Puppet Core 8.16.0 Release Announcement We’re excited to announce the release of Puppet Core 8.16.0, available as of 18th November 2025. This update focuses on strengthening the security and reliability of Puppet Core by addressing several upstream vulnerabilities through updated components and patched libraries. Delivering secure-hardened Puppet Core binaries remains a top priority for us, and this release delivers important fixes that help ensure Puppet Core users stay protected and up to date. Security Enhancements Updated Thor Gem The Thor gem has been updated to version 1.4.0 to resolve CVE-2025-54314. Updated curl Curl has been upgraded to version 8.16.0, addressing CVE-2025-9086 and CVE-2025-10148. Updated REXML Gem The REXML gem is now updated to version 3.4.2, fixing CVE-2025-58767. Updated OpenSSL OpenSSL has been updated to version 3.0.18 to address CVE-2025-9230 and CVE-2025-9232. Patched URI Gem The URI gem included with the Puppet agent has been patched to resolve CVE-2025-61594. Thanks, The Puppet Core Team. This e-mail may contain information that is privileged or confidential. If you are not the intended recipient, please delete the e-mail and any attachments and notify us immediately. -- You received this message because you are subscribed to the Google Groups "Puppet Announce" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-announce+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/puppet-announce/MN2PR20MB3183A770FC359AF42951F10EE6D7A%40MN2PR20MB3183.namprd20.prod.outlook.com. Sent by Zapier