> {dry_prefix}{shlex.join(cmd)}', flush=True)
+
+    if not dry_run:
+        subprocess.run(cmd, check=True)
+
+
+def install_codecov(dest: pathlib.Path, dry_run: bool = False) -> pathlib.Path:
+    """Populate a transitively pinned venv with ``codecov-cli``."""
+    requirement_file = DEPS_DIR / 'codecov.in'
+    constraint_file = requirement_file.with_suffix('.txt')
+
+    venv_dir = dest / 'venv'
+    python_bin = venv_dir / 'bin' / 'python'
+    codecov_bin = venv_dir / 'bin' / 'codecovcli'
+
+    venv.create(venv_dir, with_pip=True)
+
+    run(
+        python_bin,
+        '-m',
+        'pip',
+        'install',
+        f'--constraint={constraint_file!s}',
+        f'--requirement={requirement_file!s}',
+        '--disable-pip-version-check',
+        dry_run=dry_run,
+    )
+
+    return codecov_bin
+
+
 def process_files(directory: pathlib.Path) -> t.Tuple[CoverageFile, ...]:
     processed = []
     for file in directory.joinpath('reports').glob('coverage*.xml'):
@@ -57,45 +104,67 @@ def process_files(directory: pathlib.Path) -> t.Tuple[CoverageFile, ...]:
     return tuple(processed)
 
 
-def upload_files(codecov_bin: pathlib.Path, files: t.Tuple[CoverageFile, ...], dry_run: bool = False) -> None:
+def upload_files(codecov_bin: pathlib.Path, config_file: pathlib.Path, files: t.Tuple[CoverageFile, ...], dry_run: bool = False) -> None:
     for file in files:
         cmd = [
-            str(codecov_bin),
+            codecov_bin,
-            '--name', file.name,
+            '--disable-telem',
-            '--file', str(file.path),
+            '--codecov-yml-path',
+            config_file,
+            'upload-process',
+            '--disable-search',
+            '--disable-file-fixes',
+            '--plugin',
+            'noop',
+            '--name',
+            file.name,
+            '--file',
+            file.path,
         ]
+
         for flag in file.flags:
-            cmd.extend(['--flags', flag])
+            cmd.extend(['--flag', flag])
 
         if dry_run:
-            print(f'DRY-RUN: Would run command: {cmd}')
+            cmd.append('--dry-run')
-            continue
 
-        subprocess.run(cmd, check=True)
+        run(*cmd)
 
 
-def download_file(url: str, dest: pathlib.Path, flags: int, dry_run: bool = False) -> None:
+def report_upload_completion(
-    if dry_run:
+    codecov_bin: pathlib.Path,
-        print(f'DRY-RUN: Would download {url} to {dest} and set mode to {flags:o}')
+    config_file: pathlib.Path,
-        return
+    dry_run: bool = False,
-
+) -> None:
-    with urllib.request.urlopen(url) as resp:
+    """Notify Codecov backend that all reports we wanted are in."""
-        with dest.open('w+b') as f:
+    cmd = [
-            # Read data in chunks rather than all at once
+        codecov_bin,
-            shutil.copyfileobj(resp, f, 64 * 1024)
+        '--disable-telem',
+        f'--codecov-yml-path={config_file}',
+        'send-notifications',
+    ]
 
-    dest.chmod(flags)
+    run(*cmd, dry_run=dry_run)
 
 
-def main():
+def main() -> None:
     args = parse_args()
-    url = 'https://ci-files.testing.ansible.com/codecov/linux/codecov'
-    with tempfile.TemporaryDirectory(prefix='codecov-') as tmpdir:
-        codecov_bin = pathlib.Path(tmpdir) / 'codecov'
-        download_file(url, codecov_bin, 0o755, args.dry_run)
 
+    with tempfile.TemporaryDirectory(prefix='codecov-') as tmpdir:
+        config_file = pathlib.Path(tmpdir) / 'config.yml'
+        # Refs:
+        # * https://docs.codecov.com/docs/codecovyml-reference#codecovnotifymanual_trigger
+        # * https://docs.codecov.com/docs/notifications#preventing-notifications-until-youre-ready-to-send-notifications
+        config_file.write_text('codecov:\n  notify:\n    manual_trigger: true')
+
+        codecov_bin = install_codecov(
+            pathlib.Path(tmpdir),
+            dry_run=args.dry_run,
+        )
         files = process_files(args.path)
-        upload_files(codecov_bin, files, args.dry_run)
+        upload_files(codecov_bin, config_file, files, args.dry_run)
+        # Ref: https://docs.codecov.com/docs/cli-options#send-notifications
+        report_upload_completion(codecov_bin, config_file, args.dry_run)
 
 
 if __name__ == '__main__':

.azure-pipelines/scripts/report-coverage.sh

@@ -12,6 +12,6 @@ if ! ansible-test --help >/dev/null 2>&1; then
     pip install https://github.com/ansible/ansible/archive/devel.tar.gz --disable-pip-version-check
 fi
 
-# Generate stubs using docker (if supported) otherwise fall back to using a virtual environment instead.
+# Generate stubs using docker.
-# The use of docker is required when Powershell code is present, but Ansible 2.12 was the first version to support --docker with coverage.
+# The use of docker is mandatory when Powershell code is present.
-ansible-test coverage xml --group-by command --stub --docker --color -v || ansible-test coverage xml --group-by command --stub --venv --color -v
+ansible-test coverage xml --group-by command --stub --docker --color -v

.azure-pipelines/templates/coverage.yml

@@ -7,6 +7,7 @@ jobs:
   - job: Coverage
     displayName: Code Coverage
     container: $[ variables.defaultContainer ]
+    timeoutInMinutes: 10
     workspace:
       clean: all
     steps:

.azure-pipelines/templates/test.yml

@@ -12,6 +12,7 @@ jobs:
     - job: test_${{ replace(replace(replace(replace(job.test, '/', '_'), '.', '_'), '-', '_'), '@', '_') }}
       displayName: ${{ job.name }}
       container: $[ variables.defaultContainer ]
+      timeoutInMinutes: 65
       workspace:
         clean: all
       steps:

