openstack/ironic — Week of 2026-07-11

Security response. The week was dominated by coordinated fixes for two CVEs shipped across every supported branch. CVE-2026-44918 blocks rehoming resources to nodes with a different owner, landing as eight ~340-line backports plus a follow-up (996529) tightening the check further. CVE-2026-54423 blocks the vendor.send_raw passthrough, going out as seven parallel patches. Together these account for roughly 4,000 lines of the week's churn.

Feature work. A new ironic-manage command lands to improve driver discoverability, wired into the CLI reference docs. The API gains JSON schemas for the volume_target/volume_connector and portgroups endpoints. Typing work continues across the driver stack: annotations on the base driver/interface for tasks and steps, type hints on hardware-type supported interfaces and step arginfo helpers, stub annotations on base interface methods, a new ParsedKernelCommandLine type, and a fresh mypy tox environment and CI job to enforce it.

Bug fixes. bootfile_name_by_arch now considers boot mode (four-branch backport), BIOS firmware updates recover when the Redfish TaskMonitor disappears (three branches), and Glance image-member lookups are skipped for non-shared images (three branches). Node history events are truncated to avoid DB column overflow, pending-attribute checks are made conditional, and duplicate middleware reimports are removed.

Elsewhere. The oslo_policy[enforce_scope] override is dropped and a small pep8 cleanup lands in redfish/firmware.py.