New release v2.17.4 (#83924 )

Update Ansible release version to v2.17.4rc1.post0. (#83894 )
New release v2.17.4rc1 (#83891 )
2024-09-09 14:26:24 -05:00 · 2024-09-03 22:05:21 +00:00 · 2024-09-03 16:31:20 -05:00 · 2024-09-03 15:25:00 -05:00 · 2024-09-03 12:27:41 -05:00 · 2024-09-03 12:26:18 -05:00
330 changed files with 3428 additions and 6705 deletions
--- a/.azure-pipelines/azure-pipelines.yml
+++ b/.azure-pipelines/azure-pipelines.yml
@ -31,7 +31,7 @@ variables:
  - name: fetchDepth
    value: 500
  - name: defaultContainer
-    value: quay.io/ansible/azure-pipelines-test-container:4.0.1
+    value: quay.io/ansible/azure-pipelines-test-container:6.0.0

 pool: Standard

@ -193,8 +193,6 @@ stages:
          targets:
            - name: IOS Python
              test: ios/csr1000v/
-            - name: VyOS Python
-              test: vyos/1.1.8/
  - stage: Summary
    condition: succeededOrFailed()
    dependsOn:
--- a/.azure-pipelines/commands/incidental/vyos.sh
+++ b/.azure-pipelines/commands/incidental/vyos.sh
@ -1 +0,0 @@
-network.sh
--- a/changelogs/CHANGELOG-v2.17.rst
+++ b/changelogs/CHANGELOG-v2.17.rst
@ -0,0 +1,369 @@
+==============================================
+ansible-core 2.17 "Gallows Pole" Release Notes
+==============================================
+
+.. contents:: Topics
+
+v2.17.4
+=======
+
+Release Summary
+---------------
+
+| Release Date: 2024-09-09
+| `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
+
+Bugfixes
+--------
+
+- Fix ``SemanticVersion.parse()`` to store the version string so that ``__repr__`` reports it instead of ``None`` (https://github.com/ansible/ansible/pull/83831).
+- Fix an issue where registered variable was not available for templating in ``loop_control.label`` on skipped looped tasks (https://github.com/ansible/ansible/issues/83619)
+- Fix for ``meta`` tasks breaking host/fork affinity with ``host_pinned`` strategy (https://github.com/ansible/ansible/issues/83294)
+- Fix using the current task's directory for looking up relative paths within roles (https://github.com/ansible/ansible/issues/82695).
+- atomic_move - fix using the setgid bit on the parent directory when creating files (https://github.com/ansible/ansible/issues/46742, https://github.com/ansible/ansible/issues/67177).
+- connection plugins using the 'extras' option feature would need variables to match the plugin's loaded name, sometimes requiring fqcn, which is not the same as the documented/declared/expected variables. Now we fall back to the 'basename' of the fqcn, but plugin authors can still set the expected value directly.
+- csvfile lookup - give an error when no search term is provided using modern config syntax (https://github.com/ansible/ansible/issues/83689).
+- include_tasks - Display location when attempting to load a task list where ``include_*`` did not specify any value - https://github.com/ansible/ansible/issues/83874
+- powershell - Improve CLIXML decoding to decode all control characters and unicode characters that are encoded as surrogate pairs.
+- psrp - Fix bug when attempting to fetch a file path that contains special glob characters like ``[]``
+- runtime-metadata sanity test - do not crash on deprecations if ``galaxy.yml`` contains an empty ``version`` field (https://github.com/ansible/ansible/pull/83831).
+- ssh - Fix bug when attempting to fetch a file path with characters that should be quoted when using the ``piped`` transfer method
+
+v2.17.3
+=======
+
+Release Summary
+---------------
+
+| Release Date: 2024-08-12
+| `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
+
+Minor Changes
+-------------
+
+- ansible-test - Improve the error message shown when an unknown ``--remote`` or ``--docker`` option is given.
+- ansible-test - Removed the ``vyos/1.1.8`` network remote as it is no longer functional.
+
+Bugfixes
+--------
+
+- Warning now includes filename and line number of variable when specifying a list of dictionaries for vars (https://github.com/ansible/ansible/issues/82528).
+- config, restored the ability to set module compression via a variable
+- debconf - fix normalization of value representation for boolean vtypes in new packages (https://github.com/ansible/ansible/issues/83594)
+- linear strategy: fix handlers included via ``include_tasks`` handler to be executed in lockstep (https://github.com/ansible/ansible/issues/83019)
+
+v2.17.2
+=======
+
+Release Summary
+---------------
+
+| Release Date: 2024-07-15
+| `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
+
+Bugfixes
+--------
+
+- Fix a traceback when an environment variable contains certain special characters (https://github.com/ansible/ansible/issues/83498)
+- dnf - reverted incomplete fix from 2.17.2rc1 (https://github.com/ansible/ansible/pull/83504)
+- dnf, dnf5 - fix for installing a set of packages by specifying them using a wildcard character (https://github.com/ansible/ansible/issues/83373)
+- linear strategy now provides a properly templated task name to the v2_runner_on_started callback event.
+- package_facts - ignore warnings sent by apk on stderr (https://github.com/ansible/ansible/issues/83501).
+- replace - Updated before/after example (https://github.com/ansible/ansible/issues/83390).
+- templating hostvars under native jinja will not cause serialization errors anymore.
+
+v2.17.1
+=======
+
+Release Summary
+---------------
+
+| Release Date: 2024-06-17
+| `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
+
+Minor Changes
+-------------
+
+- ansible-test - Update ``pypi-test-container`` to version 3.1.0.
+
+Bugfixes
+--------
+
+- Fix rapid memory usage growth when notifying handlers using the ``listen`` keyword (https://github.com/ansible/ansible/issues/83392)
+- Fix the task attribute ``resolved_action`` to show the FQCN instead of ``None`` when ``action`` or ``local_action`` is used in the playbook.
+- Fix using ``module_defaults`` with ``local_action``/``action`` (https://github.com/ansible/ansible/issues/81905).
+- fixed unit test test_borken_cowsay to address mock not been properly applied when existing unix system already have cowsay installed.
+- powershell - Implement more robust deletion mechanism for C# code compilation temporary files. This should avoid scenarios where the underlying temporary directory may be temporarily locked by antivirus tools or other IO problems. A failure to delete one of these temporary directories will result in a warning rather than an outright failure.
+- shell plugin - properly quote all needed components of shell commands (https://github.com/ansible/ansible/issues/82535)
+
+v2.17.0
+=======
+
+Release Summary
+---------------
+
+| Release Date: 2024-05-20
+| `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
+
+Major Changes
+-------------
+
+- urls.py - Removed support for Python 2
+
+Minor Changes
+-------------
+
+- Add ``dump`` and ``passno`` mount information to facts component (https://github.com/ansible/ansible/issues/80478)
+- Added MIRACLE LINUX 9.2 in RedHat OS Family.
+- Interpreter Discovery - Remove hardcoded references to specific python interpreters to use for certain distro versions, and modify logic for python3 to become the default.
+- Use Python's built-in ``functools.update_wrapper`` instead an inline copy from Python 3.7.
+- User can now set ansible.log to record higher verbosity than what is specified for display via new configuration item LOG_VERBOSITY.
+- ``DEFAULT_PRIVATE_ROLE_VARS`` is now overridden by explicit setting of ``public`` for ``include_roles`` and ``import_roles``.
+- ``ansible-galaxy role|collection init`` - accept ``--extra-vars`` to supplement/override the variables ``ansible-galaxy`` injects for templating ``.j2`` files in the skeleton.
+- ``import_role`` action now also gets a ``public`` option that controls variable exports,  default depending on ``DEFAULT_PRIVATE_ROLE_VARS`` (if using defaults equates to ``public=True``).
+- added configuration item ``TARGET_LOG_INFO`` that allows the user/author to add an information string to the log output on targets.
+- ansible-doc - treat double newlines in documentation strings as paragraph breaks. This is useful to create multi-paragraph notes in module/plugin documentation (https://github.com/ansible/ansible/pull/82465).
+- ansible-doc output has been revamped to make it more visually pleasing when going to a terminal, also more concise, use -v to show extra information.
+- ansible-galaxy - Started normalizing build directory with a trailing separator when building collections, internally. (https://github.com/ansible/ansible/pull/81619).
+- ansible-galaxy dependency resolution messages have changed the unexplained 'virtual' collection for the specific type ('scm', 'dir', etc) that is more user friendly
+- ansible-test - Add Alpine 3.19 container.
+- ansible-test - Add Alpine 3.19 to remotes.
+- ansible-test - Add Fedora 39 container.