.claude/commands/review.md

@@ -0,0 +1,55 @@
+---
+description: Review an Ansible PR following the project's standardized process from CLAUDE.md
+argument-hint: <pr_number>
+allowed-tools: [TodoWrite, Bash(gh pr view:*), Bash(gh pr diff:*), Bash(gh pr checkout:*), Bash(gh pr checks:*), Read, Grep, Glob, Search]
+---
+
+PR Review Command
+=================
+
+Review an Ansible PR following the project's standardized process from `CLAUDE.md`.
+
+Usage
+-----
+
+```bash
+/review <pr_number>
+```
+
+Arguments
+---------
+
+- `pr_number` (required): The GitHub PR number to review
+
+Implementation
+--------------
+
+This command implements the PR Review Guidelines documented in the `PR Review Guidelines` section of CLAUDE.md.
+
+Review Process Steps
+--------------------
+
+The command follows these numbered steps from CLAUDE.md:
+
+1. **Create TodoWrite list** for systematic review tracking
+2. **Get PR details**: `gh pr view <number>` to understand scope, motivation and the desired outcome
+3. **Get PR diff**: `gh pr diff <number>` to see all changes
+4. **Check required components FIRST**:
+   - Verify changelog fragment exists in `changelogs/fragments/`
+   - Verify changelog uses correct section (check `changelogs/config.yaml`)
+   - Verify tests exist and specifically cover the changed code paths
+   - Unit tests should be pytest style, and functional rather than tightly coupled to mocking
+   - Integration tests required for almost all plugin changes
+5. **Checkout PR branch**: `gh pr checkout <number>` to examine code holistically
+6. **Review existing feedback**: `gh pr view <number> --comments` for all comments and previous reviews
+7. **Verify all issues addressed**: Ensure bot failures, reviewer requests, and discussion points are resolved
+8. **Call out unresolved feedback**: Explicitly mention any discussions/requests that remain unaddressed
+
+Critical Review Elements
+------------------------
+
+- **Licensing**: Verify GPLv3/BSD-2-Clause compatibility for any new dependencies
+- **Test scope**: Tests must exercise actual changed code, not just add random coverage
+- **Changelog validation**: Fragment structure follows sections defined in `changelogs/config.yaml`
+
+Each step is tracked in TodoWrite for visibility and systematic completion. A review round should not exceed 20 feedback items.

.git-blame-ignore-revs

@@ -2,3 +2,5 @@
 # Bulk PowerShell sanity fixes
 6def4a3180fe03981ba64c6d8db28fed3bb39c0c
 716631189cb5a3f66b3add98f39e64e98bc17bf7
+# Bulk update of strings from triple single quotes to triple double quotes
+a0495fc31497798a7a833ba7406a9729e1528dd8

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -47,23 +47,7 @@ body:
 - type: dropdown
   attributes:
     label: Issue Type
-    description: >
+    description: This is a marker for our automatic bot. Do not change it.
-      Please select the single available option in the drop-down.
-
-      <details>
-        <summary>
-          <em>Why?</em>
-        </summary>
-
-        We would do it by ourselves but unfortunately, the current
-        edition of GitHub Issue Forms Alpha does not support this yet 🤷
-
-
-        _We will make it easier in the future, once GitHub
-        supports dropdown defaults. Promise!_
-
-      </details>
-    # FIXME: Once GitHub allows defining the default choice, update this
     options:
     - Bug Report
   validations:
@@ -121,7 +105,8 @@ body:
     label: Configuration
     description: >-
       Paste verbatim output from `ansible-config dump --only-changed -t all` below, under the prompt line.
-      (if using a version older than ansible-core 2.12 you should omit the '-t all')
+      Remember to redact secret values. You can easily filter Galaxy server secrets using grep,
+      for example `ansible-config dump --only-changed -t all | grep -Ev 'token|password|client_secret'`.
       Please don't wrap it with triple backticks — your
       whole input will be turned into a code snippet automatically.
     render: console
@@ -152,7 +137,7 @@ body:
   attributes:
     label: Steps to Reproduce
     description: |
-      Describe exactly how to reproduce the problem, using a minimal test-case. It would *really* help us understand your problem if you could also pased any playbooks, configs and commands you used.
+      Describe exactly how to reproduce the problem, using a minimal test-case. It would *really* help us understand your problem if you could also provide any playbooks, configs and commands you used.
 
       **HINT:** You can paste https://gist.github.com links for larger files.
     value: |

.github/ISSUE_TEMPLATE/config.yml

@@ -16,10 +16,10 @@ contact_links:
   url: https://docs.ansible.com/ansible/devel/community/code_of_conduct.html?utm_medium=github&utm_source=issue_template_chooser
   about: ❤ Be nice to other members of the community. ☮ Behave.
 - name: 💬 Talk to the community
-  url: https://docs.ansible.com/ansible/devel/community/communication.html?utm_medium=github&utm_source=issue_template_chooser#mailing-list-information
+  url: https://docs.ansible.com/ansible/devel/community/communication.html?utm_medium=github&utm_source=issue_template_chooser#forum
   about: Please ask and answer usage questions here
 - name: ⚡ Working groups
-  url: https://github.com/ansible/community/wiki
+  url: https://forum.ansible.com/g?utm_medium=github&utm_source=issue_template_chooser
   about: Interested in improving a specific area? Become a part of a working group!
 - name: 💼 For Enterprise
   url: https://www.ansible.com/products/engine?utm_medium=github&utm_source=issue_template_chooser

.github/ISSUE_TEMPLATE/documentation_report.yml

@@ -84,20 +84,7 @@ body:
 - type: dropdown
   attributes:
     label: Issue Type
-    description: >
+    description: This is a marker for our automatic bot. Do not change it.
-      Please select the single available option in the drop-down.
-
-      <details>
-        <summary>
-          <em>Why?</em>
-        </summary>
-
-
-        _We will make it easier in the future, once GitHub
-        supports dropdown defaults. Promise!_
-
-      </details>
-    # FIXME: Once GitHub allows defining the default choice, update this
     options:
     - Documentation Report
   validations:
@@ -143,6 +130,8 @@ body:
     label: Configuration
     description: >-
       Paste verbatim output from `ansible-config dump --only-changed -t all` below, under the prompt line.
+      Remember to redact secret values. You can easily filter Galaxy server secrets using grep,
+      for example `ansible-config dump --only-changed -t all | grep -Ev 'token|password|client_secret'`.
       (if using a version older than ansible-core 2.12 you should omit the '-t all')
       Please don't wrap it with triple backticks — your
       whole input will be turned into a code snippet automatically.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -101,23 +101,7 @@ body:
 - type: dropdown
   attributes:
     label: Issue Type
-    description: >
+    description: This is a marker for our automatic bot. Do not change it.
-      Please select the single available option in the drop-down.
-
-      <details>
-        <summary>
-          <em>Why?</em>
-        </summary>
-
-        We would do it by ourselves but unfortunately, the current
-        edition of GitHub Issue Forms Alpha does not support this yet 🤷
-
-
-        _We will make it easier in the future, once GitHub
-        supports dropdown defaults. Promise!_
-
-      </details>
-    # FIXME: Once GitHub allows defining the default choice, update this
     options:
     - Feature Idea
   validations:

