Salt 3006.30 LTS, 3007.17 STS, 3008.5 LTS Now Available

Salt Releases 3006.30, 3007.17, and 3008.5: Aligning with the Upstream Certifi Trust Store Policy

We’re releasing Salt 3006.30, 3007.17, and 3008.5 today following a subsequent administrative update to the Python trust store ecosystem. These are narrow, targeted patch releases — each contains exactly one change on top of the prior release in its line, nothing else.

What happened

Following the initial mitigation of the eMudhra/emSign certificate authority intermediate key compromise (remediated in certifi 2026.10.19), Mozilla issued a progressive trust policy change (certifi 2026.10.23). This update completely removed the remaining, uncompromised emSign root certificates from the baseline trust store as part of a proactive cleanup of the CA authority.

While the critical key vulnerabilities were already fully neutralized in our previous release cycle, we are issuing this immediate follow-up to provide upstream trust policy alignment and prevent friction for infrastructure environments utilizing strict, automated security and compliance scanners.

How this affects Salt

Salt ships the certifi package as its fallback trust store inside our onedir Python runtimes. Whenever Salt or its underlying HTTP dependencies execute secure operations without a explicitly specified custom CA configuration bundle, certificate verification falls back to the embedded store.

By updating our onedir boundaries to the absolute latest trust standard, downstream compliance platforms can cleanly validate that the local Python environments match current upstream security definitions.

What we fixed

Each of these three releases contains exactly one change, cherry-picked identically across all three branches:

  • Bumped certifi to 2026.10.23 (the floor in requirements/base.txt, and the exact pin in every requirements/static/pkg/* lock file used to build onedir packages).

The bundled pip companion package remains at the fully remediated version 26.2.2 introduced in the last round of builds. No other features, bug fixes, or development branch changes are included in these point releases.

Upgrade guidance

We recommend upgrading to the applicable version to maintain absolute policy consistency across your environments and to eliminate compliance tracker false positives.

As always, see the full release notes for 3006.30, 3007.17, and 3008.5 for complete changelogs.

Credit

This update reflects administrative adjustments within the third-party Python Packaging Authority trust store pipeline. Thanks to our package maintainers and community contributors for their rapid testing and validation workflows across our active release lines.

Note on 3006.x: 3006.x releases are now security fixes only. Bugfixes will no longer be backported to the 3006 LTS line, so we recommend planning your move to 3008 LTS.

Note on 3007.17: This is a Capstone release, the final release of the 3007 STS line. We recommend planning your move to a supported LTS release, 3006 LTS or 3008 LTS.

Installation & Upgrade Notes

Users can install Salt via PyPI or through our official package repositories.

IMPORTANT
While Salt supports differing versions between the Master and Minions during transitional periods, it is highly recommended to upgrade your Salt Master first to prevent compatibility issues.

Reporting Issues & Feedback

If you encounter any unexpected behavior, bugs, or packaging issues with these releases, please let us know right away by opening an issue:

Open a GitHub Issue

Thank you for being a vital part of the Salt Project community. Happy automating!

Last updated on October 26, 2026.