Pending Release Notes

Release Date: 18 December, 2024.

Components

• Updated Chef Infra Client from v18.5.0 to v18.6.2 and Knife from v18.5.0 to v18.6.2. See the Chef Infra Client release notes for a full list of improvements and features.
• Updated Chef InSpec from v5.22.55 to v5.22.65. See the InSpec release notes for more information.
• Updated kitchen-dokken to v2.20.7.

Improvements

• Updated the chef-cli gem from v5.6.14 to v5.6.16 so users can connect to JFrog Artifactory with an access token. ([#239] (https://github.com/chef/chef-cli/pull/239))

Licensing

These changes prepare users for new license requirements in Chef Infra Client 19. (#14669)

The knife bootstrap command now validates your license key and downloads from Chef’s new download APIs. If you don’t have a license, Knife falls back to the older Omnitruck API and returns a warning to add a license.

We added the following commands to manage licenses with Knife:

• knife license
• knife license list
• knife license add

See the Chef licensing documentation and download API documentation for more information.

Security

• Updated OpenSSL from v3.0.12 to v3.0.15 to resolve the following CVEs:

  • CVE-2024-5535
  • CVE-2024-6119
  • CVE-2024-4741

• Updated libxml2 from v2.12.5 to v2.12.7 to resolve the following CVE:

  • CVE-2024-34459

• Updated libarchive from v3.7.4 to v3.7.5 to resolve the following CVEs:

  • CVE-2024-37407
  • CVE-2024-48957
  • CVE-2024-48958

• Updated git-windows from v2.41.0 to v2.47.0 to resolve the following CVE:

  • CVE-2023-38545

• Updated ruby and ruby-msys2-devkit from v3.1.2 to v3.1.6 to resolve the following CVE:

  • CVE-2023-38545

• Updated RDoc to v6.4.1.1 to resolve the following CVE:

  • CVE-2024-27281