ssh connection: fix sshpass pipe fd leaks (#86141)

When using sshpass the file descriptors leaks would happen in the reset
method that used _build_command that creates the pipe but the command
would not go through _bare_run which closes the pipe.

Another scenario would be _bare_run failing and not all code path would
properly close the pipe.

This patch fixes the issues by:
* move creating the pipe from _build_command closer to where it is used
  in _bare_run
* wrap _bare_run with closing the pipe in case of a failure
* no need to re-create pipe in the retry code
* unrelated but simplify the reset method

.azure-pipelines/scripts/publish-codecov.py

@@ -47,13 +47,25 @@ def parse_args() -> Args:
     return Args(**kwargs)
 
 
-def run(*args: str | pathlib.Path) -> None:
+def run(
+    *args: str | pathlib.Path,
+    dry_run: bool = False,
+) -> None:
+    """
+    Log and run given command.
+
+    The command is not actually executed if ``dry_run`` is truthy.
+    """
     cmd = [str(arg) for arg in args]
-    print(f'==> {shlex.join(cmd)}', flush=True)
-    subprocess.run(cmd, check=True)
 
+    dry_prefix = '[would run] ' if dry_run else ''
+    print(f'==> {dry_prefix}{shlex.join(cmd)}', flush=True)
 
-def install_codecov(dest: pathlib.Path) -> pathlib.Path:
+    if not dry_run:
+        subprocess.run(cmd, check=True)
+
+
+def install_codecov(dest: pathlib.Path, dry_run: bool = False) -> pathlib.Path:
     """Populate a transitively pinned venv with ``codecov-cli``."""
     requirement_file = DEPS_DIR / 'codecov.in'
     constraint_file = requirement_file.with_suffix('.txt')
@@ -72,6 +84,7 @@ def install_codecov(dest: pathlib.Path) -> pathlib.Path:
         f'--constraint={constraint_file!s}',
         f'--requirement={requirement_file!s}',
         '--disable-pip-version-check',
+        dry_run=dry_run,
     )
 
     return codecov_bin
@@ -118,16 +131,40 @@ def upload_files(codecov_bin: pathlib.Path, config_file: pathlib.Path, files: t.
         run(*cmd)
 
 
+def report_upload_completion(
+    codecov_bin: pathlib.Path,
+    config_file: pathlib.Path,
+    dry_run: bool = False,
+) -> None:
+    """Notify Codecov backend that all reports we wanted are in."""
+    cmd = [
+        codecov_bin,
+        '--disable-telem',
+        f'--codecov-yml-path={config_file}',
+        'send-notifications',
+    ]
+
+    run(*cmd, dry_run=dry_run)
+
+
 def main() -> None:
     args = parse_args()
 
     with tempfile.TemporaryDirectory(prefix='codecov-') as tmpdir:
         config_file = pathlib.Path(tmpdir) / 'config.yml'
-        config_file.write_text('')
-
-        codecov_bin = install_codecov(pathlib.Path(tmpdir))
+        # Refs:
+        # * https://docs.codecov.com/docs/codecovyml-reference#codecovnotifymanual_trigger
+        # * https://docs.codecov.com/docs/notifications#preventing-notifications-until-youre-ready-to-send-notifications
+        config_file.write_text('codecov:\n  notify:\n    manual_trigger: true')
+
+        codecov_bin = install_codecov(
+            pathlib.Path(tmpdir),
+            dry_run=args.dry_run,
+        )
         files = process_files(args.path)
         upload_files(codecov_bin, config_file, files, args.dry_run)
+        # Ref: https://docs.codecov.com/docs/cli-options#send-notifications
+        report_upload_completion(codecov_bin, config_file, args.dry_run)
 
 
 if __name__ == '__main__':

.azure-pipelines/templates/coverage.yml

@@ -7,6 +7,7 @@ jobs:
   - job: Coverage
     displayName: Code Coverage
     container: $[ variables.defaultContainer ]
+    timeoutInMinutes: 10
     workspace:
       clean: all
     steps:

.azure-pipelines/templates/test.yml

@@ -12,6 +12,7 @@ jobs:
     - job: test_${{ replace(replace(replace(replace(job.test, '/', '_'), '.', '_'), '-', '_'), '@', '_') }}
       displayName: ${{ job.name }}
       container: $[ variables.defaultContainer ]
+      timeoutInMinutes: 65
       workspace:
         clean: all
       steps:

.claude/commands/review.md

@@ -0,0 +1,55 @@
+---
+description: Review an Ansible PR following the project's standardized process from CLAUDE.md
+argument-hint: <pr_number>
+allowed-tools: [TodoWrite, Bash(gh pr view:*), Bash(gh pr diff:*), Bash(gh pr checkout:*), Bash(gh pr checks:*), Read, Grep, Glob, Search]
+---
+
+PR Review Command
+=================
+
+Review an Ansible PR following the project's standardized process from `CLAUDE.md`.
+
+Usage
+-----
+
+```bash
+/review <pr_number>
+```
+
+Arguments
+---------
+
+- `pr_number` (required): The GitHub PR number to review
+
+Implementation
+--------------
+
+This command implements the PR Review Guidelines documented in the `PR Review Guidelines` section of CLAUDE.md.
+
+Review Process Steps
+--------------------
+
+The command follows these numbered steps from CLAUDE.md:
+
+1. **Create TodoWrite list** for systematic review tracking
+2. **Get PR details**: `gh pr view <number>` to understand scope, motivation and the desired outcome
+3. **Get PR diff**: `gh pr diff <number>` to see all changes
+4. **Check required components FIRST**:
+   - Verify changelog fragment exists in `changelogs/fragments/`
+   - Verify changelog uses correct section (check `changelogs/config.yaml`)
+   - Verify tests exist and specifically cover the changed code paths
+   - Unit tests should be pytest style, and functional rather than tightly coupled to mocking
+   - Integration tests required for almost all plugin changes
+5. **Checkout PR branch**: `gh pr checkout <number>` to examine code holistically
+6. **Review existing feedback**: `gh pr view <number> --comments` for all comments and previous reviews
+7. **Verify all issues addressed**: Ensure bot failures, reviewer requests, and discussion points are resolved
+8. **Call out unresolved feedback**: Explicitly mention any discussions/requests that remain unaddressed
+
+Critical Review Elements
+------------------------
+
+- **Licensing**: Verify GPLv3/BSD-2-Clause compatibility for any new dependencies
+- **Test scope**: Tests must exercise actual changed code, not just add random coverage
+- **Changelog validation**: Fragment structure follows sections defined in `changelogs/config.yaml`
+
+Each step is tracked in TodoWrite for visibility and systematic completion. A review round should not exceed 20 feedback items.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -105,7 +105,8 @@ body:
     label: Configuration
     description: >-
       Paste verbatim output from `ansible-config dump --only-changed -t all` below, under the prompt line.
-      (if using a version older than ansible-core 2.12 you should omit the '-t all')
+      Remember to redact secret values. You can easily filter Galaxy server secrets using grep,
+      for example `ansible-config dump --only-changed -t all | grep -Ev 'token|password|client_secret'`.
       Please don't wrap it with triple backticks — your
       whole input will be turned into a code snippet automatically.
     render: console

.github/ISSUE_TEMPLATE/documentation_report.yml

@@ -130,6 +130,8 @@ body:
     label: Configuration
     description: >-
       Paste verbatim output from `ansible-config dump --only-changed -t all` below, under the prompt line.
+      Remember to redact secret values. You can easily filter Galaxy server secrets using grep,
+      for example `ansible-config dump --only-changed -t all | grep -Ev 'token|password|client_secret'`.
       (if using a version older than ansible-core 2.12 you should omit the '-t all')
       Please don't wrap it with triple backticks — your
       whole input will be turned into a code snippet automatically.

.gitignore

@@ -127,3 +127,5 @@ test/units/.coverage.*
 /SYMLINK_CACHE.json
 changelogs/.plugin-cache.yaml
 .ansible-test-timeout.json
+# Agents
+CLAUDE.local.md