+- ansible-test - Add Fedora 39 remote.
+- ansible-test - Add a work-around for permission denied errors when using ``pytest >= 8`` on multi-user systems with an installed version of ``ansible-test``.
+- ansible-test - Add support for RHEL 9.3 remotes.
+- ansible-test - Added a macOS 14.3 remote VM.
+- ansible-test - Bump the ``nios-test-container`` from version 2.0.0 to version 3.0.0.
+- ansible-test - Containers and remotes managed by ansible-test will have their Python ``EXTERNALLY-MANAGED`` marker (PEP668) removed. This provides backwards compatibility for existing tests running in newer environments which mark their Python as externally managed. A future version of ansible-test may change this behavior, requiring tests to be adapted to such environments.
+- ansible-test - Make Python 3.12 the default version used in the ``base`` and ``default`` containers.
+- ansible-test - Remove Alpine 3(.18) container.
+- ansible-test - Remove Alpine 3.18 from remotes.
+- ansible-test - Remove Fedora 38 remote support.
+- ansible-test - Remove Fedora 38 test container.
+- ansible-test - Remove rhel/9.2 test remote
+- ansible-test - Remove the FreeBSD 13.2 remote.
+- ansible-test - Removed fallback to ``virtualenv`` when ``-m venv`` is non-functional.
+- ansible-test - Removed test remotes: macos/13.2
+- ansible-test - Removed the ``no-basestring`` sanity test. The test is no longer necessary now that Python 3 is required.
+- ansible-test - Removed the ``no-dict-iteritems``, ``no-dict-iterkeys`` and ``no-dict-itervalues`` sanity tests. The tests are no longer necessary since Python 3 is required.
+- ansible-test - Removed the ``no-main-display`` sanity test. The unwanted pattern is unlikely to occur, since the test has existed since Ansible 2.8.
+- ansible-test - Removed the ``no-unicode-literals`` sanity test. The test is unnecessary now that Python 3 is required and the ``unicode_literals`` feature has no effect.
+- ansible-test - Special handling for installation of ``cryptography`` has been removed, as it is no longer necessary.
+- ansible-test - The ``shellcheck`` sanity test no longer disables the ``SC2164`` check. In most cases, seeing this error means the script is missing ``set -e``.
+- ansible-test - The ``unidiomatic-typecheck`` rule has been enabled in the ``pylint`` sanity test.
+- ansible-test - The ``unidiomatic-typecheck`` rule has been removed from the ``validate-modules`` sanity test.
+- ansible-test - Update the base and default containers to use Ubuntu 22.04 for the base image. This also updates PowerShell to version 7.4.0 with .NET 8.0.0 and ShellCheck to version 0.8.0.
+- ansible-test - Updated the CloudStack test container to version 1.7.0.
+- ansible-test - Updated the distro test containers to version 6.3.0 to include coverage 7.3.2 for Python 3.8+. The alpine3 container is now based on 3.18 instead of 3.17 and includes Python 3.11 instead of Python 3.10.
+- ansible-test - Updated the distro test containers to version 7.1.0.
+- ansible-test - When ansible-test installs requirements, it now instructs pip to allow installs on externally managed environments as defined by PEP 668. This only occurs in ephemeral environments managed by ansible-test, such as containers, or when the `--requirements` option is used.
+- ansible-test - When invoking ``sleep`` in containers during container setup, the ``env`` command is used to avoid invoking the shell builtin, if present.
+- ansible-test - document block name now included in error message for YAML parsing errors (https://github.com/ansible/ansible/issues/82353).
+- ansible-test - sanity test allows ``EXAMPLES`` to be multi-document YAML (https://github.com/ansible/ansible/issues/82353).
+- ansible-test now has FreeBSD 13.3 and 14.0 support
+- ansible.builtin.user - Remove user not found warning (https://github.com/ansible/ansible/issues/80267)
+- apt_repository.py - use api.launchpad.net endpoint instead of launchpad.net/api
+- async tasks can now also support check mode at the same time.
+- async_status now supports check mode.
+- constructed inventory plugin - Adding a note that only group_vars of explicit groups are loaded (https://github.com/ansible/ansible/pull/82580).
+- csvfile - add a keycol parameter to specify in which column to search.
+- dnf - add the ``best`` option
+- dnf5 - add the ``best`` option
+- filter plugin - Add the count and mandatory_count parameters in the regex_replace filter
+- find - add a encoding parameter to specify which encoding of the files to be searched.
+- git module - gpg_allowlist name was added in 2.17 and we will eventually deprecate the gpg_whitelist alias.
+- import_role - allow subdirectories with ``_from`` options for parity with ``include_role`` (https://github.com/ansible/ansible/issues/82584).
+- module argument spec - Allow module authors to include arbitrary additional context in the argument spec, by making use of a new top level key called ``context``. This key should be a dict type. This allows for users to customize what they place in the argument spec, without having to ignore sanity tests that validate the schema.
+- modules - Add the ability for an action plugin to call ``self._execute_module(*, ignore_unknown_opts=True)`` to execute a module with options that may not be supported for the version being called. This tells the module basic wrapper to ignore validating the options provided match the arg spec.
+- package action now has a configuration that overrides the detected package manager, it is still overridden itself by the use option.
+- py3compat - Remove ``ansible.utils.py3compat`` as it is no longer necessary
+- removed the unused argument ``create_new_password`` from ``CLI.build_vault_ids`` (https://github.com/ansible/ansible/pull/82066).
+- urls - Add support for TLS 1.3 post handshake certificate authentication - https://github.com/ansible/ansible/issues/81782
+- urls - reduce complexity of ``Request.open``
+- user - accept yescrypt hash as user password
+- validate-modules tests now correctly handles ``choices`` in dictionary format.
+
+Breaking Changes / Porting Guide
+--------------------------------
+
+- assert - Nested templating may result in an inability for the conditional to be evaluated. See the porting guide for more information.
+
+Deprecated Features
+-------------------
+
+- Old style vars plugins which use the entrypoints `get_host_vars` or `get_group_vars` are deprecated. The plugin should be updated to inherit from `BaseVarsPlugin` and define a `get_vars` method as the entrypoint.
+- The 'required' parameter in 'ansible.module_utils.common.process.get_bin_path' API is deprecated (https://github.com/ansible/ansible/issues/82464).
+- ``module_utils`` - importing the following convenience helpers from ``ansible.module_utils.basic`` has been deprecated: ``get_exception``, ``literal_eval``, ``_literal_eval``, ``datetime``, ``signal``, ``types``, ``chain``, ``repeat``, ``PY2``, ``PY3``, ``b``, ``binary_type``, ``integer_types``, ``iteritems``, ``string_types``, ``test_type``, ``map`` and ``shlex_quote``.
+- ansible-doc - role entrypoint attributes are deprecated and eventually will no longer be shown in ansible-doc from ansible-core 2.20 on (https://github.com/ansible/ansible/issues/82639, https://github.com/ansible/ansible/pull/82678).
+- paramiko connection plugin, configuration items in the global scope are being deprecated and will be removed in favor or the existing same options in the plugin itself. Users should not need to change anything (how to configure them are the same) but plugin authors using the global constants should move to using the plugin's get_option().
+
+Removed Features (previously deprecated)
+----------------------------------------
+
+- Remove deprecated APIs from ansible-docs (https://github.com/ansible/ansible/issues/81716).
+- Remove deprecated JINJA2_NATIVE_WARNING environment variable (https://github.com/ansible/ansible/issues/81714)
+- Remove deprecated ``scp_if_ssh`` from ssh connection plugin (https://github.com/ansible/ansible/issues/81715).
+- Remove deprecated crypt support from ansible.utils.encrypt (https://github.com/ansible/ansible/issues/81717)
+- Removed Python 2.7 and Python 3.6 as a supported remote version. Python 3.7+ is now required for target execution.
+- With the removal of Python 2 support, the yum module and yum action plugin are removed and redirected to ``dnf``.
+
+Security Fixes
+--------------
+
+- ANSIBLE_NO_LOG - Address issue where ANSIBLE_NO_LOG was ignored (CVE-2024-0690)
+- ansible-galaxy - Prevent roles from using symlinks to overwrite files outside of the installation directory (CVE-2023-5115)
+- templating - Address issues where internal templating can cause unsafe variables to lose their unsafe designation (CVE-2023-5764)
+
+Bugfixes
+--------
+
+- Add a version ceiling constraint for pypsrp to avoid potential breaking changes in the 1.0.0 release.
+- All core lookups now use set_option(s) even when doing their own custom parsing. This ensures that the options are always the proper type.
