Chef Infra Client 18.11.11 Released!

Chef Release Announcements
1

We are delighted to announce the availability of version 18.11.11 of Chef Infra Client.

New features

  • chef_client_config resource: Adds two new properties. directory_specs lets you configure permissions (owner, group, mode, and Windows rights and inherits) for each Chef-managed directory: :config, :client_d, :logs, :cache, and :backups. client_rb_mode lets you set the file mode of the generated client.rb file (defaults to "0640"). (#16025)
  • dnf_package and package resources: Adds support for the DNF5 package manager used in Fedora 41+ and future RHEL-based systems, including updated version-lock handling and config-manager command differences between DNF4 and DNF5. Chef Infra Client automatically detects which version of DNF is installed. No changes to existing cookbooks or recipes are required. (#16007)

Improvements

  • Template error messages now include the cookbook name and template filename, and are truncated to 10,000 characters to prevent exposing large node attribute data in logs. (#16087)
  • The dnf_package resource now locates the DNF Python helper more efficiently, reducing unnecessary shell_out calls during converge runs on DNF-based systems. (#15971)

Bug fixes

  • The Compliance Phase now runs only once per client run. When a resource triggers action :reboot_now, the second Compliance Phase execution is skipped. (#15997)
  • Passwords, auth tokens, and private key passphrases are now properly masked in logs and run reports for resources including chocolatey_installer, chocolatey_package, habitat_package, habitat_sup, openssl_ec_private_key, and openssl_rsa_private_key. (#16138)
  • The chocolatey_installer resource now constructs a full file path for Invoke-WebRequest -OutFile, which PowerShell 5.1 requires. (#15925)
  • The authenticator.retrieve_certificate_key method no longer intermittently raises NoMethodError on Windows. (#16076)
  • lazy content blocks in the file resource are now evaluated only once during a single converge run. (#15715)
  • The rest_resource DSL now behaves correctly. (#15970)
  • The keyboard input issue in reline 0.3.1 that affected interactive Ruby sessions is resolved. (#15963)
  • platform_family now correctly identifies platform families on all supported platforms. (#15742)

Security

  • Fixed a path traversal vulnerability in the archive_file resource. Extraction now rejects archive entries with .. sequences, absolute paths, and unsafe symlinks. (#16119)
  • Updated aws-sdk-s3 to 1.218.0 to address CVE-2025-14762 and GHSA-wx95-c6cv-8532. (#15848)
  • Updated rack to 3.2.6 to address multiple CVEs including CVE-2026-34835 and CVE-2026-34829. (#15854)
  • Updated faraday to 2.14.3 to address GHSA-98m9-hrrm-r99r and GHSA-5rv5-xj5j-3484. (#16154)

Packages

  • We're releasing an AIX package for this release. (#16109)

Dependency updates

  • Updated train-winrm, train-core, and chef to the latest releases. (#15671)
  • Updated pry from 0.13.0 to 0.15.2. (#15801)
  • Updated vault requirement from > 0.18.2 to >= 0.18.2, < 0.21.0. (#15802)
  • Updated webmock from 3.26.1 to 3.26.2. (#15809)
  • Updated crack from 0.4.5 to 1.0.1. (#15828)
  • Updated win32-eventlog requirement from = 0.6.3 to = 0.6.7. (#15829)
  • Updated highline requirement from >= 1.6.9, < 3 to >= 1.6.9, < 4. (#15831)
  • Updated unf_ext requirement from > 0.0.8.2 to >= 0.0.8.2, < 0.0.10.0. (#15816)
  • Updated Ohai from 73fcb7e to 7a4e10c; this updated ohai, json, and net-ssh gems. (#15805)
  • Updated pry-stack_explorer from 0.6.1 to 0.6.2. (#15830)
  • Updated Cookstyle from 8.6.4 to 8.6.10. (#15810)
  • Updated aws-sdk-secretsmanager from 1.128.0 to 1.129.0. (#15807)
  • Updated net-ssh from 7.3.0 to 7.3.2. (#15818)
  • Updated inspec-core requirement from >= 5, < 6 to >= 5, < 8. (#15814)
  • Updated uri requirement from ~> 1.0.4 to >= 1.0.4, < 1.2.0. (#15804)
  • Updated tomlrb from 1.3.0 to 2.0.4. (#15808)
  • Updated addressable from 2.8.7 to 2.8.9. (#15819)
  • Removed MSYS-installed OpenSSL on Windows because Chef uses a different version. (#15863)
  • Updated pry-stack_explorer from 0.6.2 to 0.6.3. (#15877)
  • Updated rake from 13.3.1 to 13.4.2. (#15907)
  • Updated Ohai from 7a4e10c to 2b30698. (#15951)
  • Updated train-core from 3.16.1 to 3.16.2. (#15930)
  • Locked aws-sdk-s3 to a specific version to prevent incompatible GCC versions from loading. (#15966)
  • Updated Ohai from 2b30698 to 31b00ef. (#15965)
  • Updated ffi-yajl requirement from ~> 2.2 to >= 2.2, < 4.0. (#16013)
  • Updated train-core from 3.16.2 to 3.16.3. (#15976)
  • Updated uuidtools requirement from >= 2.1.5, < 3.0 to >= 2.1.5, < 4.0. (#16056)
  • Updated chef-zero from 15.1.0 to 15.1.11. (#16057)
  • Updated train-core from 3.16.3 to 3.16.5. (#16103)
  • Updated chef-vault from 4.2.9 to 4.2.12. (#16129)
  • Updated concurrent-ruby from 1.3.6 to 1.3.7. (#16114)
  • Updated Chef InSpec to 5.24.24. (#16142)
  • Updated diff-lcs requirement from >= 1.2.4, != 1.4.0, < 1.6.0 to >= 1.2.4, != 1.4.0, < 2.1.0. (#15826)