Update dependency pulpcore_client to '~> 3.116.0'

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
pulpcore_client	'~> 3.22.2' → '~> 3.116.0'

---

Release Notes

pulp/pulpcore (pulpcore_client)

v3.116.0

Compare Source

REST API {: #​3.116.0-rest-api }

Features {: #​3.116.0-rest-api-feature }

• Added --backend option to the add-signing-service management command, enabling Sequoia (sq) as an alternative to GPG for key management. Use --backend sq to register signing services using Sequoia's key store.
  #​7479

Bugfixes {: #​3.116.0-rest-api-bugfix }

• Reduced lock contention for distribution updates that leave base_path unchanged.
  #​3322,
  #​7896
• Fix temp file leak in pull-through metadata streaming.
  #​7846
• Fixed domain list returning all domains to authenticated users instead of only domains they can view.
  #​7898
• Fixed RedisWorker leaking Redis locks when task acquire, abort, cancel, or immediate dispatch cleanup failed.
  #​7902
• Fixed the waiting_tasks metric to count only tasks that can run in parallel under resource locks, matching worker FIFO scheduling.
  #​7938
• Fixed Redis workers polling the database at the single-worker rate during startup by learning the online worker count before the first heartbeat.
• Increased the content app's maximum HTTP header field size from 8190 to 16384 bytes to support PQC (post-quantum) X.509 certificates forwarded via the X-CLIENT-CERT header.

Plugin API {: #​3.116.0-plugin-api }

No significant changes.

Pulp File {: #​3.116.0-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.116.0-pulp-cert-guard }

No significant changes.

---

v3.115.4

Compare Source

REST API {: #​3.115.4-rest-api }

Bugfixes {: #​3.115.4-rest-api-bugfix }

• Reduced lock contention for distribution updates that leave base_path unchanged.
  #​3322,
  #​7896
• Fixed the waiting_tasks metric to count only tasks that can run in parallel under resource locks, matching worker FIFO scheduling.
  #​7938
• Fixed Redis workers polling the database at the single-worker rate during startup by learning the online worker count before the first heartbeat.

Plugin API {: #​3.115.4-plugin-api }

No significant changes.

Pulp File {: #​3.115.4-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.115.4-pulp-cert-guard }

No significant changes.

---

v3.115.3

Compare Source

REST API {: #​3.115.3-rest-api }

Bugfixes {: #​3.115.3-rest-api-bugfix }

• Fixed domain list returning all domains to authenticated users instead of only domains they can view.
  #​7898

Plugin API {: #​3.115.3-plugin-api }

No significant changes.

Pulp File {: #​3.115.3-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.115.3-pulp-cert-guard }

No significant changes.

---

v3.115.2

Compare Source

REST API {: #​3.115.2-rest-api }

No significant changes.

Plugin API {: #​3.115.2-plugin-api }

No significant changes.

Pulp File {: #​3.115.2-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.115.2-pulp-cert-guard }

No significant changes.

---

v3.115.1

Compare Source

Yank reason: Broken settings-setup - fixed in .115.2

REST API {: #​3.115.1-rest-api }

No significant changes.

Plugin API {: #​3.115.1-plugin-api }

No significant changes.

Pulp File {: #​3.115.1-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.115.1-pulp-cert-guard }

No significant changes.

---

v3.115.0

Compare Source

REST API {: #​3.115.0-rest-api }

Features {: #​3.115.0-rest-api-feature }

• Add /v4/ API to Pulp.

  This adds a /v4/ API path to Pulp, in parallel to the existing /v3/ path. The two
  are currently (nearly) identical APIs - see the /pulp/api/v4/status/ ouput for the
  only (current) end-user-visible impact.

  This change is primarily setting the stage to allow for future API changes and growth.
  It is in TECH PREVIEW, and is likely to have significant changes happening to it as we
  continue integrating into the rest of the Pulp architecture.
  #​6462

• Allow commas in pulp_labels values. To filter for labels containing commas, escape them
  with a backslash (e.g. ?pulp_label_select=key=val\,ue).
  #​7789

• Optimized response time when filtering repository versions by content.
  #​7799

• Added saml2 as a dependency option accompanied by the SAML_CONFIG setting.