.github/ISSUE_TEMPLATE/internal_issue.md

@@ -0,0 +1,10 @@
+---
+name: Internal Issue
+about: Free-form issue creation for core maintainer use only.
+title: ''
+labels: [core-internal]
+assignees: ''
+---
+
+
+@ansibot bot_skip

.github/ISSUE_TEMPLATE/pre_release.yml

@@ -0,0 +1,42 @@
+name: Pre-Release Bug Report
+description: File a bug report against a pre-release version
+labels:
+  - bug
+  - pre_release
+assignees:
+  - nitzmahone
+  - mattclay
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ## Bug Report
+  - type: textarea
+    attributes:
+      label: Ansible Version
+      description: Paste the full output from `ansible --version` below.
+      render: console
+      placeholder: $ ansible --version
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Summary
+      description: Describe the issue with any relevant steps to reproduce.
+    validations:
+      required: true
+  - type: dropdown
+    attributes:
+      label: <!-- Bot instructions (ignore this) -->
+      options:
+        - |
+          <!--
+          ### Component Name
+          bin/ansible
+          ### Issue Type
+          Bug Report
+          ### Configuration
+          ### OS / Environment
+          -->
+    validations:
+      required: true

.github/PULL_REQUEST_TEMPLATE/Bug fix.md

@@ -2,19 +2,8 @@
 
 <!--- Describe the change below, including rationale and design decisions -->
 
-<!--- HINT: Include "Fixes #nnn" if you are fixing an existing issue -->
+<!--- Add "Fixes #1234" or steps to reproduce the problem if there is no corresponding issue -->
 
 ##### ISSUE TYPE
 
 - Bugfix Pull Request
-
-##### ADDITIONAL INFORMATION
-
-<!--- Include additional information to help people understand the change here -->
-<!--- A step-by-step reproduction of the problem is helpful if there is no related issue -->
-
-<!--- Paste verbatim command output below, e.g. before and after your change -->
-
-```paste below
-
-```

.github/PULL_REQUEST_TEMPLATE/Documentation change.md

@@ -2,18 +2,8 @@
 
 <!--- Describe the change below, including rationale -->
 
-<!--- HINT: Include "Closes #nnn" if you are fixing an existing issue -->
+<!--- Add "Fixes #1234" if there is a corresponding issue -->
 
 ##### ISSUE TYPE
 
 - Docs Pull Request
-
-##### ADDITIONAL INFORMATION
-
-<!--- Include additional information to help people understand the change here -->
-
-<!--- Paste verbatim command output below, e.g. before and after your change -->
-
-```paste below
-
-```

.github/PULL_REQUEST_TEMPLATE/New feature.md

@@ -2,18 +2,8 @@
 
 <!--- Describe the change below, including rationale and design decisions -->
 
-<!--- HINT: Include "Resolves #nnn" if you are fixing an existing issue -->
+<!--- Add "Fixes #1234" if there is a corresponding issue -->
 
 ##### ISSUE TYPE
 
 - Feature Pull Request
-
-##### ADDITIONAL INFORMATION
-
-<!--- Include additional information to help people understand the change here -->
-
-<!--- Paste verbatim command output below, e.g. before and after your change -->
-
-```paste below
-
-```

.github/PULL_REQUEST_TEMPLATE/Tests.md

@@ -2,19 +2,8 @@
 
 <!--- Describe the change below, including rationale and design decisions -->
 
-<!--- HINT: Include "Closes #nnn" if you are fixing an existing issue -->
+<!--- Add "Fixes #1234" if there is a corresponding issue -->
 
 ##### ISSUE TYPE
 
 - Test Pull Request
-
-##### ADDITIONAL INFORMATION
-
-<!--- Include additional information to help people understand the change here -->
-<!--- A step-by-step reproduction of the problem is helpful if there is no related issue -->
-
-<!--- Paste verbatim command output below, e.g. before and after your change -->
-
-```paste below
-
-```

.github/PULL_REQUEST_TEMPLATE/Unclear purpose or motivation.md

@@ -2,7 +2,7 @@
 
 <!--- Describe the change below, including rationale and design decisions -->
 
-<!--- HINT: Include "Fixes #nnn" if you are fixing an existing issue -->
+<!--- Add "Fixes #1234" or steps to reproduce the problem if there is no corresponding issue -->
 
 ##### ISSUE TYPE
 
@@ -12,14 +12,3 @@
 - Docs Pull Request
 - Feature Pull Request
 - Test Pull Request
-
-##### ADDITIONAL INFORMATION
-
-<!--- Include additional information to help people understand the change here -->
-<!--- A step-by-step reproduction of the problem is helpful if there is no related issue -->
-
-<!--- Paste verbatim command output below, e.g. before and after your change -->
-
-```paste below
-
-```

.github/RELEASE_NAMES.txt

@@ -1,3 +1,5 @@
+2.20.0  Good Times Bad Times
+2.19.0  What Is and What Should Never Be
 2.18.0  Fool in the Rain
 2.17.0  Gallows Pole
 2.16.0  All My Love

.gitignore

@@ -97,6 +97,9 @@ Vagrantfile
 # vendored lib dir
 lib/ansible/_vendor/*
 !lib/ansible/_vendor/__init__.py
+# PowerShell signed hashlist
+lib/ansible/config/powershell_signatures.psd1
+*.authenticode
 # test stuff
 /test/integration/cloud-config-*.*
 !/test/integration/cloud-config-*.*.template
@@ -124,3 +127,5 @@ test/units/.coverage.*
 /SYMLINK_CACHE.json
 changelogs/.plugin-cache.yaml
 .ansible-test-timeout.json
+# Agents
+CLAUDE.local.md

