ssh connection: fix sshpass pipe fd leaks (#86141)

When using sshpass the file descriptors leaks would happen in the reset
method that used _build_command that creates the pipe but the command
would not go through _bare_run which closes the pipe.

Another scenario would be _bare_run failing and not all code path would
properly close the pipe.

This patch fixes the issues by:
* move creating the pipe from _build_command closer to where it is used
  in _bare_run
* wrap _bare_run with closing the pipe in case of a failure
* no need to re-create pipe in the retry code
* unrelated but simplify the reset method

.azure-pipelines/azure-pipelines.yml

@@ -31,7 +31,7 @@ variables:
   - name: fetchDepth
     value: 500
   - name: defaultContainer
-    value: quay.io/ansible/azure-pipelines-test-container:6.0.0
+    value: quay.io/ansible/azure-pipelines-test-container:7.0.0
 
 pool: Standard
 
@@ -54,12 +54,12 @@ stages:
           nameFormat: Python {0}
           testFormat: units/{0}
           targets:
-            - test: 3.8
             - test: 3.9
             - test: '3.10'
             - test: 3.11
             - test: 3.12
             - test: 3.13
+            - test: 3.14
   - stage: Windows
     dependsOn: []
     jobs:
@@ -90,14 +90,16 @@ stages:
           targets:
             - name: macOS 15.3
               test: macos/15.3
-            - name: RHEL 9.5 py39
+            - name: RHEL 9.6 py39
-              test: rhel/9.5@3.9
+              test: rhel/9.6@3.9
-            - name: RHEL 9.5 py312
+            - name: RHEL 9.6 py312
-              test: rhel/9.5@3.12
+              test: rhel/9.6@3.12
+            - name: RHEL 10.0
+              test: rhel/10.0
             - name: FreeBSD 13.5
               test: freebsd/13.5
-            - name: FreeBSD 14.2
+            - name: FreeBSD 14.3
-              test: freebsd/14.2
+              test: freebsd/14.3
           groups:
             - 1
             - 2
@@ -106,12 +108,10 @@ stages:
           targets:
             - name: macOS 15.3
               test: macos/15.3
-            - name: RHEL 9.5
+            - name: RHEL 9.6
-              test: rhel/9.5
+              test: rhel/9.6
-            - name: FreeBSD 13.5
+            - name: RHEL 10.0
-              test: freebsd/13.5
+              test: rhel/10.0
-            - name: FreeBSD 14.2
-              test: freebsd/14.2
           groups:
             - 3
             - 4
@@ -119,12 +119,14 @@ stages:
       - template: templates/matrix.yml  # context/controller (ansible-test container management)
         parameters:
           targets:
-            - name: Alpine 3.21
+            - name: Alpine 3.22
-              test: alpine/3.21
+              test: alpine/3.22
-            - name: Fedora 41
+            - name: Fedora 42
-              test: fedora/41
+              test: fedora/42
-            - name: RHEL 9.5
+            - name: RHEL 9.6
-              test: rhel/9.5
+              test: rhel/9.6
+            - name: RHEL 10.0
+              test: rhel/10.0
             - name: Ubuntu 24.04
               test: ubuntu/24.04
           groups:
@@ -136,10 +138,10 @@ stages:
         parameters:
           testFormat: linux/{0}
           targets:
-            - name: Alpine 3.21
+            - name: Alpine 3.22
-              test: alpine321
+              test: alpine322
-            - name: Fedora 41
+            - name: Fedora 42
-              test: fedora41
+              test: fedora42
             - name: Ubuntu 22.04
               test: ubuntu2204
             - name: Ubuntu 24.04
@@ -151,16 +153,24 @@ stages:
         parameters:
           testFormat: linux/{0}
           targets:
-            - name: Alpine 3.21
+            - name: Alpine 3.22
-              test: alpine321
+              test: alpine322
-            - name: Fedora 41
+            - name: Fedora 42
-              test: fedora41
+              test: fedora42
             - name: Ubuntu 24.04
               test: ubuntu2404
           groups:
             - 3
             - 4
             - 5
+      - template: templates/matrix.yml  # context/target (dnf-oldest, dnf-latest)
+        parameters:
+          testFormat: linux/{0}
+          targets:
+            - name: Fedora 42
+              test: fedora42
+          groups:
+            - 7
   - stage: Galaxy
     dependsOn: []
     jobs:
@@ -169,9 +179,9 @@ stages:
           nameFormat: Python {0}
           testFormat: galaxy/{0}/1
           targets:
-            - test: 3.11
             - test: 3.12
             - test: 3.13
+            - test: 3.14
   - stage: Generic
     dependsOn: []
     jobs:
@@ -180,9 +190,9 @@ stages:
           nameFormat: Python {0}
           testFormat: generic/{0}/1
           targets:
-            - test: 3.11
             - test: 3.12
             - test: 3.13
+            - test: 3.14
   - stage: Incidental_Windows
     displayName: Incidental Windows
     dependsOn: []
@@ -206,15 +216,6 @@ stages:
               test: 2025/psrp/http
             - name: 2025 SSH Key
               test: 2025/ssh/key
-  - stage: Incidental
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: i/{0}/1
-          targets:
-            - name: IOS Python
-              test: ios/csr1000v/
   - stage: Summary
     condition: succeededOrFailed()
     dependsOn:
@@ -226,6 +227,5 @@ stages:
       - Galaxy
       - Generic
       - Incidental_Windows
-      - Incidental
     jobs:
       - template: templates/coverage.yml

.azure-pipelines/commands/generic.sh

@@ -13,6 +13,9 @@ else
     target="shippable/generic/"
 fi
 
+stage="${S:-prod}"
+
 # shellcheck disable=SC2086
 ansible-test integration --color -v --retry-on-error "${target}" ${COVERAGE:+"$COVERAGE"} ${CHANGED:+"$CHANGED"} ${UNSTABLE:+"$UNSTABLE"} \
+    --remote-terminate always --remote-stage "${stage}" \
     --docker default --python "${python}"

.azure-pipelines/commands/incidental/ios.sh

@@ -1 +0,0 @@
-network.sh

.azure-pipelines/commands/incidental/network.sh

@@ -1,40 +0,0 @@
-#!/usr/bin/env bash
-
-set -o pipefail -eux
-
-declare -a args
-IFS='/:' read -ra args <<< "$1"
-
-platform="${args[0]}"
-version="${args[1]}"
-python_version="${args[2]}"
-
-target="shippable/${platform}/incidental/"
-
-stage="${S:-prod}"
-provider="${P:-default}"
-
-# python versions to test in order
-# all versions run full tests
-IFS=' ' read -r -a python_versions <<< \
-    "$(PYTHONPATH="${PWD}/test/lib" python -c 'from ansible_test._internal import constants; print(" ".join(constants.CONTROLLER_PYTHON_VERSIONS))')"
-
-if [ "${python_version}" ]; then
-    # limit tests to a single python version
-    python_versions=("${python_version}")
-fi
-
-for python_version in "${python_versions[@]}"; do
-    # terminate remote instances on the final python version tested
-    if [ "${python_version}" = "${python_versions[-1]}" ]; then
-        terminate="always"
-    else
-        terminate="never"
-    fi
-
-    # shellcheck disable=SC2086
-    ansible-test network-integration --color -v --retry-on-error "${target}" ${COVERAGE:+"$COVERAGE"} ${CHANGED:+"$CHANGED"} ${UNSTABLE:+"$UNSTABLE"} \
-        --platform "${platform}/${version}" \
-        --docker default --python "${python_version}" \
-        --remote-terminate "${terminate}" --remote-stage "${stage}" --remote-provider "${provider}"
-done