Bugfixes {: #​3.115.0-rest-api-bugfix }

• Fixed content app directory listing generating broken links when distribution base paths contain colons.
  #​6955
• Fixed RelatedField rendering wrong domain in hrefs when DOMAIN_ENABLED=True.
  #​7835
• Fixed RepositoryVersion.remove_content failing when the queryset is derived from self.content and the repository version contains >= 65,535 content items. The lazy queryset was re-evaluated after content_ids was already updated, causing RepositoryContent entries to be left orphaned.
  #​7851
• Fixed a race condition when creating content with file_url or upload that could result in a duplicate artifact error.
• Fixed delete timeouts when removing repositories or repository versions with large numbers of PublishedArtifacts by batching bulk deletes and avoiding nested subqueries that produce poor PostgreSQL execution plans.
• Improved validation of relative paths to prevent a path traversal attack in filesystem exports. (CVE-2026-12701)
• Stopped shipping an insecure default as DJANGO_SECRET.

Improved Documentation {: #​3.115.0-rest-api-doc }

• Reformatted and partially rewrote the Pull-Request Walkthrough.

Removals {: #​3.115.0-rest-api-removal }

• Drop support for running with Django 4.
  #​7343

Plugin API {: #​3.115.0-plugin-api }

Features {: #​3.115.0-plugin-api-feature }

• Added pulp_domain to TaskSchedule so scheduled tasks dispatch in the correct domain. Name uniqueness is now per domain.
  #​7829

Removals {: #​3.115.0-plugin-api-removal }

• Made content_ids cache required with forceful migration and removed the /pulp/api/v3/datarepair/7465/ endpoint. This will run a migration that could take a while if you haven't already run the datarepair endpoint.
  #​7466
• Deactivated dynaconf boxify. This can affect plugins that access nested settings via dot instead of subscribing.

Pulp File {: #​3.115.0-pulp-file }

Features {: #​3.115.0-pulp-file-feature }

• Added sync optimization that skips re-syncing when the remote manifest has not changed. An optimize flag on the sync endpoint (default True) allows forcing a full sync when needed.

Pulp Cert Guard {: #​3.115.0-pulp-cert-guard }

No significant changes.

---

v3.114.2

Compare Source

REST API {: #​3.114.2-rest-api }

Bugfixes {: #​3.114.2-rest-api-bugfix }

• Improved validation of relative paths to prevent a path traversal attack in filesystem exports. (CVE-2026-12701)

Plugin API {: #​3.114.2-plugin-api }

No significant changes.

Pulp File {: #​3.114.2-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.114.2-pulp-cert-guard }

No significant changes.

---

v3.114.1

Compare Source

REST API {: #​3.114.1-rest-api }

Bugfixes {: #​3.114.1-rest-api-bugfix }

• Fixed content app directory listing generating broken links when distribution base paths contain colons.
  #​6955
• Fixed RelatedField rendering wrong domain in hrefs when DOMAIN_ENABLED=True.
  #​7835
• Fixed RepositoryVersion.remove_content failing when the queryset is derived from self.content and the repository version contains >= 65,535 content items. The lazy queryset was re-evaluated after content_ids was already updated, causing RepositoryContent entries to be left orphaned.
  #​7851
• Fixed a race condition when creating content with file_url or upload that could result in a duplicate artifact error.

Plugin API {: #​3.114.1-plugin-api }

No significant changes.

Pulp File {: #​3.114.1-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.114.1-pulp-cert-guard }

No significant changes.

---

v3.114.0

Compare Source

REST API {: #​3.114.0-rest-api }

Features {: #​3.114.0-rest-api-feature }

• Improved sync performance by caching content during re-syncs.

Bugfixes {: #​3.114.0-rest-api-bugfix }

• Enabled filesystem export of content synced with a streamed policy from a file:// remote, by reading the files from their local path instead of failing because no Artifact was downloaded.
  #​7746
• Respect the system /etc/hosts and nsswitch.conf configurations for sync configurations. We drop the aiodns resolver backend for aiohttp and use the default resolver.

Plugin API {: #​3.114.0-plugin-api }

Features {: #​3.114.0-plugin-api-feature }

• DeclarativeVersion now accepts deferred_fields to exclude fields not needed during sync, reducing memory usage and producing lighter queries.

Pulp File {: #​3.114.0-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.114.0-pulp-cert-guard }

No significant changes.