AGENTS.md

@@ -0,0 +1,321 @@
+# AGENTS.md
+
+This file provides guidance to Claude Code (claude.ai/code) and other compatible agentic tools when working with code in this repository.
+
+**Note:** This file is for AI assistant use only. For human developers, see the [Ansible Developer Guide](https://docs.ansible.com/ansible-core/devel/dev_guide/index.html).
+
+## ⚠️ IMPORTANT: Always Start Here
+
+**BEFORE starting any PR review or development task:**
+
+1. **Read this file first** - Don't work from memory or assumptions
+2. **Use TodoWrite** to create a task list and track progress systematically
+3. **Follow the numbered steps** in the relevant process sections
+4. **Reference Quick Reference** for correct commands and patterns
+
+## ⚠️ CRITICAL: Licensing Requirements
+
+**NEVER suggest, recommend, or approve code that violates these requirements:**
+
+- **ansible-core**: All code must be **GPLv3 compatible**
+- **lib/ansible/module_utils/**: Defaults to **BSD-2-Clause** (more permissive)
+- **External dependencies**: Only recommend libraries compatible with these licenses
+- **PR reviews**: Always verify any new dependencies or suggested libraries are license-compatible
+- **When in doubt**: Ask about licensing compatibility rather than assuming
+
+**This is non-negotiable** - licensing violations can create serious legal issues for the project.
+
+## Quick Reference
+
+Most commonly used commands and patterns:
+
+```bash
+# Testing
+ansible-test sanity -v --docker default                   # Run all sanity tests
+ansible-test sanity -v --docker default --test <test>     # Run specific sanity test
+ansible-test units -v --docker default                    # Run unit tests
+ansible-test integration -v --docker ubuntu2404           # Run integration tests
+
+# PR Review and CI
+gh pr view <number>                                       # Get PR details
+gh pr view <number> --comments                            # Check for ansibot CI failures
+gh pr checks <number>                                     # Get Azure Pipelines URLs
+gh pr checkout <number>                                   # Switch to PR branch
+gh pr diff <number>                                       # See all changes
+```
+
+**Container Selection:**
+
+- Sanity/Unit tests: `--docker default`
+- Integration tests: `--docker ubuntu2204`, `--docker ubuntu2404`, etc. (NOT default/base)
+
+**Critical Reminders:**
+
+- **Licensing**: See [Licensing Requirements](#️-critical-licensing-requirements) - GPLv3/BSD-2-Clause only
+
+## Development Environment Setup
+
+Ansible development typically uses an editable install after forking and cloning:
+
+```bash
+# After forking and cloning the repository
+pip install -e .
+```
+
+**Note:** ansible-core and all CLIs (including ansible-test) require a POSIX OS. On Windows, use WSL (Windows Subsystem for Linux).
+
+## Testing and CI
+
+### Basic Testing Commands
+
+```bash
+# Run sanity tests - these are linting/static analysis (pylint, mypy, pep8, etc.)
+ansible-test sanity -v --docker default
+
+# List available sanity tests
+ansible-test sanity --list-tests
+
+# Run specific sanity tests
+ansible-test sanity -v --docker default --test pep8 --test pylint
+
+# Run sanity on specific files (paths relative to repo root)
+ansible-test sanity -v --docker default lib/ansible/modules/command.py
+
+# Run unit tests (recommended with Docker)
+ansible-test units -v --docker default
+
+# Run specific unit test (paths relative to repo root, targets in test/units/)
+ansible-test units -v --docker default test/units/modules/test_command.py
+
+# Run integration tests (choose appropriate container - NOT base/default)
+ansible-test integration -v --docker ubuntu2404
+
+# Run specific integration target (directory name in test/integration/targets/)
+ansible-test integration -v --docker ubuntu2404 setup_remote_tmp_dir
+
+# Run with coverage
+ansible-test units -v --docker default --coverage
+
+# Alternative: use --venv if Docker/Podman unavailable (less reliable for units/integration)
+ansible-test sanity -v --venv
+```
+
+Available Docker containers for testing can be found in `./test/lib/ansible_test/_data/completion/docker.txt`.
+The `base` and `default` containers are for sanity/unit tests only. For integration tests, use distro-specific
+containers, depending on the modules being tested.
+
+**Test isolation options:**
+
+- `--docker` (supports Docker or Podman) - preferred for reliable, isolated testing
+- `--venv` - fallback when containers unavailable, but unit tests may be unreliable due to host environment differences
+
+### Helping Developers with CI Failures
+
+When developers submit PRs and encounter CI failures, use these approaches to help diagnose and resolve issues:
+
+**1. Check for ansibot comments:**
+
+```bash
+# Get all PR comments to find ansibot CI failure reports
+gh pr view <number> --comments
+```
+
+Look for comments from `ansibot` that contain:
+- Test failure details with specific error messages
+- File paths and line numbers for failures
+- Links to sanity test documentation (e.g., `[explain](https://docs.ansible.com/...`)
+
+**2. Get CI check status and URLs:**
+
+```bash
+# See all CI check results with Azure Pipelines URLs
+gh pr checks <number>
+```
+
+This shows:
+- Overall CI status (pass/fail) with timing
+- Direct links to Azure DevOps build results
+- Individual job results (Sanity Test 1/2, Docker tests, Units, etc.)
+
+**3. Common CI failure patterns:**
+
+- **Sanity failures**: Usually have specific fixes (trailing whitespace, import errors, etc.)
+- **Integration test failures**: May require platform-specific containers or test adjustments
+- **Unit test failures**: Often indicate actual code issues that need debugging
+
+**4. CI failure analysis workflow:**
+
+1. Check ansibot comments first for immediate error details
+2. Use `gh pr checks <number>` to get Azure Pipelines URLs for detailed logs
+3. Focus on failed jobs (marked as `fail`) and examine their specific error output
+4. For sanity test failures, the error messages usually indicate exactly what needs to be fixed
+5. For test failures, run the same tests locally using `ansible-test` to reproduce and debug
+
+## PR Review Guidelines
+
+### PR Review Checklist
+
+Use this checklist for EVERY PR review:
+
+```text
+□ Created TodoWrite list for review steps
+□ Step 1: Get PR details with gh pr view <number>
+□ Step 2: Get PR diff with gh pr diff <number>
+□ Step 3: Check required components (changelog, tests)
+□ Step 4: Checkout PR branch with gh pr checkout <number>
+□ Step 5: Review existing feedback with gh pr view <number> --comments
+□ Step 6: Verify all issues addressed
+□ Step 7: Call out any unresolved feedback
+□ Mark each TodoWrite item as completed when done
+```
+
+When assisting with PR reviews, verify:
+
+### Required Components
+
+- Changelog fragment exists in `changelogs/fragments/`
+- Appropriate tests are included and cover the changed code
+  - Unit tests should be pytest style, and functional rather than tightly coupled to mocking
+  - Integration tests required for almost all plugin changes (tests the public API)
+  - Tests should exercise the actual changed code, not just add random coverage
+
+### Review Process
+
+Follow these steps in order for thorough PR reviews:
+