AGENTS.md

@@ -0,0 +1,321 @@
+# AGENTS.md
+
+This file provides guidance to Claude Code (claude.ai/code) and other compatible agentic tools when working with code in this repository.
+
+**Note:** This file is for AI assistant use only. For human developers, see the [Ansible Developer Guide](https://docs.ansible.com/ansible-core/devel/dev_guide/index.html).
+
+## ⚠️ IMPORTANT: Always Start Here
+
+**BEFORE starting any PR review or development task:**
+
+1. **Read this file first** - Don't work from memory or assumptions
+2. **Use TodoWrite** to create a task list and track progress systematically
+3. **Follow the numbered steps** in the relevant process sections
+4. **Reference Quick Reference** for correct commands and patterns
+
+## ⚠️ CRITICAL: Licensing Requirements
+
+**NEVER suggest, recommend, or approve code that violates these requirements:**
+
+- **ansible-core**: All code must be **GPLv3 compatible**
+- **lib/ansible/module_utils/**: Defaults to **BSD-2-Clause** (more permissive)
+- **External dependencies**: Only recommend libraries compatible with these licenses
+- **PR reviews**: Always verify any new dependencies or suggested libraries are license-compatible
+- **When in doubt**: Ask about licensing compatibility rather than assuming
+
+**This is non-negotiable** - licensing violations can create serious legal issues for the project.
+
+## Quick Reference
+
+Most commonly used commands and patterns:
+
+```bash
+# Testing
+ansible-test sanity -v --docker default                   # Run all sanity tests
+ansible-test sanity -v --docker default --test <test>     # Run specific sanity test
+ansible-test units -v --docker default                    # Run unit tests
+ansible-test integration -v --docker ubuntu2404           # Run integration tests
+
+# PR Review and CI
+gh pr view <number>                                       # Get PR details
+gh pr view <number> --comments                            # Check for ansibot CI failures
+gh pr checks <number>                                     # Get Azure Pipelines URLs
+gh pr checkout <number>                                   # Switch to PR branch
+gh pr diff <number>                                       # See all changes
+```
+
+**Container Selection:**
+
+- Sanity/Unit tests: `--docker default`
+- Integration tests: `--docker ubuntu2204`, `--docker ubuntu2404`, etc. (NOT default/base)
+
+**Critical Reminders:**
+
+- **Licensing**: See [Licensing Requirements](#️-critical-licensing-requirements) - GPLv3/BSD-2-Clause only
+
+## Development Environment Setup
+
+Ansible development typically uses an editable install after forking and cloning:
+
+```bash
+# After forking and cloning the repository
+pip install -e .
+```
+
+**Note:** ansible-core and all CLIs (including ansible-test) require a POSIX OS. On Windows, use WSL (Windows Subsystem for Linux).
+
+## Testing and CI
+
+### Basic Testing Commands
+
+```bash
+# Run sanity tests - these are linting/static analysis (pylint, mypy, pep8, etc.)
+ansible-test sanity -v --docker default
+
+# List available sanity tests
+ansible-test sanity --list-tests
+
+# Run specific sanity tests
+ansible-test sanity -v --docker default --test pep8 --test pylint
+
+# Run sanity on specific files (paths relative to repo root)
+ansible-test sanity -v --docker default lib/ansible/modules/command.py
+
+# Run unit tests (recommended with Docker)
+ansible-test units -v --docker default
+
+# Run specific unit test (paths relative to repo root, targets in test/units/)
+ansible-test units -v --docker default test/units/modules/test_command.py
+
+# Run integration tests (choose appropriate container - NOT base/default)
+ansible-test integration -v --docker ubuntu2404
+
+# Run specific integration target (directory name in test/integration/targets/)
+ansible-test integration -v --docker ubuntu2404 setup_remote_tmp_dir
+
+# Run with coverage
+ansible-test units -v --docker default --coverage
+
+# Alternative: use --venv if Docker/Podman unavailable (less reliable for units/integration)
+ansible-test sanity -v --venv
+```
+
+Available Docker containers for testing can be found in `./test/lib/ansible_test/_data/completion/docker.txt`.
+The `base` and `default` containers are for sanity/unit tests only. For integration tests, use distro-specific
+containers, depending on the modules being tested.
+
+**Test isolation options:**
+
+- `--docker` (supports Docker or Podman) - preferred for reliable, isolated testing
+- `--venv` - fallback when containers unavailable, but unit tests may be unreliable due to host environment differences
+
+### Helping Developers with CI Failures
+
+When developers submit PRs and encounter CI failures, use these approaches to help diagnose and resolve issues:
+
+**1. Check for ansibot comments:**
+
+```bash
+# Get all PR comments to find ansibot CI failure reports
+gh pr view <number> --comments
+```
+
+Look for comments from `ansibot` that contain:
+- Test failure details with specific error messages
+- File paths and line numbers for failures
+- Links to sanity test documentation (e.g., `[explain](https://docs.ansible.com/...`)
+
+**2. Get CI check status and URLs:**
+
+```bash
+# See all CI check results with Azure Pipelines URLs
+gh pr checks <number>
+```
+
+This shows:
+- Overall CI status (pass/fail) with timing
+- Direct links to Azure DevOps build results
+- Individual job results (Sanity Test 1/2, Docker tests, Units, etc.)
+
+**3. Common CI failure patterns:**
+
+- **Sanity failures**: Usually have specific fixes (trailing whitespace, import errors, etc.)
+- **Integration test failures**: May require platform-specific containers or test adjustments
+- **Unit test failures**: Often indicate actual code issues that need debugging
+
+**4. CI failure analysis workflow:**
+
+1. Check ansibot comments first for immediate error details
+2. Use `gh pr checks <number>` to get Azure Pipelines URLs for detailed logs
+3. Focus on failed jobs (marked as `fail`) and examine their specific error output
+4. For sanity test failures, the error messages usually indicate exactly what needs to be fixed
+5. For test failures, run the same tests locally using `ansible-test` to reproduce and debug
+
+## PR Review Guidelines
+
+### PR Review Checklist
+
+Use this checklist for EVERY PR review:
+
+```text
+□ Created TodoWrite list for review steps
+□ Step 1: Get PR details with gh pr view <number>
+□ Step 2: Get PR diff with gh pr diff <number>
+□ Step 3: Check required components (changelog, tests)
+□ Step 4: Checkout PR branch with gh pr checkout <number>
+□ Step 5: Review existing feedback with gh pr view <number> --comments
+□ Step 6: Verify all issues addressed
+□ Step 7: Call out any unresolved feedback
+□ Mark each TodoWrite item as completed when done
+```
+
+When assisting with PR reviews, verify:
+
+### Required Components
+
+- Changelog fragment exists in `changelogs/fragments/`
+- Appropriate tests are included and cover the changed code
+  - Unit tests should be pytest style, and functional rather than tightly coupled to mocking
+  - Integration tests required for almost all plugin changes (tests the public API)
+  - Tests should exercise the actual changed code, not just add random coverage
+
+### Review Process
+
+Follow these steps in order for thorough PR reviews:
+