+- Allow for searching handler subdir for included task via include_role (https://github.com/ansible/ansible/issues/81722)
+- AnsibleModule.atomic_move - fix preserving extended ACLs of the destination when it exists (https://github.com/ansible/ansible/issues/72929).
+- Cache host_group_vars after instantiating it once and limit the amount of repetitive work it needs to do every time it runs.
+- Call PluginLoader.all() once for vars plugins, and load vars plugins that run automatically or are enabled specifically by name subsequently.
+- Consolidate systemd detection logic into one place (https://github.com/ansible/ansible/issues/80975).
+- Consolidated the list of internal static vars, centralized them as constant and completed from some missing entries.
+- Do not print undefined error message twice (https://github.com/ansible/ansible/issues/78703).
+- Enable file cache for vaulted files during vars lookup to fix a strong performance penalty in huge and complex playbboks.
+- Fix NEVRA parsing of package names that include digit(s) in them (https://github.com/ansible/ansible/issues/76463, https://github.com/ansible/ansible/issues/81018)
+- Fix ``force_handlers`` not working with ``any_errors_fatal`` (https://github.com/ansible/ansible/issues/36308)
+- Fix ``run_once`` being incorrectly interpreted on handlers (https://github.com/ansible/ansible/issues/81666)
+- Fix an issue when setting a plugin name from an unsafe source resulted in ``ValueError: unmarshallable object`` (https://github.com/ansible/ansible/issues/82708)
+- Fix check for missing _sub_plugin attribute in older connection plugins (https://github.com/ansible/ansible/pull/82954)
+- Fix condition for unquoting configuration strings from ini files (https://github.com/ansible/ansible/issues/82387).
+- Fix for when ``any_errors_fatal`` was ignored if error occurred in a block with always (https://github.com/ansible/ansible/issues/31543)
+- Fix handlers not being executed in lockstep using the linear strategy in some cases (https://github.com/ansible/ansible/issues/82307)
+- Fix handling missing urls in ansible.module_utils.urls.fetch_file for Python 3.
+- Fix issue where an ``include_tasks`` handler in a role was not able to locate a file in ``tasks/`` when ``tasks_from`` was used as a role entry point and ``main.yml`` was not present (https://github.com/ansible/ansible/issues/82241)
+- Fix issues when tasks withing nested blocks wouldn't run when ``force_handlers`` is set (https://github.com/ansible/ansible/issues/81533)
+- Fix loading vars_plugins in roles (https://github.com/ansible/ansible/issues/82239).
+- Fix notifying role handlers by listen keyword topics with the "role_name : " prefix (https://github.com/ansible/ansible/issues/82849).
+- Fix setting proper locale for git executable when running on non english systems, ensuring git output can always be parsed.
+- Fix tasks in always section not being executed for nested blocks with ``any_errors_fatal`` (https://github.com/ansible/ansible/issues/73246)
+- Fixes permission for cache json file from 600 to 644 (https://github.com/ansible/ansible/issues/82683).
+- Give the tombstone error for ``include`` pre-fork like other tombstoned action/module plugins.
+- Harden python templates for respawn and ansiballz around str literal quoting
+- Include the task location when a module or action plugin is deprecated (https://github.com/ansible/ansible/issues/82450).
+- Interpreter discovery - Add ``Amzn`` to ``OS_FAMILY_MAP`` for correct family fallback for interpreter discovery (https://github.com/ansible/ansible/issues/80882).
+- Mirror the behavior of dnf on the command line when handling NEVRAs with omitted epoch (https://github.com/ansible/ansible/issues/71808)
+- Plugin loader does not dedupe nor cache filter/test plugins by file basename, but full path name.
+- Properly template tags in parent blocks (https://github.com/ansible/ansible/issues/81053)
+- Provide additional information about the alternative plugin in the deprecation message (https://github.com/ansible/ansible/issues/80561).
+- Remove the galaxy_info field ``platforms`` from the role templates (https://github.com/ansible/ansible/issues/82453).
+- Restoring the ability of filters/tests can have same file base name but different tests/filters defined inside.
+- Reword the error message when the module fails to parse parameters in JSON format (https://github.com/ansible/ansible/issues/81188).
+- Reword warning if the reserved keyword _ansible_ used as a module parameter (https://github.com/ansible/ansible/issues/82514).
+- Run all handlers with the same ``listen`` topic, even when notified from another handler (https://github.com/ansible/ansible/issues/82363).
+- Slight optimization to hostvars (instantiate template only once per host, vs per call to var).
+- Stopped misleadingly advertising ``async`` mode support in the ``reboot`` module (https://github.com/ansible/ansible/issues/71517).
+- ``ansible-galaxy role import`` - fix using the ``role_name`` in a standalone role's ``galaxy_info`` metadata by disabling automatic removal of the ``ansible-role-`` prefix. This matches the behavior of the Galaxy UI which also no longer implicitly removes the ``ansible-role-`` prefix. Use the ``--role-name`` option or add a ``role_name`` to the ``galaxy_info`` dictionary in the role's ``meta/main.yml`` to use an alternate role name.
+- ``ansible-test sanity --test runtime-metadata`` - add ``action_plugin`` as a valid field for modules in the schema (https://github.com/ansible/ansible/pull/82562).
+- ``ansible.module_utils.service`` - ensure binary data transmission in ``daemonize()``
+- ``any_errors_fatal`` should fail all hosts and rescue all of them when a ``rescue`` section is specified (https://github.com/ansible/ansible/issues/80981)
+- ``include_role`` - properly execute ``v2_playbook_on_include`` and ``v2_runner_on_failed`` callbacks as well as increase ``ok`` and ``failed`` stats in the play recap, when appropriate (https://github.com/ansible/ansible/issues/77336)
+- allow_duplicates - fix evaluating if the current role allows duplicates instead of using the initial value from the duplicate's cached role.
+- ansible-config init will now dedupe ini entries from plugins.
+- ansible-config will now properly template defaults before dumping them.
+- ansible-doc - fixed "inicates" typo in output
+- ansible-doc - format top-level descriptions with multiple paragraphs as multiple paragraphs, instead of concatenating them (https://github.com/ansible/ansible/pull/83155).
+- ansible-galaxy - Deprecate use of the Galaxy v2 API (https://github.com/ansible/ansible/issues/81781)
+- ansible-galaxy - Provide a better error message when using a requirements file with an invalid format - https://github.com/ansible/ansible/issues/81901
+- ansible-galaxy - Resolve issue with the dataclass used for galaxy.yml manifest caused by using future annotations
+- ansible-galaxy - ensure path to ansible collection when installing or downloading doesn't have a backslash (https://github.com/ansible/ansible/pull/79705).
+- ansible-galaxy - started allowing the use of pre-releases for collections that do not have any stable versions published. (https://github.com/ansible/ansible/pull/81606)
+- ansible-galaxy - started allowing the use of pre-releases for dependencies on any level of the dependency tree that specifically demand exact pre-release versions of collections and not version ranges. (https://github.com/ansible/ansible/pull/81606)
+- ansible-galaxy error on dependency resolution will not error itself due to 'virtual' collections not having a name/namespace.
+- ansible-galaxy info - fix reporting no role found when lookup_role_by_name returns None.
+- ansible-galaxy role import - exit with 1 when the import fails (https://github.com/ansible/ansible/issues/82175).
+- ansible-galaxy role install - fix installing roles from Galaxy that have version ``None`` (https://github.com/ansible/ansible/issues/81832).
+- ansible-galaxy role install - fix symlinks (https://github.com/ansible/ansible/issues/82702, https://github.com/ansible/ansible/issues/81965).
+- ansible-galaxy role install - normalize tarfile paths and symlinks using ``ansible.utils.path.unfrackpath`` and consider them valid as long as the realpath is in the tarfile's role directory (https://github.com/ansible/ansible/issues/81965).
+- ansible-inventory - index available_hosts for major performance boost when dumping large inventories
+- ansible-pull now will expand relative paths for the ``-d|--directory`` option is now expanded before use.
+- ansible-pull will now correctly handle become and connection password file options for ansible-playbook.
+- ansible-test - Add a ``pylint`` plugin to work around a known issue on Python 3.12.
+- ansible-test - Explicitly supply ``ControlPath=none`` when setting up port forwarding over SSH to address the scenario where the local ssh configuration uses ``ControlPath`` for all hosts, and would prevent ports to be forwarded after the initial connection to the host.
+- ansible-test - Fix parsing of cgroup entries which contain a ``:`` in the path (https://github.com/ansible/ansible/issues/81977).
+- ansible-test - Include missing ``pylint`` requirements for Python 3.10.
+- ansible-test - Properly detect docker host when using ``ssh://`` protocol for connecting to the docker daemon.