---

v3.113.0

Compare Source

REST API {: #​3.113.0-rest-api }

Features {: #​3.113.0-rest-api-feature }

• Added support for passing q_select as a parameter to the replicate action, allowing users to selectively sync a subset of upstream distributions without modifying the stored upstream-pulp configuration.
  #​7617
• Added the FeatureNotImplementedError exception to indicate that a requested feature is not yet implemented.

Bugfixes {: #​3.113.0-rest-api-bugfix }

• Optimized QueryExistingArtifacts by reducing database queries.
  #​7558
• Replication now reuses existing distributions matched by base_path when a name
  lookup misses (e.g. upstream rename), preventing base_path uniqueness conflicts
  and preserving content continuity. Stale distributions are also cleaned up
  before new distributions are created as an additional safeguard. Improved error
  reporting in finalize_replication to include details about which subtasks failed.
  #​7614
• Allow nested downloader_config to be passed json stringified.
  #​7677
• Fixed adjust_roles to use update_or_create instead of get_or_create when populating locked roles, so that a pre-existing role with locked=False is updated rather than causing a duplicate key error.

Plugin API {: #​3.113.0-plugin-api }

Features {: #​3.113.0-plugin-api-feature }

• Exposed StableOrderingFilter in the plugin API so pulp plugins can import it from pulpcore.plugin.
• Exposed cancel_task and cancel_task_group from pulpcore.plugin.tasking so plugins can import them.

Pulp File {: #​3.113.0-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.113.0-pulp-cert-guard }

No significant changes.

---

v3.112.1

Compare Source

REST API {: #​3.112.1-rest-api }

Bugfixes {: #​3.112.1-rest-api-bugfix }

• Optimized QueryExistingArtifacts by reducing database queries.
  #​7558
• Allow nested downloader_config to be passed json stringified.
  #​7677

Plugin API {: #​3.112.1-plugin-api }

Features {: #​3.112.1-plugin-api-feature }

• Exposed StableOrderingFilter in the plugin API so pulp plugins can import it from pulpcore.plugin.

Pulp File {: #​3.112.1-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.112.1-pulp-cert-guard }

No significant changes.

---

v3.112.0

Compare Source

REST API {: #​3.112.0-rest-api }

Bugfixes {: #​3.112.0-rest-api-bugfix }

• Decoupled the /livez liveness probe from the database so it returns 200 even when the database is unavailable.
  #​7721
• Fixed a bug where immediate tasks could be executed even if they were blocked by other tasks using the same resources.

Plugin API {: #​3.112.0-plugin-api }

Bugfixes {: #​3.112.0-plugin-api-bugfix }

• Removed the default=True from the overwrite field on NoArtifactContentSerializer so it no
  longer leaks into validated_data. This fixes plugins that splat content serializer data
  (**serializer.validated_data).

Pulp File {: #​3.112.0-pulp-file }

Features {: #​3.112.0-pulp-file-feature }

• Added NAME_FILTER_OPTIONS to the relative_path field in FileContentFilter, enabling contains, startswith, regex, and other lookup expressions.
  #​7719

Pulp Cert Guard {: #​3.112.0-pulp-cert-guard }

No significant changes.

---

v3.111.2

Compare Source

REST API {: #​3.111.2-rest-api }

Bugfixes {: #​3.111.2-rest-api-bugfix }

• Fixed a bug where immediate tasks could be executed even if they were blocked by other tasks using the same resources.

Plugin API {: #​3.111.2-plugin-api }

No significant changes.

Pulp File {: #​3.111.2-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.111.2-pulp-cert-guard }

No significant changes.

---

v3.111.1

Compare Source

REST API {: #​3.111.1-rest-api }

No significant changes.

Plugin API {: #​3.111.1-plugin-api }

Bugfixes {: #​3.111.1-plugin-api-bugfix }

• Removed the default=True from the overwrite field on NoArtifactContentSerializer so it no
  longer leaks into validated_data. This fixes plugins that splat content serializer data
  (**serializer.validated_data).

Pulp File {: #​3.111.1-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.111.1-pulp-cert-guard }

No significant changes.