.azure-pipelines/scripts/dependencies/.pip-tools.toml

@@ -0,0 +1,6 @@
+[tool.pip-tools]
+allow-unsafe = true  # weird outdated default
+annotation-style = "line"  # put the source tracking comments inline
+generate-hashes = false  # pip bug https://github.com/pypa/pip/issues/9243
+resolver = "backtracking"  # modern depresolver
+strip-extras = true  # so that output files are true pip constraints

.azure-pipelines/scripts/dependencies/codecov.in

@@ -0,0 +1 @@
+codecov-cli

.azure-pipelines/scripts/dependencies/codecov.txt

@@ -0,0 +1,18 @@
+#
+# This file is autogenerated by pip-compile with Python 3.13
+# by the following command:
+#
+#    pip-compile --allow-unsafe --annotation-style=line --output-file=codecov.txt --strip-extras codecov.in
+#
+certifi==2025.8.3         # via requests, sentry-sdk
+charset-normalizer==3.4.3  # via requests
+click==8.2.1              # via codecov-cli
+codecov-cli==11.2.3       # via -r codecov.in
+idna==3.10                # via requests
+ijson==3.4.0              # via codecov-cli
+pyyaml==6.0.2             # via codecov-cli
+requests==2.32.5          # via responses
+responses==0.21.0         # via codecov-cli
+sentry-sdk==2.38.0        # via codecov-cli
+test-results-parser==0.5.4  # via codecov-cli
+urllib3==2.5.0            # via requests, responses, sentry-sdk

.azure-pipelines/scripts/publish-codecov.py

@@ -9,11 +9,15 @@ from __future__ import annotations
 import argparse
 import dataclasses
 import pathlib
-import shutil
+import shlex
 import subprocess
 import tempfile
 import typing as t
-import urllib.request
+import venv
+
+
+SCRIPTS_DIR = pathlib.Path(__file__).parent.resolve()
+DEPS_DIR = SCRIPTS_DIR / 'dependencies'
 
 
 @dataclasses.dataclass(frozen=True)
@@ -43,6 +47,49 @@ def parse_args() -> Args:
     return Args(**kwargs)
 
 
+def run(
+    *args: str | pathlib.Path,
+    dry_run: bool = False,
+) -> None:
+    """
+    Log and run given command.
+
+    The command is not actually executed if ``dry_run`` is truthy.
+    """
+    cmd = [str(arg) for arg in args]
+
+    dry_prefix = '[would run] ' if dry_run else ''
+    print(f'==> {dry_prefix}{shlex.join(cmd)}', flush=True)
+
+    if not dry_run:
+        subprocess.run(cmd, check=True)
+
+
+def install_codecov(dest: pathlib.Path, dry_run: bool = False) -> pathlib.Path:
+    """Populate a transitively pinned venv with ``codecov-cli``."""
+    requirement_file = DEPS_DIR / 'codecov.in'
+    constraint_file = requirement_file.with_suffix('.txt')
+
+    venv_dir = dest / 'venv'
+    python_bin = venv_dir / 'bin' / 'python'
+    codecov_bin = venv_dir / 'bin' / 'codecovcli'
+
+    venv.create(venv_dir, with_pip=True)
+
+    run(
+        python_bin,
+        '-m',
+        'pip',
+        'install',
+        f'--constraint={constraint_file!s}',
+        f'--requirement={requirement_file!s}',
+        '--disable-pip-version-check',
+        dry_run=dry_run,
+    )
+
+    return codecov_bin
+
+
 def process_files(directory: pathlib.Path) -> t.Tuple[CoverageFile, ...]:
     processed = []
     for file in directory.joinpath('reports').glob('coverage*.xml'):
@@ -57,45 +104,67 @@ def process_files(directory: pathlib.Path) -> t.Tuple[CoverageFile, ...]:
     return tuple(processed)
 
 
-def upload_files(codecov_bin: pathlib.Path, files: t.Tuple[CoverageFile, ...], dry_run: bool = False) -> None:
+def upload_files(codecov_bin: pathlib.Path, config_file: pathlib.Path, files: t.Tuple[CoverageFile, ...], dry_run: bool = False) -> None:
     for file in files:
         cmd = [
-            str(codecov_bin),
+            codecov_bin,
-            '--name', file.name,
+            '--disable-telem',
-            '--file', str(file.path),
+            '--codecov-yml-path',
+            config_file,
+            'upload-process',
+            '--disable-search',
+            '--disable-file-fixes',
+            '--plugin',
+            'noop',
+            '--name',
+            file.name,
+            '--file',
+            file.path,
         ]
+
         for flag in file.flags:
-            cmd.extend(['--flags', flag])
+            cmd.extend(['--flag', flag])
 
         if dry_run:
-            print(f'DRY-RUN: Would run command: {cmd}')
+            cmd.append('--dry-run')
-            continue
-
-        subprocess.run(cmd, check=True)
 
+        run(*cmd)
 
-def download_file(url: str, dest: pathlib.Path, flags: int, dry_run: bool = False) -> None:
-    if dry_run:
-        print(f'DRY-RUN: Would download {url} to {dest} and set mode to {flags:o}')
-        return
 
-    with urllib.request.urlopen(url) as resp:
+def report_upload_completion(
-        with dest.open('w+b') as f:
+    codecov_bin: pathlib.Path,
-            # Read data in chunks rather than all at once
+    config_file: pathlib.Path,
-            shutil.copyfileobj(resp, f, 64 * 1024)
+    dry_run: bool = False,
+) -> None:
+    """Notify Codecov backend that all reports we wanted are in."""
+    cmd = [
+        codecov_bin,
+        '--disable-telem',
+        f'--codecov-yml-path={config_file}',
+        'send-notifications',
+    ]
 
-    dest.chmod(flags)
+    run(*cmd, dry_run=dry_run)
 
 
-def main():
+def main() -> None:
     args = parse_args()
-    url = 'https://ci-files.testing.ansible.com/codecov/linux/codecov'
-    with tempfile.TemporaryDirectory(prefix='codecov-') as tmpdir:
-        codecov_bin = pathlib.Path(tmpdir) / 'codecov'
-        download_file(url, codecov_bin, 0o755, args.dry_run)
 
+    with tempfile.TemporaryDirectory(prefix='codecov-') as tmpdir:
+        config_file = pathlib.Path(tmpdir) / 'config.yml'
+        # Refs:
+        # * https://docs.codecov.com/docs/codecovyml-reference#codecovnotifymanual_trigger
+        # * https://docs.codecov.com/docs/notifications#preventing-notifications-until-youre-ready-to-send-notifications
+        config_file.write_text('codecov:\n  notify:\n    manual_trigger: true')
+
+        codecov_bin = install_codecov(
+            pathlib.Path(tmpdir),
+            dry_run=args.dry_run,
+        )
         files = process_files(args.path)
-        upload_files(codecov_bin, files, args.dry_run)
+        upload_files(codecov_bin, config_file, files, args.dry_run)
+        # Ref: https://docs.codecov.com/docs/cli-options#send-notifications
+        report_upload_completion(codecov_bin, config_file, args.dry_run)
 
 
 if __name__ == '__main__':