+- ansible-test - The ``libexpat`` package is automatically upgraded during remote bootstrapping to maintain compatibility with newer Python packages.
+- ansible-test - The ``validate-modules`` sanity test no longer attempts to process files with unrecognized extensions as Python (resolves https://github.com/ansible/ansible/issues/82604).
+- ansible-test - Update ``pylint`` to version 3.0.1.
+- ansible-test ansible-doc sanity test - do not remove underscores from plugin names in collections before calling ``ansible-doc`` (https://github.com/ansible/ansible/pull/82574).
+- ansible-test validate-modules sanity test - do not treat leading underscores for plugin names in collections as an attempted deprecation (https://github.com/ansible/ansible/pull/82575).
+- ansible-test — Python 3.8–3.12 will use ``coverage`` v7.3.2.
+- ansible.builtin.apt - calling clean = true does not properly clean certain cache files such as /var/cache/apt/pkgcache.bin and /var/cache/apt/pkgcache.bin (https://github.com/ansible/ansible/issues/82611)
+- ansible.builtin.uri - the module was ignoring the ``force`` parameter and always requesting a cached copy (via the ``If-Modified-Since`` header) when downloading to an existing local file. Disable caching when ``force`` is ``true``, as documented (https://github.com/ansible/ansible/issues/82166).
+- ansible_managed restored it's 'templatability' by ensuring the possible injection routes are cut off earlier in the process.
+- apt - honor install_recommends and dpkg_options while installing python3-apt library (https://github.com/ansible/ansible/issues/40608).
+- apt - install recommended packages when installing package via deb file (https://github.com/ansible/ansible/issues/29726).
+- apt_repository - do not modify repo files if the file is a symlink (https://github.com/ansible/ansible/issues/49809).
+- apt_repository - update PPA URL to point to https URL (https://github.com/ansible/ansible/issues/82463).
+- assemble - fixed missing parameter 'content' in _get_diff_data API (https://github.com/ansible/ansible/issues/82359).
+- async - Fix bug that stopped running async task in ``--check`` when ``check_mode: False`` was set as a task attribute - https://github.com/ansible/ansible/issues/82811
+- blockinfile - when ``create=true`` is used with a filename without path, the module crashed (https://github.com/ansible/ansible/pull/81638).
+- check if there are attributes to set before attempting to set them (https://github.com/ansible/ansible/issues/76727)
+- copy action now also generates temprary files as hidden ('.' prefixed) to avoid accidental pickup by running services that glob by extension.
+- copy action now ensures that tempfiles use the same suffix as destination, to allow for ``validate`` to work with utilities that check extensions.
+- deb822_repository - handle idempotency if the order of parameters is changed (https://github.com/ansible/ansible/issues/82454).
+- debconf - allow user to specify a list for value when vtype is multiselect (https://github.com/ansible/ansible/issues/81345).
+- delegate_to when set to an empty or undefined variable will now give a proper error.
+- distribution.py - Recognize ALP-Dolomite as part of the SUSE OS family in Ansible, fixing its previous misidentification (https://github.com/ansible/ansible/pull/82496).
+- distro - bump bundled distro version from 1.6.0 to 1.8.0 (https://github.com/ansible/ansible/issues/81713).
+- dnf - fix an issue when cached RPMs were left in the cache directory even when the keepcache setting was unset (https://github.com/ansible/ansible/issues/81954)
+- dnf - fix an issue when installing a package by specifying a file it provides could result in installing a different package providing the same file than the package already installed resulting in resolution failure (https://github.com/ansible/ansible/issues/82461)
+- dnf - properly set gpg check options on enabled repositories according to the ``disable_gpg_check`` option (https://github.com/ansible/ansible/issues/80110)
+- dnf - properly skip unavailable packages when ``skip_broken`` is enabled (https://github.com/ansible/ansible/issues/80590)
+- dnf - the ``nobest`` option only overrides the distribution default when explicitly used, and is used for all supported operations (https://github.com/ansible/ansible/issues/82616)
+- dnf5 - replace removed API calls
+- dnf5 - respect ``allow_downgrade`` when installing packages directly from rpm files
+- dnf5 - the ``nobest`` option only overrides the distribution default when used
+- dwim functions for lookups should be better at detectging role context even in abscense of tasks/main.
+- ensure we have logger before we log when we have increased verbosity.
+- expect - fix argument spec error using timeout=null (https://github.com/ansible/ansible/issues/80982).
+- fact gathering on linux now handles thread count by using rounding vs dropping decimals, it should give slightly more accurate numbers.
+- facts - add a generic detection for VMware in product name.
+- facts - detect VMware ESXi 8.0 virtualization by product name VMware20,1
+- fetch - Do not calculate the file size for Windows fetch targets to improve performance.
+- fetch - add error message when using ``dest`` with a trailing slash that becomes a local directory - https://github.com/ansible/ansible/issues/82878
+- find - do not fail on Permission errors (https://github.com/ansible/ansible/issues/82027).
+- first_found lookup now always returns a full (absolute) and normalized path
+- first_found lookup now always takes into account k=v options
+- flush_handlers - properly handle a handler failure in a nested block when ``force_handlers`` is set (http://github.com/ansible/ansible/issues/81532)
+- galaxy - skip verification for unwanted Python compiled bytecode files (https://github.com/ansible/ansible/issues/81628).
+- handle exception raised while validating with elements='int' and value is not within choices (https://github.com/ansible/ansible/issues/82776).
+- include_tasks - include `ansible_loop_var` and `ansible_index_var` in a loop (https://github.com/ansible/ansible/issues/82655).
+- include_vars - fix calculating ``depth`` relative to the root and ensure all files are included (https://github.com/ansible/ansible/issues/80987).
+- interpreter_discovery - handle AnsibleError exception raised while interpreter discovery (https://github.com/ansible/ansible/issues/78264).
+- iptables - add option choices 'src,src' and 'dst,dst' in match_set_flags (https://github.com/ansible/ansible/issues/81281).
+- iptables - set jump to DSCP when set_dscp_mark or set_dscp_mark_class is set (https://github.com/ansible/ansible/issues/77077).
+- known_hosts - Fix issue with `@cert-authority` entries in known_hosts incorrectly being removed.
+- module no_log will no longer affect top level booleans, for example ``no_log_module_parameter='a'`` will no longer hide ``changed=False`` as a 'no log value' (matches 'a').
+- moved assemble, raw, copy, fetch, reboot, script and wait_for_connection to query task instead of play_context ensuring they get the lastest and most correct data.
+- reboot action now handles connections with 'timeout' vs only 'connection_timeout' settings.
+- role params now have higher precedence than host facts again, matching documentation, this had unintentionally changed in 2.15.
+- roles, code cleanup and performance optimization of dependencies, now cached,  and ``public`` setting is now determined once, at role instantiation.
+- roles, the ``static`` property is now correctly set, this will fix issues with ``public`` and ``DEFAULT_PRIVATE_ROLE_VARS`` controls on exporting vars.
+- set_option method for plugins to update config now properly passes through type casting and validation.
+- ssh - add tests for the SSH connection plugin.
+- support url-encoded credentials in URLs like http://x%40:%40@example.com (https://github.com/ansible/ansible/pull/82552)
+- syslog - Handle ValueError exception raised when sending Null Characters to syslog with Python 3.12.
+- systemd_services - update documentation regarding required_one_of and required_by parameters (https://github.com/ansible/ansible/issues/82914).
+- template - Fix error when templating an unsafe string which corresponds to an invalid type in Python (https://github.com/ansible/ansible/issues/82600).
+- template action will also inherit the behavior from copy (as it uses it internally).
+- templating - ensure syntax errors originating from a template being compiled into Python code object result in a failure (https://github.com/ansible/ansible/issues/82606)
+- unarchive - add support for 8 character permission strings for zip archives (https://github.com/ansible/ansible/pull/81705).
+- unarchive - force unarchive if symlink target changes (https://github.com/ansible/ansible/issues/30420).
+- unarchive modules now uses zipinfo options without relying on implementation defaults, making it more compatible with all OS/distributions.
+- unsafe data - Address an incompatibility when iterating or getting a single index from ``AnsibleUnsafeBytes``
+- unsafe data - Address an incompatibility with ``AnsibleUnsafeText`` and ``AnsibleUnsafeBytes`` when pickling with ``protocol=0``
+- unsafe data - Enable directly using ``AnsibleUnsafeText`` with Python ``pathlib`` (https://github.com/ansible/ansible/issues/82414)
+- uri - update the documentation for follow_redirects.
+- uri action plugin now skipped during check mode (not supported) instead of even trying to execute the module, which already skipped, this does not really change the result, but returns much faster.