---

v3.111.0

Compare Source

REST API {: #​3.111.0-rest-api }

Features {: #​3.111.0-rest-api-feature }

• Added an overwrite boolean parameter to the repository content modify and content upload
  endpoints. When set to false, the task will fail if the content being added would overwrite
  existing content based on repo_key_fields. Defaults to true.
  #​7550
• Add a configurable ResourceBudget for preventing over-subscription of the disk "properly". Adds a backpressure mechanism + flushing mechanism in order to ensure that batches get fully processed even if minsize hasn't yet been reached. Allows previous performance-reducing mitigations to be removed.
  #​7559
• Add more PulpExceptions. Treat DRF APIExceptions as safe in the task runner.
• Added network configuration fields (total_timeout, connect_timeout, sock_connect_timeout,
  sock_read_timeout, download_concurrency, max_retries) to the Upstream Pulp model, allowing
  these settings to be propagated to remotes created during replication.

Bugfixes {: #​3.111.0-rest-api-bugfix }

• Added a distributions lock to finalize_replication to prevent concurrent finalize tasks from different upstream servers from racing on the same distribution objects.
  #​7614
• Fixed TypeError: 'str' object has no attribute 'tolower' in _ensure_bool during incremental content exports. Changed .tolower() to .lower().
  #​7678
• Fixed add-signing-service management command failing with "There are N keys matching the key id" for PGP keys that have subkeys.
• Fixed cache forgetting the Content-Type header of ApiResponses
• Treat aiohttp.ClientError exceptions as safe in the task runner to preserve download error details when REDACT_UNSAFE_EXCEPTIONS is enabled.

Plugin API {: #​3.111.0-plugin-api }

Features {: #​3.111.0-plugin-api-feature }

• Exposed EncryptedJSONField via the plugin API.
  #​7690
• Exported DATETIME_FILTER_OPTIONS from pulpcore.plugin.viewsets.
• Renamed the Replicator constructor parameter and instance attribute from tls_settings to
  remote_settings to reflect the expanded set of remote configuration fields propagated during
  replication. The old tls_settings attribute is still available as a deprecated alias.

Pulp File {: #​3.111.0-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.111.0-pulp-cert-guard }

No significant changes.

---

v3.110.3

Compare Source

REST API {: #​3.110.3-rest-api }

Bugfixes {: #​3.110.3-rest-api-bugfix }

• Added a distributions lock to finalize_replication to prevent concurrent finalize tasks from different upstream servers from racing on the same distribution objects.
  #​7614
• Fixed cache forgetting the Content-Type header of ApiResponses

Plugin API {: #​3.110.3-plugin-api }

No significant changes.

Pulp File {: #​3.110.3-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.110.3-pulp-cert-guard }

No significant changes.

---

v3.110.2

Compare Source

REST API {: #​3.110.2-rest-api }

Bugfixes {: #​3.110.2-rest-api-bugfix }

• Fixed add-signing-service management command failing with "There are N keys matching the key id" for PGP keys that have subkeys.

Plugin API {: #​3.110.2-plugin-api }

No significant changes.

Pulp File {: #​3.110.2-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.110.2-pulp-cert-guard }

No significant changes.

---

v3.110.1

Compare Source

REST API {: #​3.110.1-rest-api }

Bugfixes {: #​3.110.1-rest-api-bugfix }

• Fixed TypeError: 'str' object has no attribute 'tolower' in _ensure_bool during incremental content exports. Changed .tolower() to .lower().
  #​7678

Plugin API {: #​3.110.1-plugin-api }

No significant changes.

Pulp File {: #​3.110.1-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.110.1-pulp-cert-guard }

No significant changes.

---

v3.110.0

Compare Source

REST API {: #​3.110.0-rest-api }

Bugfixes {: #​3.110.0-rest-api-bugfix }

• Replace use of the deprecated distutils. The module has been removed in Python 3.12 .
  #​7571
• Fixed RedisWorker stalling when more than 20 tasks are waiting on the same resource.
  The worker now doubles its fetch limit and retries until a runnable task is found or the
  entire queue has been examined.
  #​7612
• Fixed RedisWorker not always respecting FIFO order of tasks with shared resources.
  #​7616
• Fixed an issue where gpg_verify() was rejecting some valid PGP signatures after changes made in pulpcore 3.108.

Plugin API {: #​3.110.0-plugin-api }

Features {: #​3.110.0-plugin-api-feature }

• Added task_args and task_kwargs fields to TaskSchedule, allowing plugins to store positional
  and keyword arguments that are forwarded to tasks when they are dispatched on schedule. Both fields
  are encrypted at rest. TaskSchedule and TaskScheduleSerializer are now exposed via the plugin
  API.
  #​7608
• Allow plugins to access pulp_plugin_configs and get_plugin_config from pulpcore.app.apps via pulpcore.plugin.apps
  #​7650

Pulp File {: #​3.110.0-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.110.0-pulp-cert-guard }

No significant changes.