.azure-pipelines/templates/coverage.yml

@@ -7,6 +7,7 @@ jobs:
   - job: Coverage
     displayName: Code Coverage
     container: $[ variables.defaultContainer ]
+    timeoutInMinutes: 10
     workspace:
       clean: all
     steps:

.azure-pipelines/templates/test.yml

@@ -12,6 +12,7 @@ jobs:
     - job: test_${{ replace(replace(replace(replace(job.test, '/', '_'), '.', '_'), '-', '_'), '@', '_') }}
       displayName: ${{ job.name }}
       container: $[ variables.defaultContainer ]
+      timeoutInMinutes: 65
       workspace:
         clean: all
       steps:

.claude/commands/review.md

@@ -0,0 +1,55 @@
+---
+description: Review an Ansible PR following the project's standardized process from CLAUDE.md
+argument-hint: <pr_number>
+allowed-tools: [TodoWrite, Bash(gh pr view:*), Bash(gh pr diff:*), Bash(gh pr checkout:*), Bash(gh pr checks:*), Read, Grep, Glob, Search]
+---
+
+PR Review Command
+=================
+
+Review an Ansible PR following the project's standardized process from `CLAUDE.md`.
+
+Usage
+-----
+
+```bash
+/review <pr_number>
+```
+
+Arguments
+---------
+
+- `pr_number` (required): The GitHub PR number to review
+
+Implementation
+--------------
+
+This command implements the PR Review Guidelines documented in the `PR Review Guidelines` section of CLAUDE.md.
+
+Review Process Steps
+--------------------
+
+The command follows these numbered steps from CLAUDE.md:
+
+1. **Create TodoWrite list** for systematic review tracking
+2. **Get PR details**: `gh pr view <number>` to understand scope, motivation and the desired outcome
+3. **Get PR diff**: `gh pr diff <number>` to see all changes
+4. **Check required components FIRST**:
+   - Verify changelog fragment exists in `changelogs/fragments/`
+   - Verify changelog uses correct section (check `changelogs/config.yaml`)
+   - Verify tests exist and specifically cover the changed code paths
+   - Unit tests should be pytest style, and functional rather than tightly coupled to mocking
+   - Integration tests required for almost all plugin changes
+5. **Checkout PR branch**: `gh pr checkout <number>` to examine code holistically
+6. **Review existing feedback**: `gh pr view <number> --comments` for all comments and previous reviews
+7. **Verify all issues addressed**: Ensure bot failures, reviewer requests, and discussion points are resolved
+8. **Call out unresolved feedback**: Explicitly mention any discussions/requests that remain unaddressed
+
+Critical Review Elements
+------------------------
+
+- **Licensing**: Verify GPLv3/BSD-2-Clause compatibility for any new dependencies
+- **Test scope**: Tests must exercise actual changed code, not just add random coverage
+- **Changelog validation**: Fragment structure follows sections defined in `changelogs/config.yaml`
+
+Each step is tracked in TodoWrite for visibility and systematic completion. A review round should not exceed 20 feedback items.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -105,7 +105,8 @@ body:
     label: Configuration
     description: >-
       Paste verbatim output from `ansible-config dump --only-changed -t all` below, under the prompt line.
-      (if using a version older than ansible-core 2.12 you should omit the '-t all')
+      Remember to redact secret values. You can easily filter Galaxy server secrets using grep,
+      for example `ansible-config dump --only-changed -t all | grep -Ev 'token|password|client_secret'`.
       Please don't wrap it with triple backticks — your
       whole input will be turned into a code snippet automatically.
     render: console
@@ -136,7 +137,7 @@ body:
   attributes:
     label: Steps to Reproduce
     description: |
-      Describe exactly how to reproduce the problem, using a minimal test-case. It would *really* help us understand your problem if you could also pased any playbooks, configs and commands you used.
+      Describe exactly how to reproduce the problem, using a minimal test-case. It would *really* help us understand your problem if you could also provide any playbooks, configs and commands you used.
 
       **HINT:** You can paste https://gist.github.com links for larger files.
     value: |

.github/ISSUE_TEMPLATE/documentation_report.yml

@@ -130,6 +130,8 @@ body:
     label: Configuration
     description: >-
       Paste verbatim output from `ansible-config dump --only-changed -t all` below, under the prompt line.
+      Remember to redact secret values. You can easily filter Galaxy server secrets using grep,
+      for example `ansible-config dump --only-changed -t all | grep -Ev 'token|password|client_secret'`.
       (if using a version older than ansible-core 2.12 you should omit the '-t all')
       Please don't wrap it with triple backticks — your
       whole input will be turned into a code snippet automatically.

.github/ISSUE_TEMPLATE/pre_release.yml

@@ -1,9 +1,8 @@
-name: Fallible 2.19 Data Tagging Preview Bug Report
+name: Pre-Release Bug Report
-description: File a bug report against the Fallible 2.19 Data Tagging Preview
+description: File a bug report against a pre-release version
 labels:
-  - fallible_dt
   - bug
-  - data_tagging
+  - pre_release
 assignees:
   - nitzmahone
   - mattclay
@@ -12,15 +11,14 @@ body:
     attributes:
       value: |
         ## Bug Report
-  - type: dropdown
+  - type: textarea
     attributes:
-      label: Fallible Version
+      label: Ansible Version
-      description: The fallible release that reproduces the issue described.
+      description: Paste the full output from `ansible --version` below.
-      options:
+      render: console
-        - 2025.4.1
+      placeholder: $ ansible --version
-        - 2025.3.11
+    validations:
-        - 2025.3.3
+      required: true
-        - 2025.1.30
   - type: textarea
     attributes:
       label: Summary
@@ -37,8 +35,6 @@ body:
           bin/ansible
           ### Issue Type
           Bug Report
-          ### Ansible Version
-          2.19.0.dev0
           ### Configuration
           ### OS / Environment
           -->

.github/RELEASE_NAMES.txt

@@ -1,3 +1,4 @@
+2.20.0  Good Times Bad Times
 2.19.0  What Is and What Should Never Be
 2.18.0  Fool in the Rain
 2.17.0  Gallows Pole

.gitignore

@@ -97,6 +97,9 @@ Vagrantfile
 # vendored lib dir
 lib/ansible/_vendor/*
 !lib/ansible/_vendor/__init__.py
+# PowerShell signed hashlist
+lib/ansible/config/powershell_signatures.psd1
+*.authenticode
 # test stuff
 /test/integration/cloud-config-*.*
 !/test/integration/cloud-config-*.*.template
@@ -124,3 +127,5 @@ test/units/.coverage.*
 /SYMLINK_CACHE.json
 changelogs/.plugin-cache.yaml
 .ansible-test-timeout.json
+# Agents
+CLAUDE.local.md