+1. **Get PR details**: Use `gh pr view <number>` to understand the PR scope and description
+2. **Get PR diff**: Use `gh pr diff <number>` to see all changes
+3. **Check required components FIRST**:
+   - Verify changelog fragment exists and uses correct section (check `changelogs/config.yaml` for valid sections)
+   - Verify tests exist and specifically cover the changed code paths
+4. **Checkout PR branch**: Use `gh pr checkout <number>` to examine code holistically with changes applied
+5. **Review existing feedback**: Use `gh pr view <number> --comments` to see all comments and previous review feedback
+6. **Verify all issues addressed**: Ensure all bot failures, reviewer requests, and discussion points are resolved
+7. **Call out any unresolved review feedback**: Explicitly mention any discussions or requests that remain unaddressed
+
+### Common Review Issues to Check
+
+- **Changelog section errors**: Verify changelog uses valid section from `changelogs/config.yaml`. Fragment structure follows sections defined there.
+- **Test scope**: Ensure tests exercise the actual changed code, not just add random coverage.
+  Integration tests required for almost all plugin changes (tests the public API).
+  Tests should be functional rather than tightly coupled to mocking.
+
+### Review Task Management
+
+- Use TodoWrite tool to track review steps for complex PRs
+- Mark tasks as in_progress when actively working on them
+- Complete tasks immediately after finishing each step
+- This provides visibility to users about review progress
+
+### Review Tools
+
+- `gh pr view <number>` - Get PR details and description
+- `gh pr view <number> --comments` - See all comments and review feedback
+- `gh pr diff <number>` - Get complete diff of changes
+- `gh pr checkout <number>` - Switch to PR branch for holistic examination
+- `Read` tool - Examine specific changed files in detail
+- `Grep` tool - Search for related code patterns or test coverage (uses ripgrep/rg)
+
+## Development Guidelines
+
+### Code Style Notes
+
+- Line limit is 160 characters (not 80)
+- E402 (module level import not at top) is ignored
+- In `lib/ansible/modules/`, imports must come after DOCUMENTATION, EXAMPLES, and RETURN definitions
+- Don't add obvious comments about code
+- Use native type hints with `from __future__ import annotations` (converts to strings at runtime)
+- Don't document module parameters in docstrings - migrate to type hints instead
+- **No trailing whitespace**: Always clean up trailing spaces on lines, especially when editing existing files
+
+### Python Version Support
+
+- Controller code: support range defined in `pyproject.toml`
+- Modules/module_utils: minimum version in `lib/ansible/module_utils/basic.py` (`_PY_MIN`) up to max from `pyproject.toml`
+- Modules support a wider Python version range than controller code
+
+### Dependencies and Imports
+
+- Prefer Python stdlib over external dependencies
+- Use existing code from within the Ansible project
+- `lib/ansible/modules/` can only import from `lib/ansible/module_utils/` (modules are packaged for remote execution)
+- `lib/ansible/module_utils/` cannot import from outside itself
+
+## Documentation Standards
+
+### Module and Plugin Documentation
+
+- Modules and plugins require DOCUMENTATION, EXAMPLES, and RETURN blocks as static YAML string variables
+- These blocks cannot be dynamically generated - they are parsed via AST/token parsing
+- Alternative: "sidecar" documentation as `.yml` files with same stem name adjacent to plugin files
+- All modules should have a `main()` function and `if __name__ == '__main__':` block
+- Use `version_added` fields in documentation following existing version format patterns
+
+### Changelog Requirements
+
+- Changes require entries in `changelogs/fragments/` as YAML files
+- Create a new fragment file per PR (never reuse existing fragments to avoid merge conflicts)
+- Fragment structure follows sections defined in `changelogs/config.yaml` under the `sections` key
+- Naming: `{issue_number}-{short-description}.yml` or `{component}-{description}.yml` if no issue
+- Format: `- {component} - {description} ({optional URL to GH issue})`
+- Content supports Sphinx markup (use double backticks for code references)
+
+## Repository Management
+
+### Plugin Development
+
+- New plugins should go into collections, not ansible-core
+- ansible-core rarely accepts new plugins; core team makes these decisions
+
+### Branch and Release Management
+
+- All PRs target the `devel` branch
+- Use GitHub templates when creating issues/PRs (`.github/ISSUE_TEMPLATE/` and `.github/PULL_REQUEST_TEMPLATE/`)
+- For issues: fill out the `component` field with project root relative file path
+- For PRs: adjust the issue type in the template as listed in `.github/PULL_REQUEST_TEMPLATE/PULL_REQUEST_TEMPLATE.md`
+- Validate issues are fixed in `devel` before reporting against stable releases
+- Bug fixes: backported to latest stable only
+- Critical bug fixes: backported to latest and previous stable
+- Security issues: contact security@ansible.com privately, not via GitHub
+
+### Backwards Compatibility
+
+- Backwards compatibility is prioritized over most other concerns
+- Deprecation cycle: 4 releases (deprecation + 2 releases + removal)
+- Use `Display.deprecated` or `AnsibleModule.deprecate` with version from `lib/ansible/release.py` plus 3
+- Example: deprecating in 2.19 means removal in 2.22
+
+## Code Structure Reference
+
+### Core Structure
+
+- `lib/ansible/` - Main Ansible library code
+  - `cli/` - Command-line interface implementations (ansible, ansible-playbook, etc.)
+  - `executor/` - Task execution engine and strategies (includes PowerShell support in `powershell/`)
+  - `inventory/` - Inventory management and parsing
+  - `modules/` - Core modules (built-in automation modules)
+  - `module_utils/` - Shared utilities for modules (includes C# in `csharp/` and PowerShell in `powershell/`)
+  - `plugins/` - Plugin framework (filters, tests, lookups, etc.)
+  - `vars/` - Variable management
+  - `config/` - Configuration handling
+  - `collections/` - Ansible Collections framework
+
+### Key Components
+
+- **CLI Layer**: Entry points in `lib/ansible/cli/` handle command parsing and dispatch
+- **Executor**: `lib/ansible/executor/` contains the core execution engine that runs tasks and plays
+- **Module System**: Modules in `lib/ansible/modules/` are the units of work; they're executed remotely
+- **Plugin Architecture**: `lib/ansible/plugins/` provides extensibility through filters, tests, lookups, etc.
+- **Inventory**: `lib/ansible/inventory/` manages host and group definitions
+- **Collections**: Modern packaging format for distributing Ansible content
+
+### Testing Infrastructure
+
+- `test/units/` - Unit tests mirroring the lib structure
+- `test/integration/` - Integration tests organized by target (named after plugin/functionality being tested)
+  - Some targets have `context/controller` or `context/target` in their `aliases` file when not easily inferable
+  - Only modules run on target hosts; all other plugins execute locally in the ansible process
+- `test/lib/` - Test utilities and frameworks
+- `ansible-test` - Unified testing tool for all test types
+
+For CI failure debugging, see [Helping Developers with CI Failures](#helping-developers-with-ci-failures).