+- vars - handle exception while combining VarsWithSources and dict (https://github.com/ansible/ansible/issues/81659).
+- wait_for should not handle 'non mmapable files' again.
+- winrm - Better handle send input failures when communicating with hosts under load
+- winrm - Do not raise another exception during cleanup when a task is timed out - https://github.com/ansible/ansible/issues/81095
+- winrm - does not hang when attempting to get process output when stdin write failed
--- a/changelogs/changelog.yaml
+++ b/changelogs/changelog.yaml
@ -1,2 +1,887 @@
 ancestor: 2.16.0
-releases: {}
+releases:
+  2.17.0:
+    changes:
+      release_summary: '| Release Date: 2024-05-20
+
+        | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
+
+        '
+    codename: Gallows Pole
+    fragments:
+    - 2.17.0_summary.yaml
+    release_date: '2024-05-20'
+  2.17.0b1:
+    changes:
+      breaking_changes:
+      - assert - Nested templating may result in an inability for the conditional
+        to be evaluated. See the porting guide for more information.
+      bugfixes:
+      - All core lookups now use set_option(s) even when doing their own custom parsing.
+        This ensures that the options are always the proper type.
+      - Allow for searching handler subdir for included task via include_role (https://github.com/ansible/ansible/issues/81722)
+      - AnsibleModule.atomic_move - fix preserving extended ACLs of the destination
+        when it exists (https://github.com/ansible/ansible/issues/72929).
+      - Cache host_group_vars after instantiating it once and limit the amount of
+        repetitive work it needs to do every time it runs.
+      - Call PluginLoader.all() once for vars plugins, and load vars plugins that
+        run automatically or are enabled specifically by name subsequently.
+      - Consolidate systemd detection logic into one place (https://github.com/ansible/ansible/issues/80975).
+      - Consolidated the list of internal static vars, centralized them as constant
+        and completed from some missing entries.
+      - Do not print undefined error message twice (https://github.com/ansible/ansible/issues/78703).
+      - Enable file cache for vaulted files during vars lookup to fix a strong performance
+        penalty in huge and complex playbboks.
+      - Fix NEVRA parsing of package names that include digit(s) in them (https://github.com/ansible/ansible/issues/76463,
+        https://github.com/ansible/ansible/issues/81018)
+      - Fix ``force_handlers`` not working with ``any_errors_fatal`` (https://github.com/ansible/ansible/issues/36308)
+      - Fix ``run_once`` being incorrectly interpreted on handlers (https://github.com/ansible/ansible/issues/81666)
+      - 'Fix an issue when setting a plugin name from an unsafe source resulted in
+        ``ValueError: unmarshallable object`` (https://github.com/ansible/ansible/issues/82708)'
+      - Fix check for missing _sub_plugin attribute in older connection plugins (https://github.com/ansible/ansible/pull/82954)
+      - Fix condition for unquoting configuration strings from ini files (https://github.com/ansible/ansible/issues/82387).
+      - Fix for when ``any_errors_fatal`` was ignored if error occurred in a block
+        with always (https://github.com/ansible/ansible/issues/31543)
+      - Fix handling missing urls in ansible.module_utils.urls.fetch_file for Python
+        3.
+      - Fix issue where an ``include_tasks`` handler in a role was not able to locate
+        a file in ``tasks/`` when ``tasks_from`` was used as a role entry point and
+        ``main.yml`` was not present (https://github.com/ansible/ansible/issues/82241)
+      - Fix issues when tasks withing nested blocks wouldn't run when ``force_handlers``
+        is set (https://github.com/ansible/ansible/issues/81533)
+      - Fix loading vars_plugins in roles (https://github.com/ansible/ansible/issues/82239).
+      - 'Fix notifying role handlers by listen keyword topics with the "role_name
+        : " prefix (https://github.com/ansible/ansible/issues/82849).'
+      - Fix setting proper locale for git executable when running on non english systems,
+        ensuring git output can always be parsed.
+      - Fix tasks in always section not being executed for nested blocks with ``any_errors_fatal``
+        (https://github.com/ansible/ansible/issues/73246)
+      - Fixes permission for cache json file from 600 to 644 (https://github.com/ansible/ansible/issues/82683).
+      - Give the tombstone error for ``include`` pre-fork like other tombstoned action/module
+        plugins.
+      - Harden python templates for respawn and ansiballz around str literal quoting
+      - Include the task location when a module or action plugin is deprecated (https://github.com/ansible/ansible/issues/82450).
+      - Interpreter discovery - Add ``Amzn`` to ``OS_FAMILY_MAP`` for correct family
+        fallback for interpreter discovery (https://github.com/ansible/ansible/issues/80882).
+      - Mirror the behavior of dnf on the command line when handling NEVRAs with omitted
+        epoch (https://github.com/ansible/ansible/issues/71808)
+      - Plugin loader does not dedupe nor cache filter/test plugins by file basename,
+        but full path name.
+      - Properly template tags in parent blocks (https://github.com/ansible/ansible/issues/81053)
+      - Provide additional information about the alternative plugin in the deprecation
+        message (https://github.com/ansible/ansible/issues/80561).
+      - Remove the galaxy_info field ``platforms`` from the role templates (https://github.com/ansible/ansible/issues/82453).
+      - Restoring the ability of filters/tests can have same file base name but different
+        tests/filters defined inside.
+      - Reword the error message when the module fails to parse parameters in JSON
+        format (https://github.com/ansible/ansible/issues/81188).
+      - Reword warning if the reserved keyword _ansible_ used as a module parameter
+        (https://github.com/ansible/ansible/issues/82514).
+      - Run all handlers with the same ``listen`` topic, even when notified from another
+        handler (https://github.com/ansible/ansible/issues/82363).
+      - Slight optimization to hostvars (instantiate template only once per host,
+        vs per call to var).
+      - Stopped misleadingly advertising ``async`` mode support in the ``reboot``
+        module (https://github.com/ansible/ansible/issues/71517).
+      - '``ansible-galaxy role import`` - fix using the ``role_name`` in a standalone
+        role''s ``galaxy_info`` metadata by disabling automatic removal of the ``ansible-role-``
+        prefix. This matches the behavior of the Galaxy UI which also no longer implicitly
+        removes the ``ansible-role-`` prefix. Use the ``--role-name`` option or add
+        a ``role_name`` to the ``galaxy_info`` dictionary in the role''s ``meta/main.yml``
+        to use an alternate role name.'
+      - '``ansible-test sanity --test runtime-metadata`` - add ``action_plugin`` as
+        a valid field for modules in the schema (https://github.com/ansible/ansible/pull/82562).'
+      - '``ansible.module_utils.service`` - ensure binary data transmission in ``daemonize()``'
+      - '``any_errors_fatal`` should fail all hosts and rescue all of them when a
+        ``rescue`` section is specified (https://github.com/ansible/ansible/issues/80981)'
+      - '``include_role`` - properly execute ``v2_playbook_on_include`` and ``v2_runner_on_failed``
+        callbacks as well as increase ``ok`` and ``failed`` stats in the play recap,
+        when appropriate (https://github.com/ansible/ansible/issues/77336)'
+      - allow_duplicates - fix evaluating if the current role allows duplicates instead
+        of using the initial value from the duplicate's cached role.
+      - ansible-config init will now dedupe ini entries from plugins.
+      - ansible-galaxy - Deprecate use of the Galaxy v2 API (https://github.com/ansible/ansible/issues/81781)
+      - ansible-galaxy - Provide a better error message when using a requirements
+        file with an invalid format - https://github.com/ansible/ansible/issues/81901
+      - ansible-galaxy - Resolve issue with the dataclass used for galaxy.yml manifest
+        caused by using future annotations
+      - ansible-galaxy - ensure path to ansible collection when installing or downloading
+        doesn't have a backslash (https://github.com/ansible/ansible/pull/79705).
+      - ansible-galaxy - started allowing the use of pre-releases for collections
+        that do not have any stable versions published. (https://github.com/ansible/ansible/pull/81606)
+      - ansible-galaxy - started allowing the use of pre-releases for dependencies
+        on any level of the dependency tree that specifically demand exact pre-release
+        versions of collections and not version ranges. (https://github.com/ansible/ansible/pull/81606)
+      - ansible-galaxy error on dependency resolution will not error itself due to
+        'virtual' collections not having a name/namespace.
+      - ansible-galaxy info - fix reporting no role found when lookup_role_by_name
+        returns None.
+      - ansible-galaxy role import - exit with 1 when the import fails (https://github.com/ansible/ansible/issues/82175).