AGENTS.md

@@ -0,0 +1,321 @@
+# AGENTS.md
+
+This file provides guidance to Claude Code (claude.ai/code) and other compatible agentic tools when working with code in this repository.
+
+**Note:** This file is for AI assistant use only. For human developers, see the [Ansible Developer Guide](https://docs.ansible.com/ansible-core/devel/dev_guide/index.html).
+
+## ⚠️ IMPORTANT: Always Start Here
+
+**BEFORE starting any PR review or development task:**
+
+1. **Read this file first** - Don't work from memory or assumptions
+2. **Use TodoWrite** to create a task list and track progress systematically
+3. **Follow the numbered steps** in the relevant process sections
+4. **Reference Quick Reference** for correct commands and patterns
+
+## ⚠️ CRITICAL: Licensing Requirements
+
+**NEVER suggest, recommend, or approve code that violates these requirements:**
+
+- **ansible-core**: All code must be **GPLv3 compatible**
+- **lib/ansible/module_utils/**: Defaults to **BSD-2-Clause** (more permissive)
+- **External dependencies**: Only recommend libraries compatible with these licenses
+- **PR reviews**: Always verify any new dependencies or suggested libraries are license-compatible
+- **When in doubt**: Ask about licensing compatibility rather than assuming
+
+**This is non-negotiable** - licensing violations can create serious legal issues for the project.
+
+## Quick Reference
+
+Most commonly used commands and patterns:
+
+```bash
+# Testing
+ansible-test sanity -v --docker default                   # Run all sanity tests
+ansible-test sanity -v --docker default --test <test>     # Run specific sanity test
+ansible-test units -v --docker default                    # Run unit tests
+ansible-test integration -v --docker ubuntu2404           # Run integration tests
+
+# PR Review and CI
+gh pr view <number>                                       # Get PR details
+gh pr view <number> --comments                            # Check for ansibot CI failures
+gh pr checks <number>                                     # Get Azure Pipelines URLs
+gh pr checkout <number>                                   # Switch to PR branch
+gh pr diff <number>                                       # See all changes
+```
+
+**Container Selection:**
+
+- Sanity/Unit tests: `--docker default`
+- Integration tests: `--docker ubuntu2204`, `--docker ubuntu2404`, etc. (NOT default/base)
+
+**Critical Reminders:**
+
+- **Licensing**: See [Licensing Requirements](#️-critical-licensing-requirements) - GPLv3/BSD-2-Clause only
+
+## Development Environment Setup
+
+Ansible development typically uses an editable install after forking and cloning:
+
+```bash
+# After forking and cloning the repository
+pip install -e .
+```
+
+**Note:** ansible-core and all CLIs (including ansible-test) require a POSIX OS. On Windows, use WSL (Windows Subsystem for Linux).
+
+## Testing and CI
+
+### Basic Testing Commands
+
+```bash
+# Run sanity tests - these are linting/static analysis (pylint, mypy, pep8, etc.)
+ansible-test sanity -v --docker default
+
+# List available sanity tests
+ansible-test sanity --list-tests
+
+# Run specific sanity tests
+ansible-test sanity -v --docker default --test pep8 --test pylint
+
+# Run sanity on specific files (paths relative to repo root)
+ansible-test sanity -v --docker default lib/ansible/modules/command.py
+
+# Run unit tests (recommended with Docker)
+ansible-test units -v --docker default
+
+# Run specific unit test (paths relative to repo root, targets in test/units/)
+ansible-test units -v --docker default test/units/modules/test_command.py
+
+# Run integration tests (choose appropriate container - NOT base/default)
+ansible-test integration -v --docker ubuntu2404
+
+# Run specific integration target (directory name in test/integration/targets/)
+ansible-test integration -v --docker ubuntu2404 setup_remote_tmp_dir
+
+# Run with coverage
+ansible-test units -v --docker default --coverage
+
+# Alternative: use --venv if Docker/Podman unavailable (less reliable for units/integration)
+ansible-test sanity -v --venv
+```
+
+Available Docker containers for testing can be found in `./test/lib/ansible_test/_data/completion/docker.txt`.
+The `base` and `default` containers are for sanity/unit tests only. For integration tests, use distro-specific
+containers, depending on the modules being tested.
+
+**Test isolation options:**
+
+- `--docker` (supports Docker or Podman) - preferred for reliable, isolated testing
+- `--venv` - fallback when containers unavailable, but unit tests may be unreliable due to host environment differences
+
+### Helping Developers with CI Failures
+
+When developers submit PRs and encounter CI failures, use these approaches to help diagnose and resolve issues:
+
+**1. Check for ansibot comments:**
+
+```bash
+# Get all PR comments to find ansibot CI failure reports
+gh pr view <number> --comments
+```
+
+Look for comments from `ansibot` that contain:
+- Test failure details with specific error messages
+- File paths and line numbers for failures
+- Links to sanity test documentation (e.g., `[explain](https://docs.ansible.com/...`)
+
+**2. Get CI check status and URLs:**
+
+```bash
+# See all CI check results with Azure Pipelines URLs
+gh pr checks <number>
+```
+
+This shows:
+- Overall CI status (pass/fail) with timing
+- Direct links to Azure DevOps build results
+- Individual job results (Sanity Test 1/2, Docker tests, Units, etc.)
+
+**3. Common CI failure patterns:**
+
+- **Sanity failures**: Usually have specific fixes (trailing whitespace, import errors, etc.)
+- **Integration test failures**: May require platform-specific containers or test adjustments
+- **Unit test failures**: Often indicate actual code issues that need debugging
+
+**4. CI failure analysis workflow:**
+
+1. Check ansibot comments first for immediate error details
+2. Use `gh pr checks <number>` to get Azure Pipelines URLs for detailed logs
+3. Focus on failed jobs (marked as `fail`) and examine their specific error output
+4. For sanity test failures, the error messages usually indicate exactly what needs to be fixed
+5. For test failures, run the same tests locally using `ansible-test` to reproduce and debug
+
+## PR Review Guidelines
+
+### PR Review Checklist
+
+Use this checklist for EVERY PR review:
+
+```text
+□ Created TodoWrite list for review steps
+□ Step 1: Get PR details with gh pr view <number>
+□ Step 2: Get PR diff with gh pr diff <number>
+□ Step 3: Check required components (changelog, tests)
+□ Step 4: Checkout PR branch with gh pr checkout <number>
+□ Step 5: Review existing feedback with gh pr view <number> --comments
+□ Step 6: Verify all issues addressed
+□ Step 7: Call out any unresolved feedback
+□ Mark each TodoWrite item as completed when done
+```
+
+When assisting with PR reviews, verify:
+
+### Required Components
+
+- Changelog fragment exists in `changelogs/fragments/`
+- Appropriate tests are included and cover the changed code
+  - Unit tests should be pytest style, and functional rather than tightly coupled to mocking
+  - Integration tests required for almost all plugin changes (tests the public API)
+  - Tests should exercise the actual changed code, not just add random coverage
+
+### Review Process
+
+Follow these steps in order for thorough PR reviews:
+
