openstack/ironic — 2026-06-06

Security hardening. The week is dominated by a coordinated security push backported across stable branches. New validation rejects malformed kernel_append_params so injected values can't smuggle extra kernel parameters, and ISO9660 handling gains a directory-traversal guard — both landed on master plus six and five stable branches respectively. A companion change disables driver_info-level pxe_template overrides on seven branches, and file URL validation is hoisted into the main deploy_utils path. Capping the surface from the outside, OSSN-0099 JSON body depth/size limiting middleware shipped to master and three stable branches.

TLS hardening. A second strand tightens transport security across the outbound clients: HTTP image service, Redfish BMC connections, the OCI registry client, and the Ansible stream_url module all gained TLS-hardening options. Together with the validation work above, this is roughly the bulk of the ~23k lines of churn.

Driver and agent fixes. Redfish gets a bound on the failure reason string returned via RFB and a fix for the any_left flag accumulating across storage controllers, plus clearer vmedia insertion error messages. A new agent flag lets operators disable bootloader installation during deploy.

Tooling. CI pinned setuptools to a still-shipping range and aligned voting jobs with the gate; the Zanata translation import also landed.