+      - ansible-galaxy role install - fix installing roles from Galaxy that have version
+        ``None`` (https://github.com/ansible/ansible/issues/81832).
+      - ansible-galaxy role install - fix symlinks (https://github.com/ansible/ansible/issues/82702,
+        https://github.com/ansible/ansible/issues/81965).
+      - ansible-galaxy role install - normalize tarfile paths and symlinks using ``ansible.utils.path.unfrackpath``
+        and consider them valid as long as the realpath is in the tarfile's role directory
+        (https://github.com/ansible/ansible/issues/81965).
+      - ansible-inventory - index available_hosts for major performance boost when
+        dumping large inventories
+      - ansible-pull now will expand relative paths for the ``-d|--directory`` option
+        is now expanded before use.
+      - ansible-pull will now correctly handle become and connection password file
+        options for ansible-playbook.
+      - ansible-test - Add a ``pylint`` plugin to work around a known issue on Python
+        3.12.
+      - ansible-test - Explicitly supply ``ControlPath=none`` when setting up port
+        forwarding over SSH to address the scenario where the local ssh configuration
+        uses ``ControlPath`` for all hosts, and would prevent ports to be forwarded
+        after the initial connection to the host.
+      - ansible-test - Fix parsing of cgroup entries which contain a ``:`` in the
+        path (https://github.com/ansible/ansible/issues/81977).
+      - ansible-test - Include missing ``pylint`` requirements for Python 3.10.
+      - ansible-test - Properly detect docker host when using ``ssh://`` protocol
+        for connecting to the docker daemon.
+      - ansible-test - The ``libexpat`` package is automatically upgraded during remote
+        bootstrapping to maintain compatibility with newer Python packages.
+      - ansible-test - The ``validate-modules`` sanity test no longer attempts to
+        process files with unrecognized extensions as Python (resolves https://github.com/ansible/ansible/issues/82604).
+      - ansible-test - Update ``pylint`` to version 3.0.1.
+      - ansible-test ansible-doc sanity test - do not remove underscores from plugin
+        names in collections before calling ``ansible-doc`` (https://github.com/ansible/ansible/pull/82574).
+      - ansible-test validate-modules sanity test - do not treat leading underscores
+        for plugin names in collections as an attempted deprecation (https://github.com/ansible/ansible/pull/82575).
+      - "ansible-test \u2014 Python 3.8\u20133.12 will use ``coverage`` v7.3.2."
+      - ansible.builtin.apt - calling clean = true does not properly clean certain
+        cache files such as /var/cache/apt/pkgcache.bin and /var/cache/apt/pkgcache.bin
+        (https://github.com/ansible/ansible/issues/82611)
+      - ansible.builtin.uri - the module was ignoring the ``force`` parameter and
+        always requesting a cached copy (via the ``If-Modified-Since`` header) when
+        downloading to an existing local file. Disable caching when ``force`` is ``true``,
+        as documented (https://github.com/ansible/ansible/issues/82166).
+      - apt - honor install_recommends and dpkg_options while installing python3-apt
+        library (https://github.com/ansible/ansible/issues/40608).
+      - apt - install recommended packages when installing package via deb file (https://github.com/ansible/ansible/issues/29726).
+      - apt_repository - do not modify repo files if the file is a symlink (https://github.com/ansible/ansible/issues/49809).
+      - apt_repository - update PPA URL to point to https URL (https://github.com/ansible/ansible/issues/82463).
+      - assemble - fixed missing parameter 'content' in _get_diff_data API (https://github.com/ansible/ansible/issues/82359).
+      - 'async - Fix bug that stopped running async task in ``--check`` when ``check_mode:
+        False`` was set as a task attribute - https://github.com/ansible/ansible/issues/82811'
+      - blockinfile - when ``create=true`` is used with a filename without path, the
+        module crashed (https://github.com/ansible/ansible/pull/81638).
+      - check if there are attributes to set before attempting to set them (https://github.com/ansible/ansible/issues/76727)
+      - copy action now also generates temprary files as hidden ('.' prefixed) to
+        avoid accidental pickup by running services that glob by extension.
+      - copy action now ensures that tempfiles use the same suffix as destination,
+        to allow for ``validate`` to work with utilities that check extensions.
+      - deb822_repository - handle idempotency if the order of parameters is changed
+        (https://github.com/ansible/ansible/issues/82454).
+      - debconf - allow user to specify a list for value when vtype is multiselect
+        (https://github.com/ansible/ansible/issues/81345).
+      - delegate_to when set to an empty or undefined variable will now give a proper
+        error.
+      - distribution.py - Recognize ALP-Dolomite as part of the SUSE OS family in
+        Ansible, fixing its previous misidentification (https://github.com/ansible/ansible/pull/82496).
+      - distro - bump bundled distro version from 1.6.0 to 1.8.0 (https://github.com/ansible/ansible/issues/81713).
+      - dnf - fix an issue when cached RPMs were left in the cache directory even
+        when the keepcache setting was unset (https://github.com/ansible/ansible/issues/81954)
+      - dnf - fix an issue when installing a package by specifying a file it provides
+        could result in installing a different package providing the same file than
+        the package already installed resulting in resolution failure (https://github.com/ansible/ansible/issues/82461)
+      - dnf - properly set gpg check options on enabled repositories according to
+        the ``disable_gpg_check`` option (https://github.com/ansible/ansible/issues/80110)
+      - dnf - properly skip unavailable packages when ``skip_broken`` is enabled (https://github.com/ansible/ansible/issues/80590)
+      - dnf - the ``nobest`` option only overrides the distribution default when explicitly
+        used, and is used for all supported operations (https://github.com/ansible/ansible/issues/82616)
+      - dnf5 - respect ``allow_downgrade`` when installing packages directly from
+        rpm files
+      - dnf5 - the ``nobest`` option only overrides the distribution default when
+        used
+      - dwim functions for lookups should be better at detectging role context even
+        in abscense of tasks/main.
+      - expect - fix argument spec error using timeout=null (https://github.com/ansible/ansible/issues/80982).
+      - fact gathering on linux now handles thread count by using rounding vs dropping
+        decimals, it should give slightly more accurate numbers.
+      - facts - detect VMware ESXi 8.0 virtualization by product name VMware20,1
+      - fetch - Do not calculate the file size for Windows fetch targets to improve
+        performance.
+      - fetch - add error message when using ``dest`` with a trailing slash that becomes
+        a local directory - https://github.com/ansible/ansible/issues/82878
+      - find - do not fail on Permission errors (https://github.com/ansible/ansible/issues/82027).
+      - first_found lookup now always returns a full (absolute) and normalized path
+      - first_found lookup now always takes into account k=v options
+      - flush_handlers - properly handle a handler failure in a nested block when
+        ``force_handlers`` is set (http://github.com/ansible/ansible/issues/81532)
+      - galaxy - skip verification for unwanted Python compiled bytecode files (https://github.com/ansible/ansible/issues/81628).
+      - handle exception raised while validating with elements='int' and value is
+        not within choices (https://github.com/ansible/ansible/issues/82776).
+      - include_tasks - include `ansible_loop_var` and `ansible_index_var` in a loop
+        (https://github.com/ansible/ansible/issues/82655).
+      - include_vars - fix calculating ``depth`` relative to the root and ensure all
+        files are included (https://github.com/ansible/ansible/issues/80987).
+      - interpreter_discovery - handle AnsibleError exception raised while interpreter
+        discovery (https://github.com/ansible/ansible/issues/78264).
+      - iptables - add option choices 'src,src' and 'dst,dst' in match_set_flags (https://github.com/ansible/ansible/issues/81281).
+      - iptables - set jump to DSCP when set_dscp_mark or set_dscp_mark_class is set
+        (https://github.com/ansible/ansible/issues/77077).
+      - known_hosts - Fix issue with `@cert-authority` entries in known_hosts incorrectly
+        being removed.
+      - module no_log will no longer affect top level booleans, for example ``no_log_module_parameter='a'``
+        will no longer hide ``changed=False`` as a 'no log value' (matches 'a').
+      - moved assemble, raw, copy, fetch, reboot, script and wait_for_connection to
+        query task instead of play_context ensuring they get the lastest and most
+        correct data.
+      - reboot action now handles connections with 'timeout' vs only 'connection_timeout'
+        settings.
+      - role params now have higher precedence than host facts again, matching documentation,
+        this had unintentionally changed in 2.15.
+      - roles, code cleanup and performance optimization of dependencies, now cached,  and
+        ``public`` setting is now determined once, at role instantiation.
+      - roles, the ``static`` property is now correctly set, this will fix issues
+        with ``public`` and ``DEFAULT_PRIVATE_ROLE_VARS`` controls on exporting vars.
