pulp/pulpcore 3.115.0

on GitHub

3.115.0 (2026-07-21)

REST API

Features

• Add /v4/ API to Pulp.

  This adds a /v4/ API path to Pulp, in parallel to the existing /v3/ path. The two
  are currently (nearly) identical APIs - see the /pulp/api/v4/status/ ouput for the
  only (current) end-user-visible impact.

  This change is primarily setting the stage to allow for future API changes and growth.
  It is in TECH PREVIEW, and is likely to have significant changes happening to it as we
  continue integrating into the rest of the Pulp architecture.
  #6462

• Allow commas in pulp_labels values. To filter for labels containing commas, escape them
  with a backslash (e.g. ?pulp_label_select=key=val\,ue).
  #7789

• Optimized response time when filtering repository versions by content.
  #7799

• Added saml2 as a dependency option accompanied by the SAML_CONFIG setting.

Bugfixes

• Fixed content app directory listing generating broken links when distribution base paths contain colons.
  #6955
• Fixed RelatedField rendering wrong domain in hrefs when DOMAIN_ENABLED=True.
  #7835
• Fixed RepositoryVersion.remove_content failing when the queryset is derived from self.content and the repository version contains >= 65,535 content items. The lazy queryset was re-evaluated after content_ids was already updated, causing RepositoryContent entries to be left orphaned.
  #7851
• Fixed a race condition when creating content with file_url or upload that could result in a duplicate artifact error.
• Fixed delete timeouts when removing repositories or repository versions with large numbers of PublishedArtifacts by batching bulk deletes and avoiding nested subqueries that produce poor PostgreSQL execution plans.
• Improved validation of relative paths to prevent a path traversal attack in filesystem exports. (CVE-2026-12701)
• Stopped shipping an insecure default as DJANGO_SECRET.

Improved Documentation

• Reformatted and partially rewrote the Pull-Request Walkthrough.

Removals

• Drop support for running with Django 4.
  #7343

Plugin API

Features

• Added pulp_domain to TaskSchedule so scheduled tasks dispatch in the correct domain. Name uniqueness is now per domain.
  #7829

Removals

• Made content_ids cache required with forceful migration and removed the /pulp/api/v3/datarepair/7465/ endpoint. This will run a migration that could take a while if you haven't already run the datarepair endpoint.
  #7466
• Deactivated dynaconf boxify. This can affect plugins that access nested settings via dot instead of subscribing.

Pulp File

Features

• Added sync optimization that skips re-syncing when the remote manifest has not changed. An optimize flag on the sync endpoint (default True) allows forcing a full sync when needed.

Pulp Cert Guard

No significant changes.