+1. **Get PR details**: Use `gh pr view <number>` to understand the PR scope and description
+2. **Get PR diff**: Use `gh pr diff <number>` to see all changes
+3. **Check required components FIRST**:
+   - Verify changelog fragment exists and uses correct section (check `changelogs/config.yaml` for valid sections)
+   - Verify tests exist and specifically cover the changed code paths
+4. **Checkout PR branch**: Use `gh pr checkout <number>` to examine code holistically with changes applied
+5. **Review existing feedback**: Use `gh pr view <number> --comments` to see all comments and previous review feedback
+6. **Verify all issues addressed**: Ensure all bot failures, reviewer requests, and discussion points are resolved
+7. **Call out any unresolved review feedback**: Explicitly mention any discussions or requests that remain unaddressed
+
+### Common Review Issues to Check
+
+- **Changelog section errors**: Verify changelog uses valid section from `changelogs/config.yaml`. Fragment structure follows sections defined there.
+- **Test scope**: Ensure tests exercise the actual changed code, not just add random coverage.
+  Integration tests required for almost all plugin changes (tests the public API).
+  Tests should be functional rather than tightly coupled to mocking.
+
+### Review Task Management
+
+- Use TodoWrite tool to track review steps for complex PRs
+- Mark tasks as in_progress when actively working on them
+- Complete tasks immediately after finishing each step
+- This provides visibility to users about review progress
+
+### Review Tools
+
+- `gh pr view <number>` - Get PR details and description
+- `gh pr view <number> --comments` - See all comments and review feedback
+- `gh pr diff <number>` - Get complete diff of changes
+- `gh pr checkout <number>` - Switch to PR branch for holistic examination
+- `Read` tool - Examine specific changed files in detail
+- `Grep` tool - Search for related code patterns or test coverage (uses ripgrep/rg)
+
+## Development Guidelines
+
+### Code Style Notes
+
+- Line limit is 160 characters (not 80)
+- E402 (module level import not at top) is ignored
+- In `lib/ansible/modules/`, imports must come after DOCUMENTATION, EXAMPLES, and RETURN definitions
+- Don't add obvious comments about code
+- Use native type hints with `from __future__ import annotations` (converts to strings at runtime)
+- Don't document module parameters in docstrings - migrate to type hints instead
+- **No trailing whitespace**: Always clean up trailing spaces on lines, especially when editing existing files
+
+### Python Version Support
+
+- Controller code: support range defined in `pyproject.toml`
+- Modules/module_utils: minimum version in `lib/ansible/module_utils/basic.py` (`_PY_MIN`) up to max from `pyproject.toml`
+- Modules support a wider Python version range than controller code
+
+### Dependencies and Imports
+
+- Prefer Python stdlib over external dependencies
+- Use existing code from within the Ansible project
+- `lib/ansible/modules/` can only import from `lib/ansible/module_utils/` (modules are packaged for remote execution)
+- `lib/ansible/module_utils/` cannot import from outside itself
+
+## Documentation Standards
+
+### Module and Plugin Documentation
+
+- Modules and plugins require DOCUMENTATION, EXAMPLES, and RETURN blocks as static YAML string variables
+- These blocks cannot be dynamically generated - they are parsed via AST/token parsing
+- Alternative: "sidecar" documentation as `.yml` files with same stem name adjacent to plugin files
+- All modules should have a `main()` function and `if __name__ == '__main__':` block
+- Use `version_added` fields in documentation following existing version format patterns
+
+### Changelog Requirements
+
+- Changes require entries in `changelogs/fragments/` as YAML files
+- Create a new fragment file per PR (never reuse existing fragments to avoid merge conflicts)
+- Fragment structure follows sections defined in `changelogs/config.yaml` under the `sections` key
+- Naming: `{issue_number}-{short-description}.yml` or `{component}-{description}.yml` if no issue
+- Format: `- {component} - {description} ({optional URL to GH issue})`
+- Content supports Sphinx markup (use double backticks for code references)
+
+## Repository Management
+
+### Plugin Development
+
+- New plugins should go into collections, not ansible-core
+- ansible-core rarely accepts new plugins; core team makes these decisions
+
+### Branch and Release Management
+
+- All PRs target the `devel` branch
+- Use GitHub templates when creating issues/PRs (`.github/ISSUE_TEMPLATE/` and `.github/PULL_REQUEST_TEMPLATE/`)
+- For issues: fill out the `component` field with project root relative file path
+- For PRs: adjust the issue type in the template as listed in `.github/PULL_REQUEST_TEMPLATE/PULL_REQUEST_TEMPLATE.md`
+- Validate issues are fixed in `devel` before reporting against stable releases
+- Bug fixes: backported to latest stable only
+- Critical bug fixes: backported to latest and previous stable
+- Security issues: contact security@ansible.com privately, not via GitHub
+
+### Backwards Compatibility
+
+- Backwards compatibility is prioritized over most other concerns
+- Deprecation cycle: 4 releases (deprecation + 2 releases + removal)
+- Use `Display.deprecated` or `AnsibleModule.deprecate` with version from `lib/ansible/release.py` plus 3
+- Example: deprecating in 2.19 means removal in 2.22
+
+## Code Structure Reference
+
+### Core Structure
+
+- `lib/ansible/` - Main Ansible library code
+  - `cli/` - Command-line interface implementations (ansible, ansible-playbook, etc.)
+  - `executor/` - Task execution engine and strategies (includes PowerShell support in `powershell/`)
+  - `inventory/` - Inventory management and parsing
+  - `modules/` - Core modules (built-in automation modules)
+  - `module_utils/` - Shared utilities for modules (includes C# in `csharp/` and PowerShell in `powershell/`)
+  - `plugins/` - Plugin framework (filters, tests, lookups, etc.)
+  - `vars/` - Variable management
+  - `config/` - Configuration handling
+  - `collections/` - Ansible Collections framework
+
+### Key Components
+
+- **CLI Layer**: Entry points in `lib/ansible/cli/` handle command parsing and dispatch
+- **Executor**: `lib/ansible/executor/` contains the core execution engine that runs tasks and plays
+- **Module System**: Modules in `lib/ansible/modules/` are the units of work; they're executed remotely
+- **Plugin Architecture**: `lib/ansible/plugins/` provides extensibility through filters, tests, lookups, etc.
+- **Inventory**: `lib/ansible/inventory/` manages host and group definitions
+- **Collections**: Modern packaging format for distributing Ansible content
+
+### Testing Infrastructure
+
+- `test/units/` - Unit tests mirroring the lib structure
+- `test/integration/` - Integration tests organized by target (named after plugin/functionality being tested)
+  - Some targets have `context/controller` or `context/target` in their `aliases` file when not easily inferable
+  - Only modules run on target hosts; all other plugins execute locally in the ansible process
+- `test/lib/` - Test utilities and frameworks
+- `ansible-test` - Unified testing tool for all test types
+
+For CI failure debugging, see [Helping Developers with CI Failures](#helping-developers-with-ci-failures).