---

v3.109.3

Compare Source

REST API {: #​3.109.3-rest-api }

Bugfixes {: #​3.109.3-rest-api-bugfix }

• Replace use of the deprecated distutils. The module has been removed in Python 3.12 .
  #​7571

Plugin API {: #​3.109.3-plugin-api }

No significant changes.

Pulp File {: #​3.109.3-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.109.3-pulp-cert-guard }

No significant changes.

---

v3.109.2

Compare Source

REST API {: #​3.109.2-rest-api }

Bugfixes {: #​3.109.2-rest-api-bugfix }

• Fixed an issue where gpg_verify() was rejecting some valid PGP signatures after changes made in pulpcore 3.108.

Plugin API {: #​3.109.2-plugin-api }

No significant changes.

Pulp File {: #​3.109.2-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.109.2-pulp-cert-guard }

No significant changes.

---

v3.109.1

Compare Source

REST API {: #​3.109.1-rest-api }

Bugfixes {: #​3.109.1-rest-api-bugfix }

• Fixed RedisWorker stalling when more than 20 tasks are waiting on the same resource.
  The worker now doubles its fetch limit and retries until a runnable task is found or the
  entire queue has been examined.
  #​7612
• Fixed RedisWorker not always respecting FIFO order of tasks with shared resources.
  #​7616

Plugin API {: #​3.109.1-plugin-api }

No significant changes.

Pulp File {: #​3.109.1-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.109.1-pulp-cert-guard }

No significant changes.

---

v3.109.0

Compare Source

REST API {: #​3.109.0-rest-api }

Features {: #​3.109.0-rest-api-feature }

• Added support for serving superseded publications for a configurable retention period.
  #​7514
• Added ability for non-admin users to update their personal account fields

Bugfixes {: #​3.109.0-rest-api-bugfix }

• Added option to pulpcore-content and pulpcore-api to configure the gunicorn control socket path.
  The default path could cause permission errors on certain deployments setups.
  This feature was added in gunicorn>=25.1 and is ignored for lower version.
  #​7574
• Optimized cleanup_old_versions() by rewriting protected_versions() to avoid expensive JOINs
  on large databases and deferring the content_ids field during version deletion.
  #​7594
• Added new setting TASK_PREFER_DEFER to always defer immediate tasks to a task worker. Useful for systems with slow databases that frequently timeout immediate tasks.

Plugin API {: #​3.109.0-plugin-api }

No significant changes.

Pulp File {: #​3.109.0-pulp-file }

Bugfixes {: #​3.109.0-pulp-file-bugfix }

• Fixed double publish when performing file replication.
  #​7557

Pulp Cert Guard {: #​3.109.0-pulp-cert-guard }

No significant changes.

---

v3.108.2

Compare Source

REST API {: #​3.108.2-rest-api }

Bugfixes {: #​3.108.2-rest-api-bugfix }

• Fixed an issue where gpg_verify() was rejecting some valid PGP signatures after changes made in pulpcore 3.108.

Plugin API {: #​3.108.2-plugin-api }

No significant changes.

Pulp File {: #​3.108.2-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.108.2-pulp-cert-guard }

No significant changes.

---

v3.108.1

Compare Source

REST API {: #​3.108.1-rest-api }

Bugfixes {: #​3.108.1-rest-api-bugfix }

• Optimized cleanup_old_versions() by rewriting protected_versions() to avoid expensive JOINs
  on large databases and deferring the content_ids field during version deletion.
  #​7594
• Added new setting TASK_PREFER_DEFER to always defer immediate tasks to a task worker. Useful for systems with slow databases that frequently timeout immediate tasks.

Plugin API {: #​3.108.1-plugin-api }

No significant changes.

Pulp File {: #​3.108.1-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.108.1-pulp-cert-guard }

No significant changes.

---

v3.108.0

Compare Source

REST API {: #​3.108.0-rest-api }

Features {: #​3.108.0-rest-api-feature }

• Added WORKER_TYPE setting. Defaults to 'pulpcore'. 'redis' is also available.
  #​7210
• Added OTEL_METRICS_DISPATCH_INTERVAL_MINUTES setting to allow configuring the periodic telemetry
  dispatch interval (default: 5 minutes).
  #​7532
• Added pulpcore.app.find_url.find_api_root() to standardize Pulp url-creation.

