Log message:
ansible-core: updated to 2.21.2

2.21.2

Minor Changes

- ansible-test - Added a timeout callback that dumps thread stacks when the test \ 
execution deadline defined by ``ansible-test env --timeout`` is approaching.
- parallel fact gathering - the async wrapper now considers the timeout when \ 
determining whether to kill the process running the module. Previously, a 5 \ 
second sleep occurred twice before checking if the job had remaining time.

Bugfixes

- encrypt - fix bcrypt salt string formatting on musl libc by ensuring it is \ 
always zero-padded to 2 digits \ 
(https://github.com/ansible/ansible/issues/87180).
- parallel fact gathering - fix hang caused by corrupt async job files.

Log message:
ansible-core: updated to 2.21.1

v2.21.1

Security Fixes

- ansible-galaxy install - Ensure role requirements are passed as positional \ 
arguments to :command:`git clone`. Previously, a malicious role author could \ 
inject arbitrary git configuration in role dependencies. (CVE-2026-11332)
- psrp - Do not log raw stdout/stderr on verbosity 5 when task has ``no_log: \ 
true`` set
- winrm - Do not log raw stdout/stderr on verbosity 5 when task has ``no_log: \ 
true`` set

Bugfixes

- cli - handle empty value for PAGER \ 
(https://github.com/ansible/ansible/issues/86898).
- config - use correct key value for inject_invocation setting \ 
(https://github.com/ansible/ansible/issues/86999).
- free strategy - Fix ``IndexError`` when hosts become unreachable during \ 
playbook execution (https://github.com/ansible/ansible/issues/87027).
- meta pseudo-action - Fixed callback args passed to ``v2_runner_on_skipped`` \ 
when any ``meta`` action was skipped by a ``when`` condition; added test \ 
coverage. A previous regression caused the callback dispatch to be omitted and a \ 
warning issued.
- module_utils sanitize_keys and remove_value functions now sort their input to \ 
ensure matching subsets are always obscured.
- module_utils/basic.py - Fix ``AnsibleModule.run_command()`` to handle ``None`` \ 
return from non-blocking pipe reads \ 
(https://github.com/ansible/ansible/issues/86920).
- wait_for - use ``errno.ENOENT`` symbolic constant instead of hardcoded value \ 
for improved code portability.

Log message:
ansible-core: updated to 2.21.0

v2.21.0

Major Changes

- ``ansible-galaxy install`` and ``ansible-galaxy collection install|download`` \ 
- collections that declare a ``requires_ansible`` version that is not compatible \ 
with the running ansible-core version are now excluded from installation and \ 
download by default. In previous versions, ansible-galaxy would install such \ 
collections even if doing so resulted in an error at load time. To restore the \ 
previous behavior, set ``COLLECTIONS_ON_ANSIBLE_VERSION_MISMATCH`` to ``ignore`` \ 
in your configuration. (https://github.com/ansible/ansible/issues/78539)
- action plugins - Actions can directly register variables at several precedence \ 
layers using the ``register_host_variables`` method on ``ActionBase``. \ 
Previously, variable registration could only be simulated by user action plugins \ 
by returning ``ansible_facts`` with insecure fact injection.
- register projections - The ``register`` task keyword allows mapping multiple \ 
variable names to Jinja expressions to transform task results and other \ 
variables. The mapping form can replace many usages of ``set_fact`` and allows \ 
order-independent chained access to other variable expressions within the same \ 
task.
- task implicit object - A new ``_task`` implicit object is available for use in \ 
``register`` and task conditional expressions (e.g., ``failed_when``). The \ 
result of the current task can be accessed via the ``_task.result`` property, \ 
without the use of ``register``. Under a loop, ``_task.result`` is the most \ 
recently completed result and ``_task.loop_result`` provides access to \ 
accumulated loop results. The ``_task.polymorphic_result`` property provides \ 
compatibility with classic name-only ``register`` in loops. The value is the \ 
result of the most recent loop iteration, then becomes the final list loop \ 
result once the loop is complete.

Log message:
ansible-core: updated to 2.20.6

v2.20.6

Security Fixes

- psrp - Do not log raw stdout/stderr on verbosity 5 when task has ``no_log: \ 
true`` set
- winrm - Do not log raw stdout/stderr on verbosity 5 when task has ``no_log: \ 
true`` set

Bugfixes

- ansible-test remote alias - Alias values for ``--controller`` and ``--target`` \ 
are properly resolved for ``remote``. Previously, remote alias values (e.g. \ 
``fedora/latest``) resolved to the correct name only for the legacy ``--remote`` \ 
arg, failing with an unknown image error for the newer args.
- git - use the branch configured in ``.gitmodules`` or the remote HEAD instead \ 
of hardcoding ``master`` when ``track_submodules=yes`` \ 
(https://github.com/ansible/ansible/issues/77691).
- module_utils/basic.py - Fix ``AnsibleModule.run_command()`` to handle ``None`` \ 
return from non-blocking pipe reads \ 
(https://github.com/ansible/ansible/issues/86920).