CLAUDE.md

@@ -0,0 +1,3 @@
+- @AGENTS.md
+- @~/.claude/ansible.md
+- @CLAUDE.local.md

changelogs/changelog.yaml

@@ -1,2 +1,2 @@
-ancestor: 2.18.0
+ancestor: 2.20.0
 releases: {}

changelogs/fragments/81709-ansible-galaxy-slow-resolution-hints.yml

@@ -1,10 +0,0 @@
----
-
-minor_changes:
-- >-
-  ``ansible-galaxy collection install`` — the collection dependency resolver
-  now prints out conflicts it hits during dependency resolution when it's
-  taking too long and it ends up backtracking a lot. It also displays
-  suggestions on how to help it compute the result more quickly.
-
-...

changelogs/fragments/81812-ansible-galaxy-negative-spec-is-pinned.yml

@@ -1,8 +0,0 @@
----
-
-bugfixes:
-- >-
-  ``ansible-galaxy`` — the collection dependency resolver now treats
-  version specifiers starting with ``!=`` as unpinned.
-
-...

changelogs/fragments/81874-deprecate-datetime-compat.yml

@@ -1,11 +0,0 @@
----
-
-deprecated_features:
-- >-
-  ``ansible.module_utils.compat.datetime`` - The datetime compatibility
-  shims are now deprecated. They are scheduled to be removed in
-  ``ansible-core`` v2.21. This includes ``UTC``, ``utcfromtimestamp()``
-  and ``utcnow`` importable from said module
-  (https://github.com/ansible/ansible/pull/81874).
-
-...

changelogs/fragments/83642-fix-sanity-ignore-for-uri.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - uri - mark ``url`` as required (https://github.com/ansible/ansible/pull/83642).

changelogs/fragments/83643-fix-sanity-ignore-for-copy.yml

@@ -1,3 +0,0 @@
-minor_changes:
-  - copy - parameter ``local_follow`` was incorrectly documented as having default value ``True`` (https://github.com/ansible/ansible/pull/83643).
-  - copy - fix sanity test failures (https://github.com/ansible/ansible/pull/83643).

changelogs/fragments/83690-get_url-content-disposition-filename.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - get_url - fix honoring ``filename`` from the ``content-disposition`` header even when the type is ``inline`` (https://github.com/ansible/ansible/issues/83690)

changelogs/fragments/83700-enable-file-disable-diff.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - file - enable file module to disable diff_mode (https://github.com/ansible/ansible/issues/80817).

changelogs/fragments/83757-deprecate-paramiko.yml

@@ -1,2 +0,0 @@
-deprecated_features:
-- paramiko - The paramiko connection plugin has been deprecated with planned removal in 2.21.

changelogs/fragments/83936-ssh-askpass.yml

@@ -1,3 +0,0 @@
-minor_changes:
-- ssh connection plugin - Support ``SSH_ASKPASS`` mechanism to provide passwords, making it the default, but still offering an explicit choice to use ``sshpass``
-  (https://github.com/ansible/ansible/pull/83936)

changelogs/fragments/83965-action-groups-schema.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - "runtime-metadata sanity test - improve validation of ``action_groups`` (https://github.com/ansible/ansible/pull/83965)."

changelogs/fragments/84008-additional-logging.yml

@@ -1,3 +0,0 @@
-minor_changes:
-  - Added a -vvvvv log message indicating when a host fails to produce output within the timeout period.
-  - SSH Escalation-related -vvv log messages now include the associated host information.

changelogs/fragments/84019-ignore_unreachable-loop.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - Fix returning 'unreachable' for the overall task result. This prevents false positives when a looped task has unignored unreachable items (https://github.com/ansible/ansible/issues/84019).

changelogs/fragments/84149-add-flush-cache-for-adhoc-commands.yml

@@ -1,3 +0,0 @@
-minor_changes:
-- >
-  ansible, ansible-console, ansible-pull - add --flush-cache option (https://github.com/ansible/ansible/issues/83749).

changelogs/fragments/84206-dnf5-apt-auto-install-module-deps.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - dnf5, apt - add ``auto_install_module_deps`` option (https://github.com/ansible/ansible/issues/84206)

changelogs/fragments/84213-ansible-galaxy-url-building.yml

@@ -1,2 +0,0 @@
-bugfixes:
-- ansible-galaxy - Small adjustments to URL building for ``download_url`` and relative redirects.

changelogs/fragments/84229-windows-server-2025.yml

@@ -1,4 +0,0 @@
-minor_changes:
-  - >-
-    Windows - Add support for Windows Server 2025 to Ansible and as an ``ansible-test``
-    remote target - https://github.com/ansible/ansible/issues/84229

changelogs/fragments/84238-fix-reset_connection-ssh_executable-templated.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - ssh - connection options were incorrectly templated during ``reset_connection`` tasks (https://github.com/ansible/ansible/pull/84238).

changelogs/fragments/84259-dnf5-latest-fix.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - "dnf5 - fix installing a package using ``state=latest`` when a binary of the same name as the package is already installed (https://github.com/ansible/ansible/issues/84259)"

changelogs/fragments/84321-added-ansible_uptime_seconds_aix.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - ansible_uptime_second - added ansible_uptime_seconds fact support for AIX (https://github.com/ansible/ansible/pull/84321).

changelogs/fragments/84325-validate-modules-seealso-fqcn.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - "validate-modules sanity test - make sure that ``module`` and ``plugin`` ``seealso`` entries use FQCNs (https://github.com/ansible/ansible/pull/84325)."

changelogs/fragments/84334-dnf5-consolidate-settings.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - dnf5 - matching on a binary can be achieved only by specifying a full path (https://github.com/ansible/ansible/issues/84334)

changelogs/fragments/84384-fix-undefined-key-host-group-vars.yml

@@ -1,4 +0,0 @@
-# Filename: changelogs/fragments/84384-fix-undefined-key-host-group-vars.yml
-
-bugfixes:
-  - host_group_vars - fixed defining the 'key' variable if the get_vars method is called with cache=False (https://github.com/ansible/ansible/issues/84384)

changelogs/fragments/84419-fix-wait_for_connection-warning.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - wait_for_connection - a warning was displayed if any hosts used a local connection (https://github.com/ansible/ansible/issues/84419)

changelogs/fragments/84468-timeout_become_unreachable.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - Time out waiting on become is an unreachable error (https://github.com/ansible/ansible/issues/84468)

changelogs/fragments/84473-dict-lookup-type-error-message.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - when the ``dict`` lookup is given a non-dict argument, show the value of the argument and its type in the error message.

changelogs/fragments/84490-allow-iptables-chain-creation-with-wait.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - iptables - Allows the wait paramater to be used with iptables chain creation (https://github.com/ansible/ansible/issues/84490)

changelogs/fragments/84496-CallbackBase-get_options.yml

@@ -1,4 +0,0 @@
----
-minor_changes:
-  - callback plugins - add has_option() to CallbackBase to match other functions overloaded from AnsiblePlugin
-  - callback plugins - fix get_options() for CallbackBase

changelogs/fragments/84540-uri-relative-redirect.yml

@@ -1,3 +0,0 @@
----
-bugfixes:
-  - uri - Form location correctly when the server returns a relative redirect (https://github.com/ansible/ansible/issues/84540)

changelogs/fragments/84547-acme-test-container.yml

@@ -1,4 +0,0 @@
-minor_changes:
-  - "ansible-test acme test container - bump `version to 2.3.0 <https://github.com/ansible/acme-test-container/releases/tag/2.3.0>`__
-     to include newer versions of Pebble, dependencies, and runtimes. This adds support for ACME profiles, ``dns-account-01`` support,
-     and some smaller improvements (https://github.com/ansible/ansible/pull/84547)."