+1. **Get PR details**: Use `gh pr view <number>` to understand the PR scope and description
+2. **Get PR diff**: Use `gh pr diff <number>` to see all changes
+3. **Check required components FIRST**:
+   - Verify changelog fragment exists and uses correct section (check `changelogs/config.yaml` for valid sections)
+   - Verify tests exist and specifically cover the changed code paths
+4. **Checkout PR branch**: Use `gh pr checkout <number>` to examine code holistically with changes applied
+5. **Review existing feedback**: Use `gh pr view <number> --comments` to see all comments and previous review feedback
+6. **Verify all issues addressed**: Ensure all bot failures, reviewer requests, and discussion points are resolved
+7. **Call out any unresolved review feedback**: Explicitly mention any discussions or requests that remain unaddressed
+
+### Common Review Issues to Check
+
+- **Changelog section errors**: Verify changelog uses valid section from `changelogs/config.yaml`. Fragment structure follows sections defined there.
+- **Test scope**: Ensure tests exercise the actual changed code, not just add random coverage.
+  Integration tests required for almost all plugin changes (tests the public API).
+  Tests should be functional rather than tightly coupled to mocking.
+
+### Review Task Management
+
+- Use TodoWrite tool to track review steps for complex PRs
+- Mark tasks as in_progress when actively working on them
+- Complete tasks immediately after finishing each step
+- This provides visibility to users about review progress
+
+### Review Tools
+
+- `gh pr view <number>` - Get PR details and description
+- `gh pr view <number> --comments` - See all comments and review feedback
+- `gh pr diff <number>` - Get complete diff of changes
+- `gh pr checkout <number>` - Switch to PR branch for holistic examination
+- `Read` tool - Examine specific changed files in detail
+- `Grep` tool - Search for related code patterns or test coverage (uses ripgrep/rg)
+
+## Development Guidelines
+
+### Code Style Notes
+
+- Line limit is 160 characters (not 80)
+- E402 (module level import not at top) is ignored
+- In `lib/ansible/modules/`, imports must come after DOCUMENTATION, EXAMPLES, and RETURN definitions
+- Don't add obvious comments about code
+- Use native type hints with `from __future__ import annotations` (converts to strings at runtime)
+- Don't document module parameters in docstrings - migrate to type hints instead
+- **No trailing whitespace**: Always clean up trailing spaces on lines, especially when editing existing files
+
+### Python Version Support
+
+- Controller code: support range defined in `pyproject.toml`
+- Modules/module_utils: minimum version in `lib/ansible/module_utils/basic.py` (`_PY_MIN`) up to max from `pyproject.toml`
+- Modules support a wider Python version range than controller code
+
+### Dependencies and Imports
+
+- Prefer Python stdlib over external dependencies
+- Use existing code from within the Ansible project
+- `lib/ansible/modules/` can only import from `lib/ansible/module_utils/` (modules are packaged for remote execution)
+- `lib/ansible/module_utils/` cannot import from outside itself
+
+## Documentation Standards
+
+### Module and Plugin Documentation
+
+- Modules and plugins require DOCUMENTATION, EXAMPLES, and RETURN blocks as static YAML string variables
+- These blocks cannot be dynamically generated - they are parsed via AST/token parsing
+- Alternative: "sidecar" documentation as `.yml` files with same stem name adjacent to plugin files
+- All modules should have a `main()` function and `if __name__ == '__main__':` block
+- Use `version_added` fields in documentation following existing version format patterns
+
+### Changelog Requirements
+
+- Changes require entries in `changelogs/fragments/` as YAML files
+- Create a new fragment file per PR (never reuse existing fragments to avoid merge conflicts)
+- Fragment structure follows sections defined in `changelogs/config.yaml` under the `sections` key
+- Naming: `{issue_number}-{short-description}.yml` or `{component}-{description}.yml` if no issue
+- Format: `- {component} - {description} ({optional URL to GH issue})`
+- Content supports Sphinx markup (use double backticks for code references)
+
+## Repository Management
+
+### Plugin Development
+
+- New plugins should go into collections, not ansible-core
+- ansible-core rarely accepts new plugins; core team makes these decisions
+
+### Branch and Release Management
+
+- All PRs target the `devel` branch
+- Use GitHub templates when creating issues/PRs (`.github/ISSUE_TEMPLATE/` and `.github/PULL_REQUEST_TEMPLATE/`)
+- For issues: fill out the `component` field with project root relative file path
+- For PRs: adjust the issue type in the template as listed in `.github/PULL_REQUEST_TEMPLATE/PULL_REQUEST_TEMPLATE.md`
+- Validate issues are fixed in `devel` before reporting against stable releases
+- Bug fixes: backported to latest stable only
+- Critical bug fixes: backported to latest and previous stable
+- Security issues: contact security@ansible.com privately, not via GitHub
+
+### Backwards Compatibility
+
+- Backwards compatibility is prioritized over most other concerns
+- Deprecation cycle: 4 releases (deprecation + 2 releases + removal)
+- Use `Display.deprecated` or `AnsibleModule.deprecate` with version from `lib/ansible/release.py` plus 3
+- Example: deprecating in 2.19 means removal in 2.22
+
+## Code Structure Reference
+
+### Core Structure
+
+- `lib/ansible/` - Main Ansible library code
+  - `cli/` - Command-line interface implementations (ansible, ansible-playbook, etc.)
+  - `executor/` - Task execution engine and strategies (includes PowerShell support in `powershell/`)
+  - `inventory/` - Inventory management and parsing
+  - `modules/` - Core modules (built-in automation modules)
+  - `module_utils/` - Shared utilities for modules (includes C# in `csharp/` and PowerShell in `powershell/`)
+  - `plugins/` - Plugin framework (filters, tests, lookups, etc.)
+  - `vars/` - Variable management
+  - `config/` - Configuration handling
+  - `collections/` - Ansible Collections framework
+
+### Key Components
+
+- **CLI Layer**: Entry points in `lib/ansible/cli/` handle command parsing and dispatch
+- **Executor**: `lib/ansible/executor/` contains the core execution engine that runs tasks and plays
+- **Module System**: Modules in `lib/ansible/modules/` are the units of work; they're executed remotely
+- **Plugin Architecture**: `lib/ansible/plugins/` provides extensibility through filters, tests, lookups, etc.
+- **Inventory**: `lib/ansible/inventory/` manages host and group definitions
+- **Collections**: Modern packaging format for distributing Ansible content
+
+### Testing Infrastructure
+
+- `test/units/` - Unit tests mirroring the lib structure
+- `test/integration/` - Integration tests organized by target (named after plugin/functionality being tested)
+  - Some targets have `context/controller` or `context/target` in their `aliases` file when not easily inferable
+  - Only modules run on target hosts; all other plugins execute locally in the ansible process
+- `test/lib/` - Test utilities and frameworks
+- `ansible-test` - Unified testing tool for all test types
+
+For CI failure debugging, see [Helping Developers with CI Failures](#helping-developers-with-ci-failures).

