pulp/pulpcore 3.120.0

on GitHub

3.120.0 (2026-09-29)

REST API

Features

• Added workload identity authentication, so a CI job can authenticate with a short-lived OIDC token instead of a stored secret and receive per-request roles computed from the WORKLOAD_IDENTITY setting.

Bugfixes

• Improved the performance of the latest publication lookup when serving content
  from a repository-backed distribution.
  #1995
• Fixed file downloader path sanitation. CVE-2026-90959
• Fixed the long_running pytest-mark, so that it correctly applies even when "nightly"
  is selected. This includes fixing a window in the task-cleanup path, where a missing
  worker's jobs were not getting cleaned up until a new task entered the system.

Plugin API

No significant changes.

Pulp File

No significant changes.

Pulp Cert Guard

No significant changes.