changelogs/fragments/84578-dnf5-is_installed-provides.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - "dnf5 - fix ``is_installed`` check for packages that are not installed but listed as provided by an installed package (https://github.com/ansible/ansible/issues/84578)"

changelogs/fragments/84660-fix-meta-end_role-linear-strategy.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - linear strategy - fix executing ``end_role`` meta tasks for each host, instead of handling these as implicit run_once tasks (https://github.com/ansible/ansible/issues/84660).

changelogs/fragments/84685-add-opensuse-microos.yml

@@ -1,3 +0,0 @@
----
-minor_changes:
-  - distribution - Added openSUSE MicroOS to Suse OS family (#84685).

changelogs/fragments/84705-error-message-malformed-plugin-documentation.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - improved error message for yaml parsing errors in plugin documentation

changelogs/fragments/84725-deprecate-strategy-plugins.yml

@@ -1,2 +0,0 @@
-deprecated_features:
-- Stategy Plugins - Use of strategy plugins not provided in ``ansible.builtin`` are deprecated and do not carry any backwards compatibility guarantees going forward. A future release will remove the ability to use external strategy plugins. No alternative for third party strategy plugins is currently planned.

changelogs/fragments/85193-runtime-metadata.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - ansible-test - The runtime-metadata sanity test now ignores pre-release and build identifiers in collection versions. This prevents errors if a tombstone version is ``X.0.0``, while the collection's version is ``X.0.0-prerelease`` (https://github.com/ansible/ansible/issues/85193)."

changelogs/fragments/85254-apt-version-comparison-bugfix.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+  - apt - Stop the >= operator from being ignored for packages that are not already installed (https://github.com/ansible/ansible/pull/85254)

changelogs/fragments/85259-fix-human_to_bytes.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - "Fix ``AnsibleModule.human_to_bytes()``, which was never adjusted after the standalone ``human_to_bytes()`` got a new parameter ``default_unit`` (https://github.com/ansible/ansible/pull/85259)."

changelogs/fragments/85623-fix-pip-check-mode-vcs.yml

@@ -0,0 +1,5 @@
+bugfixes:
+  - >-
+    ``ansible.builtin.pip`` - Running the built-in pip module with ``check_mode`` and packages coming from VCS URLs, archives, or local filepaths now correctly outputs the ``changed`` status of the task.
+    Previously, it was always reported as changed due to improper package name resolution. 
+    (https://github.com/ansible/ansible/pull/85623)

changelogs/fragments/85767-ansible-virtualization-freebsd.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - ansible_virtualization_role and ansible_virtualization_type facts - fix the detection of vms running inside FreeBSD Bhyve hypervisor and detection of jails  (https://github.com/ansible/ansible/pull/85767)

changelogs/fragments/85918-handle-missing-results.yml

@@ -0,0 +1,6 @@
+---
+bugfixes:
+  - galaxy - previously, some corrupted cache files could cause Ansible Galaxy to fail
+    with a traceback. This has been corrected to display a clear error message explaining
+    how to resolve the problem. 
+    (https://github.com/ansible/ansible/issues/85918)

changelogs/fragments/85966-psrp-readtimeout.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - psrp - ReadTimeout exceptions now mark host as unreachable instead of fatal (https://github.com/ansible/ansible/issues/85966)

changelogs/fragments/85997-basic-py-deprecations.yml

@@ -0,0 +1,2 @@
+removed_features:
+  - Removed deprecated ability to import ``datetime``, ``signal``, ``types``, ``chain``, ``repeat``, ``map`` and ``shlex_quote`` from ``ansible.module_utils.basic``.

changelogs/fragments/86003-remove-deprecated-handle_stats_and_callbacks.yml

@@ -0,0 +1,2 @@
+removed_features:
+  - Removed deprecated ``handle_stats_and_callbacks`` parameter of the ``StrategyBase._load_included_file`` method. (https://github.com/ansible/ansible/issues/86003)

changelogs/fragments/86079-ansible-test-validate-modules-bad-return-keys.yml

@@ -0,0 +1,2 @@
+minor_changes:
+  - "ansible-test validate-modules sanity test - now reports bad return value keys that cannot be used with the dot notation in Jinja expressions (https://github.com/ansible/ansible/issues/86079)."

changelogs/fragments/86128-fix-script-decrypt-docs-mismatch.yml

@@ -0,0 +1,3 @@
+---
+minor_changes:
+  - script - remove the currently unsupported ``decrypt`` argument from the module documentation (https://github.com/ansible/ansible/issues/86067).

changelogs/fragments/86147-fix-iptables-extension-handling.yml

@@ -0,0 +1,6 @@
+---
+bugfixes:
+  - >-
+    iptables - The module can now detect when a extensions added with the module ``match`` argument have 
+    been automatically imported by other module arguments such as ``uid_owner`` and prevents duplicate
+    extension imports which previously caused an error (https://github.com/ansible/ansible/issues/84387). 

changelogs/fragments/Ansible.Basic-required_if-null.yml

@@ -1,3 +0,0 @@
-bugfixes:
-  - >-
-    Ansible.Basic - Fix ``required_if`` check when the option value to check is unset or set to null.

changelogs/fragments/add-type-warning.yml

@@ -0,0 +1,5 @@
+bugfixes:
+  - >-
+    Windows - ignore temporary file cleanup warning when using AnsibleModule to
+    compile C# utils. This should reduce the number of warnings that can safely
+    be ignored when running PowerShell modules - https://github.com/ansible/ansible/issues/85976

changelogs/fragments/ansiballz-wrapper-sitecustomize.yml

@@ -0,0 +1,2 @@
+bugfixes:
+- modules - fix AnsiballZ wrapper code escaping of sitecustomize

changelogs/fragments/ansible-galaxy-keycloak-service-accounts.yml

@@ -1,2 +0,0 @@
-minor_changes:
-- ansible-galaxy - Add support for Keycloak service accounts

changelogs/fragments/ansible-minimum-setuptools.yml

@@ -0,0 +1,2 @@
+minor_changes:
+  - The minimum required ``setuptools`` version is now ``77.0.3``, as it is needed for the new PEP 639 license format

changelogs/fragments/ansible-test-added-macos-15.3.yml

@@ -1,6 +0,0 @@
----
-
-minor_changes:
-- ansible-test - Added a macOS 15.3 remote VM, replacing 14.3.
-
-...

changelogs/fragments/ansible-test-containers.yml

@@ -1,7 +1,2 @@
 minor_changes:
-  - ansible-test - Replace container Fedora 40 with 41.
+  - ansible-test - Update base and default containers.
-  - ansible-test - Replace container Alpine 3.20 with 3.21.
-  - ansible-test - Update distro containers to remove unnecessary pakages (apache2, subversion, ruby).
-  - ansible-test - Update the HTTP test container.
-  - ansible-test - Update the PyPI test container.
-  - ansible-test - Update the utility container.

changelogs/fragments/ansible-test-coverage-test-files.yml

@@ -1,4 +0,0 @@
-bugfixes:
-  - >-
-    ansible-test - Fix up coverage reporting to properly translate the temporary path of integration test modules to
-    the expected static test module path.

