openstack/kolla — Week of 2026-06-13

Security hardening. The headline change converts kolla-build to Jinja2's SandboxedEnvironment to prevent server-side template injection, landing on master and three stable branches for a coordinated fix across ~460 lines (993019).

Image coverage. A new container image build for kerbside was added (~90 lines), expanding the set of services Kolla can produce images for.

Dependency and packaging fixes. mod_auth_mellon is now installed from EPEL in the httpd image, and the keepalived image gains the mariadb client package across three branches. On the Python side, an openstacksdk==4.14.0 pin was applied and then reverted on two branches once unblocked, and setuptools<82 is now pinned for bifrost on stable/2025.1. A stray "Switch to Gazpacho/2026.1 sources" change was also reverted.

CI. The Debian upgrade job moved to Trixie.