CLAUDE.md

@@ -0,0 +1,3 @@
+- @AGENTS.md
+- @~/.claude/ansible.md
+- @CLAUDE.local.md

changelogs/changelog.yaml

@@ -1,2 +1,2 @@
-ancestor: 2.17.0
+ancestor: 2.20.0
 releases: {}

changelogs/fragments/42960_vault_password.yml

@@ -1,3 +0,0 @@
----
-bugfixes:
-- vault - handle vault password file value when it is directory (https://github.com/ansible/ansible/issues/42960).

changelogs/fragments/46314.yml

@@ -1,3 +0,0 @@
----
-bugfixes:
-  - apt - report changed=True when some packages are being removed (https://github.com/ansible/ansible/issues/46314).

changelogs/fragments/46742-atomic_move-fix-setgid.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - atomic_move - fix using the setgid bit on the parent directory when creating files (https://github.com/ansible/ansible/issues/46742, https://github.com/ansible/ansible/issues/67177).

changelogs/fragments/62151-loop_control-until.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - loop_control - add a break_when option to to break out of a task loop early based on Jinja2 expressions (https://github.com/ansible/ansible/issues/83442).

changelogs/fragments/64092-get_url_verify_tmpsrc_checksum.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - get_url - Verify checksum using tmpsrc, not dest (https://github.com/ansible/ansible/pull/64092)

changelogs/fragments/72321_git.yml

@@ -1,3 +0,0 @@
----
-bugfixes:
-- git - check if git version is available or not before using it for comparison (https://github.com/ansible/ansible/issues/72321).

changelogs/fragments/81770-add-uid-guid-minmax-keys.yml

@@ -1,3 +0,0 @@
-minor_changes:
-    - Add ``uid_min``, ``uid_max`` to the user plugin to overwrite the defaults provided by the ``/etc/login.defs`` file (https://github.com/ansible/ansible/pull/81770).
-    - Add ``gid_min``, ``gid_max`` to the group plugin to overwrite the defaults provided by the ``/etc/login.defs`` file (https://github.com/ansible/ansible/pull/81770).

changelogs/fragments/82075.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - addressed issue of trailing text been ignored, non-ASCII characters are parsed, enhance white space handling and fixed overly permissive issue of human_to_bytes filter(https://github.com/ansible/ansible/issues/82075)

changelogs/fragments/82307-handlers-lockstep-linear-fix.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - Fix handlers not being executed in lockstep using the linear strategy in some cases (https://github.com/ansible/ansible/issues/82307)

changelogs/fragments/82490_creating_user_dir_using_tilde_always_reports_changed.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - fixed the issue of creating user directory using tilde(~) always reported "changed".(https://github.com/ansible/ansible/issues/82490)

changelogs/fragments/82535-properly-quote-shell.yml

@@ -1,2 +0,0 @@
-bugfixes:
-- shell plugin - properly quote all needed components of shell commands (https://github.com/ansible/ansible/issues/82535)

changelogs/fragments/82671-ansible-doc-role-examples.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - "ansible-doc - show examples in role entrypoint argument specs (https://github.com/ansible/ansible/pull/82671)."

changelogs/fragments/82831_countme_yum_repository.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - support the countme option when using yum_repository

changelogs/fragments/82878-fetch-dest-is-dir.yml

@@ -1,4 +0,0 @@
-bugfixes:
-- >-
-    fetch - add error message when using ``dest`` with a trailing slash that becomes a local directory -
-    https://github.com/ansible/ansible/issues/82878

changelogs/fragments/82941.yml

@@ -1,5 +0,0 @@
----
-removed_features:
-  - paramiko_ssh - removed deprecated ssh_extra_args from the paramiko_ssh connection plugin (https://github.com/ansible/ansible/issues/82941).
-  - paramiko_ssh - removed deprecated ssh_common_args from the paramiko_ssh connection plugin (https://github.com/ansible/ansible/issues/82940).
-  - paramiko_ssh - removed deprecated ssh_args from the paramiko_ssh connection plugin (https://github.com/ansible/ansible/issues/82939).

changelogs/fragments/82946.yml

@@ -1,3 +0,0 @@
----
-removed_features:
-  - play_context - remove deprecated PlayContext.verbosity property (https://github.com/ansible/ansible/issues/82945).

changelogs/fragments/82947.yml

@@ -1,3 +0,0 @@
----
-removed_features:
-  - loader - remove deprecated non-inclusive words (https://github.com/ansible/ansible/issues/82947).

changelogs/fragments/83019-linear-handlers-lockstep-fix.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - "linear strategy: fix handlers included via ``include_tasks`` handler to be executed in lockstep (https://github.com/ansible/ansible/issues/83019)"

changelogs/fragments/83031.yml

@@ -1,3 +0,0 @@
----
-bugfixes:
-  - lookup - Fixed examples of csv lookup plugin (https://github.com/ansible/ansible/issues/83031).

changelogs/fragments/83155-ansible-doc-paragraphs.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - "ansible-doc - format top-level descriptions with multiple paragraphs as multiple paragraphs, instead of concatenating them (https://github.com/ansible/ansible/pull/83155)."