Bugfixes {: #​3.108.0-rest-api-bugfix }

• Set default --max-requests 10000 and --max-requests-jitter 500 for API workers
  to prevent unbounded RSS growth from glibc heap fragmentation over long-lived worker processes.
  #​7482
• Fixed reset-admin-password command failing when using --random option on Django 5.
  #​7533
• Fixed a race condition that could sometimes occur when converting an existing non-replica Pulp instance into a replica ("reverse-replication"). Likely rare in real world use.

Plugin API {: #​3.108.0-plugin-api }

No significant changes.

Pulp File {: #​3.108.0-pulp-file }

Misc {: #​3.108.0-pulp-file-misc }

Pulp Cert Guard {: #​3.108.0-pulp-cert-guard }

No significant changes.

---

v3.107.1

Compare Source

REST API {: #​3.107.1-rest-api }

Bugfixes {: #​3.107.1-rest-api-bugfix }

• Fixed reset-admin-password command failing when using --random option on Django 5.
  #​7533

Plugin API {: #​3.107.1-plugin-api }

No significant changes.

Pulp File {: #​3.107.1-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.107.1-pulp-cert-guard }

No significant changes.

---

v3.107.0

Compare Source

REST API {: #​3.107.0-rest-api }

Features {: #​3.107.0-rest-api-feature }

• Added the created_resource_prns field to Task, returning the PRN of each created resource.
  #​7003
• Add REDACT_UNSAFE_EXCEPTIONS setting for strict exception handling.

Bugfixes {: #​3.107.0-rest-api-bugfix }

• Fixed a performance issue causing operations that process large numbers of HREFs to be ~1000x slower than equivalent PRN-based operations.
  #​6237
• Pulp Replicas now present all of their distribution updates at the end of the replication process, rather than each individual repository-distribution pair being updated individually as syncs and publishes are completed. Unfortunately for users with existing replicated setups the very first replication post-upgrade will still have the old behavior - but afterwards it should work as expected.
  #​7333

Plugin API {: #​3.107.0-plugin-api }

Features {: #​3.107.0-plugin-api-feature }

• Made the prefix on PgpKeyFingerprintField optional, defaulting to v4: when omitted.

Pulp File {: #​3.107.0-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.107.0-pulp-cert-guard }

No significant changes.

---

v3.106.0

Compare Source

REST API {: #​3.106.0-rest-api }

Features {: #​3.106.0-rest-api-feature }

• Added the content_guard_prn field to Distribution.
  #​7004
• Add a data repair API for admins - for more granular control and operations which are too long for migrations.
  #​7272
• Added retain_checkpoints field to Repository to automatically clear the checkpoint flag on older publications exceeding the limit.
  #​7428
• Added /pulp/api/v3/datarepair/7465/ endpoint to add missing repository version content_ids cache to all repository versions.
  #​7465
• It is now possible to set repository_version on any distribution type, including for publication-based content types where this was not previously the case. For publication-based content, selecting a repository_version to distribute will pick the latest publication for that repository version, just as selecting a repository will pick the latest repository version.

Bugfixes {: #​3.106.0-rest-api-bugfix }

• Fixed duplicate chunk uploads corrupting the entire upload
  #​6381
• Added upperbounds to uvloop (an optional dependency) to prevent a known bug in newer releases.
  #​7213
• Fixed bug where API process would miss heartbeats during long uploads.
  #​7315
• Fix remove-signing-service handling, can now remove service without --class argument.
  #​7318
• Fixed metadata artifacts being re-uploaded to storage when creating a publication for an already-published repository version.
  #​7344
• Fixed a bug when syncing a custom repository using the upstream username only (no password)
  did not send any authentication since both were required by the download factory.
  #​7425
• Added a management command (pulpcore-manager datarepair 7465) to populate the content_ids cache for all repository versions.
  #​7465
• Added a composite database index on (pulp_domain, size) to the Artifact model to improve
  query performance when loading metrics data.
  #​7475
• Added a GIN index to the pulp_labels field on Content and updated label filtering to use
  GIN-optimized lookups, improving query performance for label-based content searches.
  #​7477
• Fixed a bug where a worker would start running finalize_replication task before the
  replicate_distributions task finishes.
  #​7520

Plugin API {: #​3.106.0-plugin-api }

Features {: #​3.106.0-plugin-api-feature }

• Added PgpKeyFingerprintField serializer field to the plugin API for validating and normalizing type-prefixed OpenPGP key identifiers.