changelogs/fragments/ansible-test-curl.yml

@@ -1,3 +0,0 @@
-minor_changes:
-  - ansible-test - Use Python's ``urllib`` instead of ``curl`` for HTTP requests.
-  - ansible-test - Automatically retry HTTP GET/PUT/DELETE requests on exceptions.

changelogs/fragments/ansible-test-docker-hostname.yml

@@ -0,0 +1,2 @@
+bugfixes:
+- ansible-test - Fix docker hostname parsing

changelogs/fragments/ansible-test-fix-command-traceback.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - ansible-test - Fix traceback that occurs after an interactive command fails.

changelogs/fragments/ansible-test-freebsd-nss.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - ansible-test - Ensure CA certificates are installed on managed FreeBSD instances.

changelogs/fragments/ansible-test-integration-coverage.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - ansible-test - Restore code coverage reporting for Python code residing in integration tests.

changelogs/fragments/ansible-test-inventory-json.yml

@@ -0,0 +1,4 @@
+minor_changes:
+  - >-
+    ansible-test - add ``.winrm`` and ``.networking`` as valid JSON/YAML inventory file extensions. This should not
+    affect any public facing code as it is used internally for inventories generated by ``ansible-test``.

changelogs/fragments/ansible-test-network-detection.yml

@@ -1,3 +0,0 @@
-minor_changes:
-  - ansible-test - When detection of the current container network fails, a warning is now issued and execution continues.
-    This simplifies usage in cases where the current container cannot be inspected, such as when running in GitHub Codespaces.

changelogs/fragments/ansible-test-nios-container.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - ansible-test - Update ``nios-test-container`` to version 7.0.0.

changelogs/fragments/ansible-test-no-exec-script.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - ansible-test - Show a more user-friendly error message when a ``runme.sh`` script is not executable.

changelogs/fragments/ansible-test-probe-error-handling.yml

@@ -1,3 +0,0 @@
-minor_changes:
-  - ansible-test - Improve container runtime probe error handling.
-    When unexpected probe output is encountered, an error with more useful debugging information is provided.

changelogs/fragments/ansible-test-pylint-fix.yml

@@ -1,4 +0,0 @@
-bugfixes:
-  - ansible-test - Enable the ``sys.unraisablehook`` work-around for the ``pylint`` sanity test on Python 3.11.
-    Previously the work-around was only enabled for Python 3.12 and later.
-    However, the same issue has been discovered on Python 3.11.

changelogs/fragments/ansible-test-pylint-update.yml

@@ -0,0 +1,2 @@
+minor_changes:
+  - ansible-test - Update the pylint sanity test to pylint 4.0.2.

changelogs/fragments/ansible-test-pylint-urllib2.yml

@@ -0,0 +1,2 @@
+minor_changes:
+  - ansible-test - Remove pylint check for ``urllib2`` usage.

changelogs/fragments/ansible-test-remotes.yml

@@ -1,6 +0,0 @@
-minor_changes:
-  - ansible-test - Replace remote FreeBSD 13.3 with 13.5.
-  - ansible-test - Replace remote FreeBSD 14.1 with 14.2.
-  - ansible-test - Replace remote Fedora 40 with 41.
-  - ansible-test - Replace remote Alpine 3.20 with 3.21.
-  - ansible-test - Replace remote RHEL 9.4 with 9.5.

changelogs/fragments/ansible-test-update.yml

@@ -1,7 +0,0 @@
-minor_changes:
-  - ansible-test - Update ``pylint`` sanity test to use version 3.3.1.
-  - ansible-test - Default to Python 3.13 in the ``base`` and ``default`` containers.
-  - ansible-test - Disable the ``deprecated-`` prefixed ``pylint`` rules as their results vary by Python version.
-  - ansible-test - Update the ``base`` and ``default`` containers.
-  - ansible-test - Update sanity test requirements to latest available versions.
-  - ansible-test - Disable the ``pep8`` sanity test rules ``E701`` and ``E704`` to improve compatibility with ``black``.

changelogs/fragments/apt_key_bye.yml

@@ -1,5 +0,0 @@
-minor_changes:
-  - apt_key module - add notes to docs and errors to point at the CLI tool deprecation by Debian and alternatives
-  - apt_repository module - add notes to errors to point at the CLI tool deprecation by Debian and alternatives
-bugfixes:
-  - apt_key module - prevent tests from running when apt-key was removed

changelogs/fragments/auto_legacy.yml

@@ -0,0 +1,3 @@
+---
+removed_features:
+    - interpreter_discovery - removed auto_legacy and auto_legacy_slient options (https://github.com/ansible/ansible/issues/85995).

changelogs/fragments/basic-py-deprecations.yml

@@ -0,0 +1,4 @@
+deprecated_features:
+  - The ``get_platfrom()`` function from ``ansible.module_utils.basic`` is deprecated and will be removed in ansible-core 2.24. Use ``platform.system()`` from the Python standard library instead.
+  - The ``load_platform_subclass()`` function from ``ansible.module_utils.basic`` is deprecated and will be removed in ansible-core 2.24. Use ``get_platform_subclass()`` from ``ansible.module_utils.common.sys_info`` instead.
+  - The ``get_all_subclasses()`` function from ``ansible.module_utils.basic`` is deprecated and will be removed in ansible-core 2.24. Use ``get_all_subclasses()`` from ``ansible.module_utils.common._utils`` instead.

changelogs/fragments/basic_shlex_split.yml

@@ -0,0 +1,3 @@
+---
+bugfixes:
+  - basic - fail in controlled manner when ``run_command()`` attempts to parse a command with broken syntax passed in as a string (https://github.com/ansible/ansible/issues/85719).

changelogs/fragments/become-runas-system-deux.yml

@@ -1,3 +0,0 @@
-bugfixes:
-  - >-
-    runas become - Fix up become logic to still get the SYSTEM token with the most privileges when running as SYSTEM.

changelogs/fragments/buildroot.yml

@@ -1,3 +0,0 @@
----
-bugfixes:
-  - user - Create Buildroot subclass as alias to Busybox (https://github.com/ansible/ansible/issues/83665).

changelogs/fragments/cache_avoid_path_keys.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - cache plugins based on the BaseFileCache class will now sanitize keys to avoid names that could cause issues with the storage path

changelogs/fragments/compat_datetime.yml

@@ -0,0 +1,3 @@
+---
+removed_features:
+    - compat.datetime - removed deprecated datetime compat APIs (https://github.com/ansible/ansible/issues/86000).

changelogs/fragments/compat_removal.yml

@@ -1,3 +0,0 @@
----
-removed_features:
-  - removed deprecated pycompat24 and compat.importlib.

changelogs/fragments/config.yml

@@ -1,3 +0,0 @@
----
-removed_features:
-  - Remove deprecated plural form of collection path (https://github.com/ansible/ansible/pull/84156).

changelogs/fragments/config_dump.yml

@@ -1,3 +0,0 @@
----
-bugfixes:
-  - ansible-config - format galaxy server configs while dumping in JSON format (https://github.com/ansible/ansible/issues/84840).

changelogs/fragments/config_lookup_fix.yml

@@ -0,0 +1,2 @@
+bugfixes:
+ - config lookup now properly factors in variables and show_origin when checking entries from the global configuration.