changelogs/fragments/83235-copy-module-update-mtime.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - copy - mtime/atime not updated. Fix now update mtime/atime(https://github.com/ansible/ansible/issues/83013)

changelogs/fragments/83294-meta-host_pinned-affinity.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - Fix for ``meta`` tasks breaking host/fork affinity with ``host_pinned`` strategy (https://github.com/ansible/ansible/issues/83294)

changelogs/fragments/83327.yml

@@ -1,3 +0,0 @@
----
-bugfixes:
-  - fixed unit test test_borken_cowsay to address mock not been properly applied when existing unix system already have cowsay installed.

changelogs/fragments/83331.yml

@@ -1,3 +0,0 @@
----
-bugfixes:
-  - facts - add facts about x86_64 flags to detect microarchitecture (https://github.com/ansible/ansible/issues/83331).

changelogs/fragments/83373-dnf5-wildcard.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - dnf, dnf5 - fix for installing a set of packages by specifying them using a wildcard character (https://github.com/ansible/ansible/issues/83373)

changelogs/fragments/83392-fix-memory-issues-handlers.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - Fix rapid memory usage growth when notifying handlers using the ``listen`` keyword (https://github.com/ansible/ansible/issues/83392)

changelogs/fragments/83406-dnf-fix-arch-cmp.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - dnf - fix an issue where two packages of the same ``evr`` but different arch failed to install (https://github.com/ansible/ansible/issues/83406)

changelogs/fragments/83447-end_host-rescue-rc.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - "``end_host`` - fix incorrect return code when executing ``end_host`` in the ``rescue`` section (https://github.com/ansible/ansible/issues/83447)"

changelogs/fragments/83457-service_facts-openbsd-dont-crash-in-equals.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - service_facts - don't crash if OpenBSD rcctl variable contains '=' character (https://github.com/ansible/ansible/issues/83457)

changelogs/fragments/83469-http-test-container.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - "ansible-test - update HTTP test container to 3.2.0 (https://github.com/ansible/ansible/pull/83469)."

changelogs/fragments/83480-fix-support-discard.yml

@@ -1,6 +0,0 @@
----
-bugfixes:
-  - facts - `support_discard` now returns `0` if either `discard_granularity`
-    or `discard_max_hw_bytes` is zero; otherwise it returns the value of
-    `discard_granularity`, as before
-    (https://github.com/ansible/ansible/pull/83480).

changelogs/fragments/83498-command-tb-env.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - Fix a traceback when an environment variable contains certain special characters (https://github.com/ansible/ansible/issues/83498)

changelogs/fragments/83508_mount_facts.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - Add a new mount_facts module to support gathering information about mounts that are excluded by default fact gathering.

changelogs/fragments/83530-validate-modules-casing.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - "validate-modules sanity test - reject option/aliases names that are identical up to casing but belong to different options (https://github.com/ansible/ansible/pull/83530)."

changelogs/fragments/83540-update_disto_version.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - distro package - update the distro package version from 1.8.0 to 1.9.0  (https://github.com/ansible/ansible/issues/82935)

changelogs/fragments/83541-add-sl-micro-suse-family.yaml

@@ -1,2 +0,0 @@
-minor_changes:
-- distribution.py - Added SL-Micro in Suse OS Family. (https://github.com/ansible/ansible/pull/83541)

changelogs/fragments/83575-fix-sanity-ignore-for-find.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - find - change the datatype of ``elements`` to ``path`` in option ``paths`` (https://github.com/ansible/ansible/pull/83575).

changelogs/fragments/83599-validate-modules-aliases.yml

@@ -1,3 +0,0 @@
-minor_changes:
-  - "validate-modules sanity test - detect if names of an option (option name + aliases) do not match between argument spec and documentation
-     (https://github.com/ansible/ansible/issues/83598, https://github.com/ansible/ansible/pull/83599)."

changelogs/fragments/83601-debconf-normalize-bools.yml

@@ -1,3 +0,0 @@
----
-bugfixes:
-  - debconf - fix normalization of value representation for boolean vtypes in new packages (https://github.com/ansible/ansible/issues/83594)

changelogs/fragments/83619-loop-label-register.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - Fix an issue where registered variable was not available for templating in ``loop_control.label`` on skipped looped tasks (https://github.com/ansible/ansible/issues/83619)

changelogs/fragments/83716-enable-subkey-fingerprint-validation-in-rpm-key-module.yml

@@ -1,4 +0,0 @@
----
-minor_changes:
-  - rpm_key - allow validation of gpg key with a subkey fingerprint
-  - rpm_key - enable gpg validation that requires presence of multiple fingerprints

changelogs/fragments/83755-ini-new-interpolation-option.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - ini lookup - add new ``interpolation`` option (https://github.com/ansible/ansible/issues/83755)

changelogs/fragments/83803-collection-import-poll-interval.yml

@@ -1,4 +0,0 @@
-minor_changes:
-- >-
-  ``ansible-galaxy collection publish`` - add configuration options for the initial poll interval
-  and the exponential when checking the import status of a collection, since the default is relatively slow.

changelogs/fragments/83831-runtime-metadata-fix.yml

@@ -1,3 +0,0 @@
-bugfixes:
-  - "runtime-metadata sanity test - do not crash on deprecations if ``galaxy.yml`` contains an empty ``version`` field (https://github.com/ansible/ansible/pull/83831)."
-  - "Fix ``SemanticVersion.parse()`` to store the version string so that ``__repr__`` reports it instead of ``None`` (https://github.com/ansible/ansible/pull/83831)."

changelogs/fragments/83874-include-parse-error-location.yml

@@ -1,4 +0,0 @@
-bugfixes:
-  - >-
-    include_tasks - Display location when attempting to load a task list where ``include_*`` did not specify any value -
-    https://github.com/ansible/ansible/issues/83874

changelogs/fragments/83960-dnf5-state-installed-fix.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - "dnf5 - re-introduce the ``state: installed`` alias to ``state: present`` (https://github.com/ansible/ansible/issues/83960)"

changelogs/fragments/85193-runtime-metadata.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - ansible-test - The runtime-metadata sanity test now ignores pre-release and build identifiers in collection versions. This prevents errors if a tombstone version is ``X.0.0``, while the collection's version is ``X.0.0-prerelease`` (https://github.com/ansible/ansible/issues/85193)."