CLAUDE.md

@@ -0,0 +1,3 @@
+- @AGENTS.md
+- @~/.claude/ansible.md
+- @CLAUDE.local.md

changelogs/changelog.yaml

@@ -1,2 +1,2 @@
-ancestor: 2.18.0
+ancestor: 2.20.0
 releases: {}

changelogs/fragments/66497-include_role-_from-dedup.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - include_role - allow host specific values in all ``*_from`` arguments (https://github.com/ansible/ansible/issues/66497)

changelogs/fragments/81796-ansible-doc-roles.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - "ansible-doc - show ``notes``, ``seealso``, and top-level ``version_added`` for role entrypoints (https://github.com/ansible/ansible/pull/81796)."

changelogs/fragments/85010-uri-multipart-file-on-retry.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - uri - fix form-multipart file not being found when task is retried (https://github.com/ansible/ansible/issues/85009)

changelogs/fragments/85193-runtime-metadata.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - ansible-test - The runtime-metadata sanity test now ignores pre-release and build identifiers in collection versions. This prevents errors if a tombstone version is ``X.0.0``, while the collection's version is ``X.0.0-prerelease`` (https://github.com/ansible/ansible/issues/85193)."

changelogs/fragments/85217-stat-add-selinux-context.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - stat module - add SELinux context as a return value, and add a new option to trigger this return, which is False by default. (https://github.com/ansible/ansible/issues/85217).

changelogs/fragments/85254-apt-version-comparison-bugfix.yaml

@@ -0,0 +1,2 @@
+bugfixes:
+  - apt - Stop the >= operator from being ignored for packages that are not already installed (https://github.com/ansible/ansible/pull/85254)

changelogs/fragments/85259-fix-human_to_bytes.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - "Fix ``AnsibleModule.human_to_bytes()``, which was never adjusted after the standalone ``human_to_bytes()`` got a new parameter ``default_unit`` (https://github.com/ansible/ansible/pull/85259)."

changelogs/fragments/85487-add-dependency-installation-to-deb822_repository.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - deb822_repository - Add automatic installation of the ``python3-debian`` package if it is missing by adding the parameter ``install_python_debian``

changelogs/fragments/85497-default-callback-indent.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - "default callback plugin - add option to configure indentation for JSON and YAML output (https://github.com/ansible/ansible/pull/85497)."

changelogs/fragments/85524-resolve-task-resolved_action-early.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - callback plugins - improve consistency accessing the Task object's resolved_action attribute.

changelogs/fragments/85556-fix-pip-changed.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - pip - Fix pip module output so that it returns changed when the only operation is initializing a venv.

changelogs/fragments/85596-hide-proto.yml

@@ -1,3 +0,0 @@
-bugfixes:
-- >-
-  ``ansible-galaxy collection list`` - fail when none of the configured collection paths exist.

changelogs/fragments/85599-fix-templating-import_tasks-parent-include.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - import_tasks - fix templating parent include arguments.

changelogs/fragments/85623-fix-pip-check-mode-vcs.yml

@@ -0,0 +1,5 @@
+bugfixes:
+  - >-
+    ``ansible.builtin.pip`` - Running the built-in pip module with ``check_mode`` and packages coming from VCS URLs, archives, or local filepaths now correctly outputs the ``changed`` status of the task.
+    Previously, it was always reported as changed due to improper package name resolution. 
+    (https://github.com/ansible/ansible/pull/85623)

changelogs/fragments/85632-setup-logical-volume-name-uniqueness.yml

@@ -1,6 +0,0 @@
-minor_changes:
-- >-
-  setup - added new subkey ``lvs`` within each entry of ``ansible_facts['vgs']``
-  to provide complete logical volume data scoped by volume group.
-  The top level ``lvs`` fact by comparison, deduplicates logical volume names
-  across volume groups and may be incomplete. (https://github.com/ansible/ansible/issues/85632)

changelogs/fragments/85638-ansible-test-validate-modules-doc-fragments.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - "validate-modules sanity test - fix handling of missing doc fragments (https://github.com/ansible/ansible/pull/85638)."

changelogs/fragments/85682-rescue-flush_handlers.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - The ``ansible_failed_task`` variable is now correctly exposed in a rescue section, even when a failing handler is triggered by the ``flush_handlers`` task in the corresponding ``block`` (https://github.com/ansible/ansible/issues/85682)

changelogs/fragments/85743-lazy-ternary.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - "``ternary`` filter - evaluate values lazily (https://github.com/ansible/ansible/issues/85743)"

changelogs/fragments/85767-ansible-virtualization-freebsd.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - ansible_virtualization_role and ansible_virtualization_type facts - fix the detection of vms running inside FreeBSD Bhyve hypervisor and detection of jails  (https://github.com/ansible/ansible/pull/85767)

changelogs/fragments/85816-wsl-cache-files.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - cache plugins - close temp cache file before moving it to fix error on WSL. (https://github.com/ansible/ansible/pull/85816)

changelogs/fragments/85918-handle-missing-results.yml

@@ -0,0 +1,6 @@
+---
+bugfixes:
+  - galaxy - previously, some corrupted cache files could cause Ansible Galaxy to fail
+    with a traceback. This has been corrected to display a clear error message explaining
+    how to resolve the problem. 
+    (https://github.com/ansible/ansible/issues/85918)

changelogs/fragments/85966-psrp-readtimeout.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - psrp - ReadTimeout exceptions now mark host as unreachable instead of fatal (https://github.com/ansible/ansible/issues/85966)

changelogs/fragments/85997-basic-py-deprecations.yml

@@ -0,0 +1,2 @@
+removed_features:
+  - Removed deprecated ability to import ``datetime``, ``signal``, ``types``, ``chain``, ``repeat``, ``map`` and ``shlex_quote`` from ``ansible.module_utils.basic``.