Bugfixes {: #​3.106.0-plugin-api-bugfix }

• Properly support DRF responses in Synchronous Content Cache.

Pulp File {: #​3.106.0-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.106.0-pulp-cert-guard }

No significant changes.

---

v3.105.16

Compare Source

REST API {: #​3.105.16-rest-api }

Bugfixes {: #​3.105.16-rest-api-bugfix }

• Reduced lock contention for distribution updates that leave base_path unchanged.
  #​3322,
  #​7896

Plugin API {: #​3.105.16-plugin-api }

No significant changes.

Pulp File {: #​3.105.16-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.105.16-pulp-cert-guard }

No significant changes.

---

v3.105.15

Compare Source

REST API {: #​3.105.15-rest-api }

Bugfixes {: #​3.105.15-rest-api-bugfix }

• Fixed domain list returning all domains to authenticated users instead of only domains they can view.
  #​7898

Plugin API {: #​3.105.15-plugin-api }

No significant changes.

Pulp File {: #​3.105.15-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.105.15-pulp-cert-guard }

No significant changes.

---

v3.105.14

Compare Source

REST API {: #​3.105.14-rest-api }

No significant changes.

Plugin API {: #​3.105.14-plugin-api }

No significant changes.

Pulp File {: #​3.105.14-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.105.14-pulp-cert-guard }

No significant changes.

---

v3.105.13

Compare Source

REST API {: #​3.105.13-rest-api }

Bugfixes {: #​3.105.13-rest-api-bugfix }

• Stopped shipping an insecure default as DJANGO_SECRET.

Plugin API {: #​3.105.13-plugin-api }

No significant changes.

Pulp File {: #​3.105.13-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.105.13-pulp-cert-guard }

No significant changes.

---

v3.105.12

Compare Source

REST API {: #​3.105.12-rest-api }

Bugfixes {: #​3.105.12-rest-api-bugfix }

• Improved validation of relative paths to prevent a path traversal attack in filesystem exports. (CVE-2026-12701)

Plugin API {: #​3.105.12-plugin-api }

No significant changes.

Pulp File {: #​3.105.12-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.105.12-pulp-cert-guard }

No significant changes.

---

v3.105.11

Compare Source

REST API {: #​3.105.11-rest-api }

No significant changes.

Plugin API {: #​3.105.11-plugin-api }

No significant changes.

Pulp File {: #​3.105.11-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.105.11-pulp-cert-guard }

No significant changes.

---

v3.105.10

Compare Source

REST API {: #​3.105.10-rest-api }

Bugfixes {: #​3.105.10-rest-api-bugfix }

• Fixed content app directory listing generating broken links when distribution base paths contain colons.
  #​6955
• Fixed RelatedField rendering wrong domain in hrefs when DOMAIN_ENABLED=True.
  #​7835
• Fixed RepositoryVersion.remove_content failing when the queryset is derived from self.content and the repository version contains >= 65,535 content items. The lazy queryset was re-evaluated after content_ids was already updated, causing RepositoryContent entries to be left orphaned.
  #​7851
• Fixed a race condition when creating content with file_url or upload that could result in a duplicate artifact error.

Plugin API {: #​3.105.10-plugin-api }

No significant changes.

Pulp File {: #​3.105.10-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.105.10-pulp-cert-guard }

No significant changes.

---

v3.105.9

Compare Source

REST API {: #​3.105.9-rest-api }

Bugfixes {: #​3.105.9-rest-api-bugfix }

• Fixed adjust_roles to use update_or_create instead of get_or_create when populating locked roles, so that a pre-existing role with locked=False is updated rather than causing a duplicate key error.

Plugin API {: #​3.105.9-plugin-api }

No significant changes.

Pulp File {: #​3.105.9-pulp-file }

No significant changes.

Pulp Cert Guard {: #​3.105.9-pulp-cert-guard }

No significant changes.

---

v3.105.8

Compare Source

REST API {: #​3.105.8-rest-api }

Bugfixes {: #​3.105.8-rest-api-bugfix }

• Optimized QueryExistingArtifacts by reducing database queries.
  #​7558
• Allow nested downloader_config to be passed json stringified.
  [

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.