Log message:
ansible-core: updated to 2.20.5

2.20.5

Minor Changes

- ansible-test - Generate ``dist_info`` when running tests.
- ansible-test - Replace the ``parallels`` managed macOS provider with a new \ 
``mac`` provider.
- ansible-test - Switch managed macOS remotes from x86_64 to aarch64.

Bugfixes

- Fix ``validate_argspec`` when tags are defined on the play. The ``always`` tag \ 
is only added if the play has no tags.
- ``--start-at-task`` - fix starting at the requested task instead of starting \ 
at the next block or play. Play level tasks run first. \ 
(https://github.com/ansible/ansible/issues/86268)
- ansible-galaxy collection - Fix using the server configuration for \ 
``validate_certs`` when downloading collections. \ 
(https://github.com/ansible/ansible/issues/86694)
- ansible_facts[os_*] - Contained wrong information, if ClearLinux parsing was \ 
tried before falling back to general os-release parsing
- templating - Fix traceback when using ``deepcopy`` on an imported template \ 
(https://github.com/ansible/ansible/issues/86723).

Log message:
ansible-core: updated to 2.20.4

v2.20.4

Minor Changes

- ansible-test - Add container/remote aliases for more loosely specifying \ 
managed test environments.
- ansible-test - Add support for using the Ansible Core CI service from GitHub \ 
Actions.

Bugfixes

- Fix up ``powershell`` shell commands when using a connection plugin that does \ 
not support stdin/pipeline input - \ 
https://github.com/ansible/ansible/issues/86397
- ansible-connection - Prevent unpickling failures in module contexts by \ 
ensuring that AnsibleTaggedObjects in pickled responses are converted to plain \ 
types in ``JsonRpcServer``.
- config lookup now uses preexisting constants for templating when needed.
- rpm_key - Use librpm library API instead of gpg utility to support version 6 \ 
PGP keys (https://github.com/ansible/ansible/issues/86157).
- yaml loading - Fix traceback when parsing YAML strings (not files) when using \ 
the pure Python implementation of PyYAML.

Log message:
ansible-core: updated to 2.20.3

v2.20.3

Minor Changes

- ansible-test - Update URL used to download FreeBSD wheels for managed remotes.
- ansible-test - Use the new API endpoint for the Ansible Core CI service.

Bugfixes

- Fix interpreter discovery on delegated ``async`` tasks \ 
(https://github.com/ansible/ansible/issues/86491)
- Fix up the Action plugin ``_make_tmp_path`` error to only include the command \ 
run rather than the shell's dataclass repr from ``mkdtemp``.
- local connection - Pass correct type to become plugins when checking password \ 
(https://github.com/ansible/ansible/issues/86458)

Log message:
ansible-core: updated to 2.20.2

v2.20.2

Minor Changes

- ansible-test - Replace RHEL 10.0 remote with 10.1.
- ansible-test - Replace RHEL 9.6 remote with 9.7.

Bugfixes

- Fix Windows LIB env var corruption \ 
(https://github.com/ansible-collections/ansible.windows/issues/297).
- ``ansible``, ``ansible-console`` - fix executing ``- meta: end_play`` tasks.
- ansible-test - Upgrade ``expat`` during provisioning of Fedora 42 remote instances.
- ansible_local will no longer trigger variable injection default value deprecation.
- copy - when a single-file local directory was specified as the source, \ 
``changed`` used to be ``false`` even when the source was actually copied. It \ 
now makes sure ``changed`` is ``true`` in this case. \ 
(https://github.com/ansible/ansible/issues/85833)
- deb822_repository - Remove ``Install-Python-Debian`` from files outputed by \ 
the ``deb822_repository`` module \ 
(https://github.com/ansible/ansible/issues/86395)
- dnf - When installing a dnf module, install and enable when missing, upgrade \ 
when present (https://github.com/ansible/ansible/issues/73457)
- dnf - fix package installation when specifying architecture without version \ 
(e.g., ``libgcc.i686``) where a different architecture of the same package is \ 
already installed (https://github.com/ansible/ansible/issues/86156).
- package, service, gather_facts - fix templating module_defaults for modules \ 
executed by these action plugins. \ 
(https://github.com/ansible/ansible/issues/85848)
- winrm - Provide a better error message if a domain user is specified using a \ 
User Principal Name (``UPN``) but the ``pykerberos`` library is not installed so \ 
Kerberos is unavailable.