changelogs/fragments/86003-remove-deprecated-handle_stats_and_callbacks.yml

@@ -0,0 +1,2 @@
+removed_features:
+  - Removed deprecated ``handle_stats_and_callbacks`` parameter of the ``StrategyBase._load_included_file`` method. (https://github.com/ansible/ansible/issues/86003)

changelogs/fragments/86079-ansible-test-validate-modules-bad-return-keys.yml

@@ -0,0 +1,2 @@
+minor_changes:
+  - "ansible-test validate-modules sanity test - now reports bad return value keys that cannot be used with the dot notation in Jinja expressions (https://github.com/ansible/ansible/issues/86079)."

changelogs/fragments/86128-fix-script-decrypt-docs-mismatch.yml

@@ -0,0 +1,3 @@
+---
+minor_changes:
+  - script - remove the currently unsupported ``decrypt`` argument from the module documentation (https://github.com/ansible/ansible/issues/86067).

changelogs/fragments/86147-fix-iptables-extension-handling.yml

@@ -0,0 +1,6 @@
+---
+bugfixes:
+  - >-
+    iptables - The module can now detect when a extensions added with the module ``match`` argument have 
+    been automatically imported by other module arguments such as ``uid_owner`` and prevents duplicate
+    extension imports which previously caused an error (https://github.com/ansible/ansible/issues/84387). 

changelogs/fragments/add-type-warning.yml

@@ -0,0 +1,5 @@
+bugfixes:
+  - >-
+    Windows - ignore temporary file cleanup warning when using AnsibleModule to
+    compile C# utils. This should reduce the number of warnings that can safely
+    be ignored when running PowerShell modules - https://github.com/ansible/ansible/issues/85976

changelogs/fragments/ansiballz-wrapper-sitecustomize.yml

@@ -0,0 +1,2 @@
+bugfixes:
+- modules - fix AnsiballZ wrapper code escaping of sitecustomize

changelogs/fragments/ansible-doc-description-verbosity.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - ansible-doc - Return a more verbose error message when the ``description`` field is missing.

changelogs/fragments/ansible-minimum-setuptools.yml

@@ -0,0 +1,2 @@
+minor_changes:
+  - The minimum required ``setuptools`` version is now ``77.0.3``, as it is needed for the new PEP 639 license format

changelogs/fragments/ansible-test-auth-update.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - ansible-test - Implement new authentication methods for accessing the Ansible Core CI service.

changelogs/fragments/ansible-test-bootstrap-retry.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - ansible-test - Limit package install retries during managed remote instance bootstrapping.

changelogs/fragments/ansible-test-containers.yml

@@ -1,2 +1,2 @@
 minor_changes:
-  - ansible-test - Update test containers.
+  - ansible-test - Update base and default containers.

changelogs/fragments/ansible-test-coverage-config.yml

@@ -1,7 +0,0 @@
-bugfixes:
- - ansible-test - Use a consistent coverage config for all collection testing.
- - ansible-test - Always exclude the ``tests/output/`` directory from a collection's code coverage.
-   (https://github.com/ansible/ansible/issues/84244)
-
-minor_changes:
-  - ansible-test - Improve formatting of generated coverage config file.

changelogs/fragments/ansible-test-coverage-upgrade.yml

@@ -1,2 +0,0 @@
-minor_changes:
- - ansible-test - Upgrade to ``coverage`` version 7.10.6 for Python 3.9 and later.

changelogs/fragments/ansible-test-docker-hostname.yml

@@ -0,0 +1,2 @@
+bugfixes:
+- ansible-test - Fix docker hostname parsing

changelogs/fragments/ansible-test-freebsd-14.3.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - ansible-test - Replace FreeBSD 14.2 with 14.3.

changelogs/fragments/ansible-test-freebsd-bootstrap.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - ansible-test - Use OS packages to satisfy controller requirements on FreeBSD 13.5 during managed instance bootstrapping.

changelogs/fragments/ansible-test-integration-coverage.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - ansible-test - Restore code coverage reporting for Python code residing in integration tests.

changelogs/fragments/ansible-test-inventory-json.yml

@@ -0,0 +1,4 @@
+minor_changes:
+  - >-
+    ansible-test - add ``.winrm`` and ``.networking`` as valid JSON/YAML inventory file extensions. This should not
+    affect any public facing code as it is used internally for inventories generated by ``ansible-test``.

changelogs/fragments/ansible-test-ios.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - ansible-test - Removed support for automatic provisioning of obsolete instances for network-integration tests.

changelogs/fragments/ansible-test-missing-dir-fix.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - ansible-test - Fix a traceback that can occur when using delegation before the ansible-test temp directory is created.

changelogs/fragments/ansible-test-pylint-update.yml

@@ -0,0 +1,2 @@
+minor_changes:
+  - ansible-test - Update the pylint sanity test to pylint 4.0.2.

changelogs/fragments/ansible-test-pylint-urllib2.yml

@@ -0,0 +1,2 @@
+minor_changes:
+  - ansible-test - Remove pylint check for ``urllib2`` usage.

changelogs/fragments/ansible-test-remotes.yml

@@ -1,4 +0,0 @@
-minor_changes:
-  - ansible-test - Upgrade Fedora 41 to Fedora 42.
-  - ansible-test - Upgrade Alpine 3.21 to 3.22.
-  - ansible-test - Update Ubuntu containers.

changelogs/fragments/ansible-test-rhel-9.6.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - ansible-test - Replace RHEL 9.5 with 9.6.

changelogs/fragments/ansible-test-sanity-requirements.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - ansible-test - Update pinned sanity test requirements.