changelogs/fragments/85254-apt-version-comparison-bugfix.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+  - apt - Stop the >= operator from being ignored for packages that are not already installed (https://github.com/ansible/ansible/pull/85254)

changelogs/fragments/85259-fix-human_to_bytes.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - "Fix ``AnsibleModule.human_to_bytes()``, which was never adjusted after the standalone ``human_to_bytes()`` got a new parameter ``default_unit`` (https://github.com/ansible/ansible/pull/85259)."

changelogs/fragments/85623-fix-pip-check-mode-vcs.yml

@@ -0,0 +1,5 @@
+bugfixes:
+  - >-
+    ``ansible.builtin.pip`` - Running the built-in pip module with ``check_mode`` and packages coming from VCS URLs, archives, or local filepaths now correctly outputs the ``changed`` status of the task.
+    Previously, it was always reported as changed due to improper package name resolution. 
+    (https://github.com/ansible/ansible/pull/85623)

changelogs/fragments/85767-ansible-virtualization-freebsd.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - ansible_virtualization_role and ansible_virtualization_type facts - fix the detection of vms running inside FreeBSD Bhyve hypervisor and detection of jails  (https://github.com/ansible/ansible/pull/85767)

changelogs/fragments/85918-handle-missing-results.yml

@@ -0,0 +1,6 @@
+---
+bugfixes:
+  - galaxy - previously, some corrupted cache files could cause Ansible Galaxy to fail
+    with a traceback. This has been corrected to display a clear error message explaining
+    how to resolve the problem. 
+    (https://github.com/ansible/ansible/issues/85918)

changelogs/fragments/85966-psrp-readtimeout.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - psrp - ReadTimeout exceptions now mark host as unreachable instead of fatal (https://github.com/ansible/ansible/issues/85966)

changelogs/fragments/85997-basic-py-deprecations.yml

@@ -0,0 +1,2 @@
+removed_features:
+  - Removed deprecated ability to import ``datetime``, ``signal``, ``types``, ``chain``, ``repeat``, ``map`` and ``shlex_quote`` from ``ansible.module_utils.basic``.

changelogs/fragments/86003-remove-deprecated-handle_stats_and_callbacks.yml

@@ -0,0 +1,2 @@
+removed_features:
+  - Removed deprecated ``handle_stats_and_callbacks`` parameter of the ``StrategyBase._load_included_file`` method. (https://github.com/ansible/ansible/issues/86003)

changelogs/fragments/86079-ansible-test-validate-modules-bad-return-keys.yml

@@ -0,0 +1,2 @@
+minor_changes:
+  - "ansible-test validate-modules sanity test - now reports bad return value keys that cannot be used with the dot notation in Jinja expressions (https://github.com/ansible/ansible/issues/86079)."

changelogs/fragments/86128-fix-script-decrypt-docs-mismatch.yml

@@ -0,0 +1,3 @@
+---
+minor_changes:
+  - script - remove the currently unsupported ``decrypt`` argument from the module documentation (https://github.com/ansible/ansible/issues/86067).

changelogs/fragments/86147-fix-iptables-extension-handling.yml

@@ -0,0 +1,6 @@
+---
+bugfixes:
+  - >-
+    iptables - The module can now detect when a extensions added with the module ``match`` argument have 
+    been automatically imported by other module arguments such as ``uid_owner`` and prevents duplicate
+    extension imports which previously caused an error (https://github.com/ansible/ansible/issues/84387). 

changelogs/fragments/PowerShell-AddType-temp.yml

@@ -1,7 +0,0 @@
-bugfixes:
-- >-
-  powershell - Implement more robust deletion mechanism for C# code compilation
-  temporary files. This should avoid scenarios where the underlying temporary
-  directory may be temporarily locked by antivirus tools or other IO problems.
-  A failure to delete one of these temporary directories will result in a
-  warning rather than an outright failure.

changelogs/fragments/action-plugin-docs-sidecar.yml

@@ -1,2 +0,0 @@
-bugfixes:
-- ansible-test action-plugin-docs - Fix to check for sidecar documentation for action plugins

changelogs/fragments/add-type-warning.yml

@@ -0,0 +1,5 @@
+bugfixes:
+  - >-
+    Windows - ignore temporary file cleanup warning when using AnsibleModule to
+    compile C# utils. This should reduce the number of warnings that can safely
+    be ignored when running PowerShell modules - https://github.com/ansible/ansible/issues/85976

changelogs/fragments/add_systemd_facts.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - facts - add systemd version and features

changelogs/fragments/ansiballz-wrapper-sitecustomize.yml

@@ -0,0 +1,2 @@
+bugfixes:
+- modules - fix AnsiballZ wrapper code escaping of sitecustomize

changelogs/fragments/ansible-config-validate.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - ansible-config has new 'validate' option to find mispelled/forgein configurations in ini file or environment variables.

changelogs/fragments/ansible-doc-color.yml

@@ -1,3 +0,0 @@
----
-bugfixes:
-  - ansible-doc - make colors configurable.

changelogs/fragments/ansible-doc-inicate.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - ansible-doc - fixed "inicates" typo in output

changelogs/fragments/ansible-doc.yml

@@ -1,3 +0,0 @@
----
-bugfixes:
-  - ansible-doc - handle no_fail condition for role.

changelogs/fragments/ansible-drop-python-3.7.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - The minimum supported Python version on targets is now Python 3.8.

changelogs/fragments/ansible-galaxy-install-archive-url-timeout.yml

@@ -1,4 +0,0 @@
-bugfixes:
-- >-
-  ``ansible-galaxy role install`` - update the default timeout to download
-  archive URLs from 20 seconds to 60 (https://github.com/ansible/ansible/issues/83521).

changelogs/fragments/ansible-galaxy-install-help.yml

@@ -1,5 +0,0 @@
-bugfixes:
-- >-
-  Add descriptions for ``ansible-galaxy install --help` and ``ansible-galaxy role|collection install --help``.
-- >-
-  ``ansible-galaxy install --help`` - Fix the usage text and document that the requirements file passed to ``-r`` can include collections and roles.

changelogs/fragments/ansible-galaxy-role-install-symlink.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - ansible-galaxy role install - fix symlinks (https://github.com/ansible/ansible/issues/82702, https://github.com/ansible/ansible/issues/81965).