+      - set_option method for plugins to update config now properly passes through
+        type casting and validation.
+      - ssh - add tests for the SSH connection plugin.
+      - support url-encoded credentials in URLs like http://x%40:%40@example.com (https://github.com/ansible/ansible/pull/82552)
+      - syslog - Handle ValueError exception raised when sending Null Characters to
+        syslog with Python 3.12.
+      - systemd_services - update documentation regarding required_one_of and required_by
+        parameters (https://github.com/ansible/ansible/issues/82914).
+      - template - Fix error when templating an unsafe string which corresponds to
+        an invalid type in Python (https://github.com/ansible/ansible/issues/82600).
+      - template action will also inherit the behavior from copy (as it uses it internally).
+      - templating - ensure syntax errors originating from a template being compiled
+        into Python code object result in a failure (https://github.com/ansible/ansible/issues/82606)
+      - unarchive - add support for 8 character permission strings for zip archives
+        (https://github.com/ansible/ansible/pull/81705).
+      - unarchive - force unarchive if symlink target changes (https://github.com/ansible/ansible/issues/30420).
+      - unarchive modules now uses zipinfo options without relying on implementation
+        defaults, making it more compatible with all OS/distributions.
+      - unsafe data - Address an incompatibility when iterating or getting a single
+        index from ``AnsibleUnsafeBytes``
+      - unsafe data - Address an incompatibility with ``AnsibleUnsafeText`` and ``AnsibleUnsafeBytes``
+        when pickling with ``protocol=0``
+      - unsafe data - Enable directly using ``AnsibleUnsafeText`` with Python ``pathlib``
+        (https://github.com/ansible/ansible/issues/82414)
+      - uri action plugin now skipped during check mode (not supported) instead of
+        even trying to execute the module, which already skipped, this does not really
+        change the result, but returns much faster.
+      - vars - handle exception while combining VarsWithSources and dict (https://github.com/ansible/ansible/issues/81659).
+      - wait_for should not handle 'non mmapable files' again.
+      - winrm - Better handle send input failures when communicating with hosts under
+        load
+      - winrm - Do not raise another exception during cleanup when a task is timed
+        out - https://github.com/ansible/ansible/issues/81095
+      - winrm - does not hang when attempting to get process output when stdin write
+        failed
+      deprecated_features:
+      - Old style vars plugins which use the entrypoints `get_host_vars` or `get_group_vars`
+        are deprecated. The plugin should be updated to inherit from `BaseVarsPlugin`
+        and define a `get_vars` method as the entrypoint.
+      - The 'required' parameter in 'ansible.module_utils.common.process.get_bin_path'
+        API is deprecated (https://github.com/ansible/ansible/issues/82464).
+      - '``module_utils`` - importing the following convenience helpers from ``ansible.module_utils.basic``
+        has been deprecated: ``get_exception``, ``literal_eval``, ``_literal_eval``,
+        ``datetime``, ``signal``, ``types``, ``chain``, ``repeat``, ``PY2``, ``PY3``,
+        ``b``, ``binary_type``, ``integer_types``, ``iteritems``, ``string_types``,
+        ``test_type``, ``map`` and ``shlex_quote``.'
+      - ansible-doc - role entrypoint attributes are deprecated and eventually will
+        no longer be shown in ansible-doc from ansible-core 2.20 on (https://github.com/ansible/ansible/issues/82639,
+        https://github.com/ansible/ansible/pull/82678).
+      - paramiko connection plugin, configuration items in the global scope are being
+        deprecated and will be removed in favor or the existing same options in the
+        plugin itself. Users should not need to change anything (how to configure
+        them are the same) but plugin authors using the global constants should move
+        to using the plugin's get_option().
+      major_changes:
+      - urls.py - Removed support for Python 2
+      minor_changes:
+      - Add ``dump`` and ``passno`` mount information to facts component (https://github.com/ansible/ansible/issues/80478)
+      - Added MIRACLE LINUX 9.2 in RedHat OS Family.
+      - Interpreter Discovery - Remove hardcoded references to specific python interpreters
+        to use for certain distro versions, and modify logic for python3 to become
+        the default.
+      - Use Python's built-in ``functools.update_wrapper`` instead an inline copy
+        from Python 3.7.
+      - User can now set ansible.log to record higher verbosity than what is specified
+        for display via new configuration item LOG_VERBOSITY.
+      - '``DEFAULT_PRIVATE_ROLE_VARS`` is now overridden by explicit setting of ``public``
+        for ``include_roles`` and ``import_roles``.'
+      - '``ansible-galaxy role|collection init`` - accept ``--extra-vars`` to supplement/override
+        the variables ``ansible-galaxy`` injects for templating ``.j2`` files in the
+        skeleton.'
+      - '``import_role`` action now also gets a ``public`` option that controls variable
+        exports,  default depending on ``DEFAULT_PRIVATE_ROLE_VARS`` (if using defaults
+        equates to ``public=True``).'
+      - added configuration item ``TARGET_LOG_INFO`` that allows the user/author to
+        add an information string to the log output on targets.
+      - ansible-doc - treat double newlines in documentation strings as paragraph
+        breaks. This is useful to create multi-paragraph notes in module/plugin documentation
+        (https://github.com/ansible/ansible/pull/82465).
+      - ansible-doc output has been revamped to make it more visually pleasing when
+        going to a terminal, also more concise, use -v to show extra information.
+      - ansible-galaxy - Started normalizing build directory with a trailing separator
+        when building collections, internally. (https://github.com/ansible/ansible/pull/81619).
+      - ansible-galaxy dependency resolution messages have changed the unexplained
+        'virtual' collection for the specific type ('scm', 'dir', etc) that is more
+        user friendly
+      - ansible-test - Add Alpine 3.19 container.
+      - ansible-test - Add Alpine 3.19 to remotes.
+      - ansible-test - Add Fedora 39 container.
+      - ansible-test - Add Fedora 39 remote.
+      - ansible-test - Add a work-around for permission denied errors when using ``pytest
+        >= 8`` on multi-user systems with an installed version of ``ansible-test``.
+      - ansible-test - Add support for RHEL 9.3 remotes.
+      - ansible-test - Added a macOS 14.3 remote VM.
+      - ansible-test - Bump the ``nios-test-container`` from version 2.0.0 to version
+        3.0.0.
+      - ansible-test - Containers and remotes managed by ansible-test will have their
+        Python ``EXTERNALLY-MANAGED`` marker (PEP668) removed. This provides backwards
+        compatibility for existing tests running in newer environments which mark
+        their Python as externally managed. A future version of ansible-test may change
+        this behavior, requiring tests to be adapted to such environments.
+      - ansible-test - Make Python 3.12 the default version used in the ``base`` and
+        ``default`` containers.
+      - ansible-test - Remove Alpine 3(.18) container.
+      - ansible-test - Remove Alpine 3.18 from remotes.
+      - ansible-test - Remove Fedora 38 remote support.
+      - ansible-test - Remove Fedora 38 test container.
+      - ansible-test - Remove rhel/9.2 test remote
+      - ansible-test - Remove the FreeBSD 13.2 remote.
+      - ansible-test - Removed fallback to ``virtualenv`` when ``-m venv`` is non-functional.
+      - 'ansible-test - Removed test remotes: macos/13.2'
+      - ansible-test - Removed the ``no-basestring`` sanity test. The test is no longer
+        necessary now that Python 3 is required.
+      - ansible-test - Removed the ``no-dict-iteritems``, ``no-dict-iterkeys`` and
+        ``no-dict-itervalues`` sanity tests. The tests are no longer necessary since
+        Python 3 is required.
+      - ansible-test - Removed the ``no-main-display`` sanity test. The unwanted pattern
+        is unlikely to occur, since the test has existed since Ansible 2.8.
+      - ansible-test - Removed the ``no-unicode-literals`` sanity test. The test is
+        unnecessary now that Python 3 is required and the ``unicode_literals`` feature
+        has no effect.
+      - ansible-test - Special handling for installation of ``cryptography`` has been
+        removed, as it is no longer necessary.
+      - ansible-test - The ``shellcheck`` sanity test no longer disables the ``SC2164``
+        check. In most cases, seeing this error means the script is missing ``set
+        -e``.
+      - ansible-test - The ``unidiomatic-typecheck`` rule has been enabled in the
+        ``pylint`` sanity test.
+      - ansible-test - The ``unidiomatic-typecheck`` rule has been removed from the
+        ``validate-modules`` sanity test.
+      - ansible-test - Update the base and default containers to use Ubuntu 22.04
+        for the base image. This also updates PowerShell to version 7.4.0 with .NET
+        8.0.0 and ShellCheck to version 0.8.0.