changelogs/fragments/apt_deb_install.yml

@@ -1,3 +0,0 @@
----
-bugfixes:
-  - apt - mark dependencies installed as part of deb file installation as auto (https://github.com/ansible/ansible/issues/78123).

changelogs/fragments/apt_repo_debug.yml

@@ -1,3 +0,0 @@
----
-minor_changes:
-    - apt_repository - use correct debug method to print debug message.

changelogs/fragments/auto_legacy.yml

@@ -0,0 +1,3 @@
+---
+removed_features:
+    - interpreter_discovery - removed auto_legacy and auto_legacy_slient options (https://github.com/ansible/ansible/issues/85995).

changelogs/fragments/basic-py-deprecations.yml

@@ -0,0 +1,4 @@
+deprecated_features:
+  - The ``get_platfrom()`` function from ``ansible.module_utils.basic`` is deprecated and will be removed in ansible-core 2.24. Use ``platform.system()`` from the Python standard library instead.
+  - The ``load_platform_subclass()`` function from ``ansible.module_utils.basic`` is deprecated and will be removed in ansible-core 2.24. Use ``get_platform_subclass()`` from ``ansible.module_utils.common.sys_info`` instead.
+  - The ``get_all_subclasses()`` function from ``ansible.module_utils.basic`` is deprecated and will be removed in ansible-core 2.24. Use ``get_all_subclasses()`` from ``ansible.module_utils.common._utils`` instead.

changelogs/fragments/basic_shlex_split.yml

@@ -0,0 +1,3 @@
+---
+bugfixes:
+  - basic - fail in controlled manner when ``run_command()`` attempts to parse a command with broken syntax passed in as a string (https://github.com/ansible/ansible/issues/85719).

changelogs/fragments/blockinfile-new-module-option-encoding.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - blockinfile - add new module option ``encoding`` to support files in encodings other than UTF-8 (https://github.com/ansible/ansible/pull/85291).

changelogs/fragments/cache_avoid_path_keys.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - cache plugins based on the BaseFileCache class will now sanitize keys to avoid names that could cause issues with the storage path

changelogs/fragments/compat_datetime.yml

@@ -0,0 +1,3 @@
+---
+removed_features:
+    - compat.datetime - removed deprecated datetime compat APIs (https://github.com/ansible/ansible/issues/86000).

changelogs/fragments/concat_coerce_none_to_empty.yml

@@ -1,3 +0,0 @@
-bugfixes:
-  - templating - Multi-node template results coerce embedded ``None`` nodes to empty string (instead of rendering literal ``None`` to the output).
-  - argspec validation - The ``str`` argspec type treats ``None`` values as empty string for better consistency with pre-2.19 templating conversions.

changelogs/fragments/config_lookup_fix.yml

@@ -0,0 +1,2 @@
+bugfixes:
+ - config lookup now properly factors in variables and show_origin when checking entries from the global configuration.

changelogs/fragments/configure_display_skipped_hosts.yml

@@ -0,0 +1,3 @@
+minor_changes:
+  - callback plugins - support configuration using extra variables.
+  - default callback plugin - add variable configuration for ``display_skipped_hosts`` (https://github.com/ansible/ansible/issues/84469).

changelogs/fragments/copy_directory_mode_remote_src.yml

@@ -0,0 +1,3 @@
+---
+bugfixes:
+    - copy - honor directory_mode when copying directories with remote_src=True (https://github.com/ansible/ansible/issues/81292).

changelogs/fragments/ctypes-crypt.yml

@@ -0,0 +1,2 @@
+minor_changes:
+- password hashing - Add support back for using the ``crypt`` implmentation from the C library used to build Python, or with expanded functionality using ``libxcrypt``

changelogs/fragments/data-loader-more-minimize-type-juggling.yml

@@ -0,0 +1,2 @@
+minor_changes:
+- DataLoader - Update ``DataLoader`` to deal exclusively in str

changelogs/fragments/deprecate_inject.yml

@@ -1,3 +0,0 @@
-deprecated_features:
-- INJECT_FACTS_AS_VARS configuration currently defaults to ``True``, this is now deprecated and it will switch to ``False`` by Ansible 2.24.
-  You will only get notified if you are accessing 'injected' facts (for example, ansible_os_distribution vs ansible_facts['os_distribution']).

changelogs/fragments/display_internals.yml

@@ -1,3 +0,0 @@
-bugfixes:
-  - display - Fixed reference to undefined `_DeferredWarningContext` when issuing early warnings during startup.
-    (https://github.com/ansible/ansible/issues/85886)

changelogs/fragments/dnf-remove-install_repoquery.yml

@@ -1,2 +0,0 @@
-removed_features:
-  - dnf/dnf5 - remove deprecated ``install_repoquery`` option.

changelogs/fragments/dnf_installroot_dir.yml

@@ -1,3 +0,0 @@
----
-bugfixes:
-    - dnf - Check if installroot is directory or not (https://github.com/ansible/ansible/issues/85680).

changelogs/fragments/du_size.yml

@@ -0,0 +1,4 @@
+---
+minor_changes:
+    - file - return disk_usage_bytes fact (https://github.com/ansible/ansible/issues/70834).
+    - stat - return disk_usage_bytes fact (https://github.com/ansible/ansible/issues/70834).

changelogs/fragments/elide_broken_conditional_result.yml

@@ -1,3 +0,0 @@
-bugfixes:
-  - conditionals - When displaying a broken conditional error or deprecation warning, 
-    the origin of the non-boolean result is included (if available), and the raw result is omitted.

changelogs/fragments/encrypt.yml

@@ -1,3 +0,0 @@
----
-removed_features:
-    - encrypt - remove deprecated passlib_or_crypt API.

