(release-3006.24)=
# Salt 3006.24 release notes

<!---
Do not edit this file. This is auto generated.
Edit the templates in doc/topics/releases/templates/
for a given release.
-->


<!--
Add release specific details below
-->

<!--
Do not edit the changelog below.
This is auto generated.
-->
## Changelog

### Fixed

- Fixed inotify file descriptor leak in beacons. When beacons are refreshed
  (e.g. during module refresh or pillar refresh), the old beacon modules are now
  properly closed before creating new ones, preventing exhaustion of the inotify
  instance limit. Also fixed beacon delete not calling the beacon's close
  function, causing resource leaks and CPU spin after deleting beacons at runtime
  via ``beacons.delete``. [#66449](https://github.com/saltstack/salt/issues/66449)
- Fixed x509_v2.certificate_managed state fails if another state.apply is queued [#66929](https://github.com/saltstack/salt/issues/66929)
- Fixed x509_v2 private_key_managed failing on Windows due to default `mode` argument [#66942](https://github.com/saltstack/salt/issues/66942)
- Windows LGPO / audit policy: Advanced audit policy is now read and applied through the Windows security API (AuditQuerySystemPolicy / AuditSetSystemPolicy) instead of parsing auditpol.exe output, so behavior no longer depends on the system locale. [#68354](https://github.com/saltstack/salt/issues/68354)
- Decouple the pub timeout from opts timeout. Programatic useage of client now has a 30 second timeout. [#68597](https://github.com/saltstack/salt/issues/68597)
- Fix salt-call and salt-pip to honor configured user for privilege dropping [#68684](https://github.com/saltstack/salt/issues/68684)
- Fix `mac_brew_pkg.list_pkgs` crashing or producing incorrect results when
  Homebrew returns `null` values for cask metadata:

  - When the installed version of a cask is `null` (e.g. Homebrew cannot
    determine the installed version), it is now reported as `"unknown"`
    instead of raising an error.
  - When `full_token` is `null`, it is now filtered out so that `None`
    is never used as a package name key in the returned dictionary. [#68763](https://github.com/saltstack/salt/issues/68763)
- - Prevented generation of spurious ppbt toolchain in /root/.local on RPM upgrade
  - Stale pycache files now get cleaned up on RPM upgrade [#68781](https://github.com/saltstack/salt/issues/68781)
- Ensure Salt file and directory ownership is correctly detected and preserved when upgrading RPM and Debian packages, particularly when running Salt as a non-root user. [#68793](https://github.com/saltstack/salt/issues/68793)
- Upgrade relenv to 0.22.5 which pin's openssl to an LTS version (3.5.x) [#68803](https://github.com/saltstack/salt/issues/68803)
- Patch the vendored tornado version to account for CVE patches that have been applied. [#68820](https://github.com/saltstack/salt/issues/68820)
- Made x509_v2 certificate_managed respect `copypath` and `prepend_cn` parameters [#68828](https://github.com/saltstack/salt/issues/68828)
- Upgrade pyopenssl to >= 26.0.0
   - CVE-2026-27459
   - CVE-2026-27448 [#68832](https://github.com/saltstack/salt/issues/68832)
- Patch tornado for BDSA-2025-60810 [#68853](https://github.com/saltstack/salt/issues/68853)
- Patch tornado for BDSA-2026-3867 [#68854](https://github.com/saltstack/salt/issues/68854)
- Fixed source package builds (DEB/RPM) failing with ``LookupError: hatchling is already being built`` by adding ``hatchling`` to the ``--only-binary`` allow-list so pip uses its universal wheel instead of attempting a circular source build. [#68858](https://github.com/saltstack/salt/issues/68858)
- Upgrade relenv to 0.22.7

  * Upgread Python Versions 3.12.13, 3.11.15, 3.10.20
    - CVE-2024-6923: Header injection in email module
    - CVE-2026-24515, CVE-2026-25210, CVE-2025-59375: XML memory amplification and libexpat vulnerabilities
  * SQLite 3.51.3.0
    - CVE-2025-70873: Heap memory disclosure in zipfile extension
    - CVE-2025-7709: Integer overflow in FTS5 extension
    - Fixes WAL-reset bug preventing database corruption
  * XZ Utils 5.8.3
    - CVE-2026-34743: Buffer overflow in lzma_index_append()
  * Expat 2.7.5
    - CVE-2026-32776: NULL pointer dereference in external parameter entities
    - CVE-2026-32777: Infinite loop in entityValueProcessor
    - CVE-2026-32778: NULL pointer dereference during OOM recovery [#68884](https://github.com/saltstack/salt/issues/68884)
- Minion properly closes pub channel when authentication to the master failes,
  prevents leaking file handles. [#68901](https://github.com/saltstack/salt/issues/68901)
- Patch tornado for BDSA-2026-6522 [#68920](https://github.com/saltstack/salt/issues/68920)
- Perl 5.42.2.1
      CVE-2026-4176: Memory corruption in Compress::Raw::Zlib core module
      CVE-2026-3381 / CVE-2026-27171: zlib vulnerabilities within compression capabilities
  OpenSSL 3.5.6
      CVE-2026-31790: Leakage from uninitialized memory in RSA KEM RSASVE
      CVE-2026-2673: Loss of key agreement group tuple structure
      CVE-2026-28387: Potential use-after-free in DANE client code
      CVE-2026-28388: DoS via NULL pointer dereference in delta CRL processing
      CVE-2026-31789: Heap buffer overflow in hexadecimal conversion
      CVE-2026-28389 / CVE-2026-28390: NULL pointer dereferences in CMS processing
  SQLite 3.53.0.0
      CVE-2025-6965: High-severity memory corruption flaw in aggregate terms [#68986](https://github.com/saltstack/salt/issues/68986)