changelogs/fragments/failed-when-exception.yml

@@ -1,4 +0,0 @@
-bugfixes:
-  - failed_when - When using ``failed_when`` to suppress an error, the ``exception`` key in the result is renamed to ``failed_when_suppressed_exception``.
-    This prevents the error from being displayed by callbacks after being suppressed.
-    (https://github.com/ansible/ansible/issues/85505)

changelogs/fragments/fetch_file.yml

@@ -1,3 +0,0 @@
----
-minor_changes:
-  - fetch_file - add ca_path and cookies parameter arguments (https://github.com/ansible/ansible/issues/85172).

changelogs/fragments/first-found-example.yml

@@ -0,0 +1,2 @@
+bugfixes:
+ - first_found - Correct the "Include tasks only if one of the files exists, otherwise skip" example.

changelogs/fragments/fix-displaying-delegate_to-ansible_host.yml

@@ -1,3 +0,0 @@
-bugfixes:
-  - callback plugins - fix displaying the rendered ``ansible_host`` variable with ``delegate_to`` (https://github.com/ansible/ansible/issues/84922).
-  - ssh connection - fix documented variables for the ``host`` option. Connection options can be configured with delegated variables in general.

changelogs/fragments/fix-listing-nested-filter-and-test-plugins.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - ansible-doc --list/--list_files/--metadata-dump - fixed relative imports in nested filter/test plugin files (https://github.com/ansible/ansible/issues/85753).

changelogs/fragments/fix_script_error.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - script inventory plugin will now show correct 'incorrect' type when doing implicit conversions on groups.

changelogs/fragments/galaxy-use-import-task-url.yml

@@ -1,2 +0,0 @@
-bugfixes:
-- ansible-galaxy - Use the provided import task url, instead of parsing to get the task id and reconstructing the URL

changelogs/fragments/generator_use_extra.yml

@@ -0,0 +1,3 @@
+---
+minor_changes:
+  - generator - add support for extra vars (https://github.com/ansible/ansible/issues/83270).

changelogs/fragments/get_url_regex.yml

@@ -0,0 +1,3 @@
+---
+bugfixes:
+    - get_url - fix regex for GNU Digest line which is used in comparing checksums (https://github.com/ansible/ansible/issues/86132).

changelogs/fragments/getattr_marker_access.yml

@@ -1,4 +0,0 @@
-bugfixes:
-  - templating - Undefined marker values sourced from the Jinja ``getattr->getitem`` fallback are now accessed correctly,
-    raising AnsibleUndefinedVariable for user plugins that do not understand markers.
-    Previously, these values were erroneously returned to user plugin code that had not opted in to marker acceptance.

changelogs/fragments/getent-empty-split-fail-json.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - getent - handle non-empty string for split parameter value (https://github.com/ansible/ansible/issues/85720).

changelogs/fragments/getuser-exception-handling.yml

@@ -0,0 +1,4 @@
+bugfixes:
+  - display - Fix ``getuser`` fallback error handling on Python 3.13 and later.
+    (https://github.com/ansible/ansible/issues/86142)
+  - local connection - Fix ``getuser`` fallback error handling on Python 3.13 and later.

changelogs/fragments/git_gpg.yml

@@ -0,0 +1,3 @@
+---
+removed_features:
+    - git - removed deprecated alias gpg_whitelist (https://github.com/ansible/ansible/issues/86004).

changelogs/fragments/group-priority-warning.yml

@@ -0,0 +1,2 @@
+minor_changes:
+  - group - Add warning message when invalid priority values are provided to Group.set_priority() method (https://github.com/ansible/ansible/pull/85468).

changelogs/fragments/hide_proto.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - ansible-galaxy no longer shows the internal protomatter collection when listing.

changelogs/fragments/import_tasks-dont-readd-tags.yml

@@ -1,2 +0,0 @@
-bugfixes:
-  - Do not re-add ``tags`` on blocks from within ``import_tasks``.

changelogs/fragments/include_tasks_fail_rescue.yml

@@ -0,0 +1,5 @@
+minor_changes:
+  - include_role has new option `rescuable` to allow it to toggle between task failure and syntax errors.
+bugfixes:
+  - include_role would emit a syntax error on X_from options errors, but a task failure when missing a role to make it consistent now it also emits a task failure on missing tasks_from, which makes it subject to error handling in the play.
+  - include_role, would ignore missing X_from files if the subdir (tasks/vars/handlers/defaults) did not exist, now it is a proper error.

changelogs/fragments/include_vars.yml

@@ -1,6 +0,0 @@
----
-deprecated_features:
-    - include_vars - Specifying 'ignore_files' as a string is deprecated.
-minor_changes:
-    - include_vars - Raise an error if 'ignore_files' is not specified as a list.
-    - include_vars - Raise an error if 'extensions' is not specified as a list.

changelogs/fragments/jinja-syntax-error-line-numbers.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - template module - Report the line number for Jinja syntax errors in template files.

changelogs/fragments/known_issues_jinja_error.yml

@@ -1,4 +0,0 @@
-known_issues:
-  - templating - Exceptions raised in a Jinja ``set`` or ``with`` block which are not accessed by the template are ignored in the same manner as undefined values.
-  - templating - Passing a container created in a Jinja ``set`` or ``with`` block to a method results in a copy of that container.
-    Mutations to that container which are not returned by the method will be discarded.

changelogs/fragments/lineinfile-new-module-option-encoding.yml

@@ -1,2 +0,0 @@
-minor_changes:
-  - lineinfile - add new module option ``encoding`` to support files in encodings other than UTF-8 (https://github.com/ansible/ansible/pull/84999).