+      - ansible-test - Updated the CloudStack test container to version 1.7.0.
+      - ansible-test - Updated the distro test containers to version 6.3.0 to include
+        coverage 7.3.2 for Python 3.8+. The alpine3 container is now based on 3.18
+        instead of 3.17 and includes Python 3.11 instead of Python 3.10.
+      - ansible-test - Updated the distro test containers to version 7.1.0.
+      - ansible-test - When ansible-test installs requirements, it now instructs pip
+        to allow installs on externally managed environments as defined by PEP 668.
+        This only occurs in ephemeral environments managed by ansible-test, such as
+        containers, or when the `--requirements` option is used.
+      - ansible-test - When invoking ``sleep`` in containers during container setup,
+        the ``env`` command is used to avoid invoking the shell builtin, if present.
+      - ansible-test - document block name now included in error message for YAML
+        parsing errors (https://github.com/ansible/ansible/issues/82353).
+      - ansible-test - sanity test allows ``EXAMPLES`` to be multi-document YAML (https://github.com/ansible/ansible/issues/82353).
+      - ansible-test now has FreeBSD 13.3 and 14.0 support
+      - ansible.builtin.user - Remove user not found warning (https://github.com/ansible/ansible/issues/80267)
+      - apt_repository.py - use api.launchpad.net endpoint instead of launchpad.net/api
+      - async tasks can now also support check mode at the same time.
+      - async_status now supports check mode.
+      - constructed inventory plugin - Adding a note that only group_vars of explicit
+        groups are loaded (https://github.com/ansible/ansible/pull/82580).
+      - csvfile - add a keycol parameter to specify in which column to search.
+      - dnf - add the ``best`` option
+      - dnf5 - add the ``best`` option
+      - filter plugin - Add the count and mandatory_count parameters in the regex_replace
+        filter
+      - find - add a encoding parameter to specify which encoding of the files to
+        be searched.
+      - git module - gpg_allowlist name was added in 2.17 and we will eventually deprecate
+        the gpg_whitelist alias.
+      - import_role - allow subdirectories with ``_from`` options for parity with
+        ``include_role`` (https://github.com/ansible/ansible/issues/82584).
+      - module argument spec - Allow module authors to include arbitrary additional
+        context in the argument spec, by making use of a new top level key called
+        ``context``. This key should be a dict type. This allows for users to customize
+        what they place in the argument spec, without having to ignore sanity tests
+        that validate the schema.
+      - modules - Add the ability for an action plugin to call ``self._execute_module(*,
+        ignore_unknown_opts=True)`` to execute a module with options that may not
+        be supported for the version being called. This tells the module basic wrapper
+        to ignore validating the options provided match the arg spec.
+      - package action now has a configuration that overrides the detected package
+        manager, it is still overridden itself by the use option.
+      - py3compat - Remove ``ansible.utils.py3compat`` as it is no longer necessary
+      - removed the unused argument ``create_new_password`` from ``CLI.build_vault_ids``
+        (https://github.com/ansible/ansible/pull/82066).
+      - urls - Add support for TLS 1.3 post handshake certificate authentication -
+        https://github.com/ansible/ansible/issues/81782
+      - urls - reduce complexity of ``Request.open``
+      - user - accept yescrypt hash as user password
+      - validate-modules tests now correctly handles ``choices`` in dictionary format.
+      release_summary: '| Release Date: 2024-04-08
+
+        | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
+
+        '
+      removed_features:
+      - Remove deprecated APIs from ansible-docs (https://github.com/ansible/ansible/issues/81716).
+      - Remove deprecated JINJA2_NATIVE_WARNING environment variable (https://github.com/ansible/ansible/issues/81714)
+      - Remove deprecated ``scp_if_ssh`` from ssh connection plugin (https://github.com/ansible/ansible/issues/81715).
+      - Remove deprecated crypt support from ansible.utils.encrypt (https://github.com/ansible/ansible/issues/81717)
+      - With the removal of Python 2 support, the yum module and yum action plugin
+        are removed and redirected to ``dnf``.
+      security_fixes:
+      - ANSIBLE_NO_LOG - Address issue where ANSIBLE_NO_LOG was ignored (CVE-2024-0690)
+      - ansible-galaxy - Prevent roles from using symlinks to overwrite files outside
+        of the installation directory (CVE-2023-5115)
+      - templating - Address issues where internal templating can cause unsafe variables
+        to lose their unsafe designation (CVE-2023-5764)
+    codename: Gallows Pole
+    fragments:
+    - 2.17.0b1_summary.yaml
+    - 49809_apt_repository.yml
+    - 76727-chattr-fix-for-backups-of-symlinks.yml
+    - 77077_iptables.yml
+    - 77336-include_role-callbacks-stats.yml
+    - 78703_undefined.yml
+    - 79705-fix-ensure-path-to-collection-argument-doesnt-have-backslash.yml
+    - 79945-host_group_vars-improvements.yml
+    - 80110-repos-gpgcheck.yml
+    - 80267-ansible_builtin_user-remove-user-not-found-warning.yml
+    - 80478-extend-mount-info.yml
+    - 80561.yml
+    - 80590-dnf-skip_broken-unavailable-pkgs.yml
+    - 80882-Amazon-os-family-compat.yaml
+    - 80975-systemd-detect.yml
+    - 80995-include-all-var-files.yml
+    - 81053-templated-tags-inheritance.yml
+    - 81188_better_error.yml
+    - 81532-fix-nested-flush_handlers.yml
+    - 81584-daemonize-follow-up-fixes.yml
+    - 81606-ansible-galaxy-collection-pre-releases.yml
+    - 81628_galaxy_verify.yml
+    - 81638-blockinfile.yml
+    - 81659_varswithsources.yml
+    - 81666-handlers-run_once.yml
+    - 81699-zip-permission.yml
+    - 81713-distro.yml
+    - 81714-remove-deprecated-jinja2_native_warning.yml
+    - 81716-ansible-doc.yml
+    - 81717-remove-deprecated-crypt-support.yml
+    - 81722-handler-subdir-include_tasks.yml
+    - 81732-cloudstack-test-container-1.7.0.yml
+    - 81775-add-regex_replace-parameters.yml
+    - 81901-galaxy-requirements-format.yml
+    - 81931-locale-related-parsing-error-git.yml
+    - 81954-dnf-keepcache.yml
+    - 81978-launchpad-api-endpoint.yml
+    - 81995-enable_file_cache.yml
+    - 82027_find.yml
+    - 82066.yml
+    - 82175-fix-ansible-galaxy-role-import-rc.yml
+    - 82187-uri-handle-force.yml
+    - 82241-handler-include-tasks-from.yml
+    - 82353-ansible-sanity-examples.yml
+    - 82359_assemble_diff.yml
+    - 82363-multiple-handlers-with-recursive-notification.yml
+    - 82377-git-gpg-whitelist-allowlist.yml
+    - 82387-unquote-strings-from-ini-files.yml
+    - 82455-new-vmware-productname.yml
+    - 82461-dnf-provides.yml
+    - 82465-ansible-doc-paragraphs.yml
+    - 82496-add-alp-dolomite-suse-family.yaml
+    - 82574-ansible-test-ansible-doc-underscore.yml
+    - 82575-ansible-test-validate-modules-underscore.yml
+    - 82580_constructed.yml
+    - 82606-template-python-syntax-error.yml
+    - 82611_fix_alignment_apt_clean_with_ansible_apt_clean.yml
+    - 82616-dnf-best-nobest.yml
+    - 82655-fix-ansible-loop-index-var-in-includedtasks.yml
+    - 82675-fix-unsafe-templating-leading-to-type-error.yml
+    - 82678-role-entrypoint-attributes.yml
+    - 82683-ansible-fact_cache-permissions-changed-after-ansible-coreupdate.yml
+    - 82708-unsafe-plugin-name-error.yml
+    - 82878-fetch-dest-is-dir.yml
+    - 82954-fix-older-connection-plugins.yml
+    - a-g-install-version-None.yml
+    - ansible-galaxy-init-extra-vars.yml
+    - ansible-galaxy-role-install-symlink.yml
+    - ansible-test-added-fedora-39.yml
+    - ansible-test-added-macos-14.3.yml
+    - ansible-test-alpine-libexpat.yml
+    - ansible-test-cgroup-split.yml
+    - ansible-test-container-sleep.yml
+    - ansible-test-coverage-update.yml
+    - ansible-test-cryptography.yml
+    - ansible-test-default-containers.yml
+    - ansible-test-distro-containers.yml
+    - ansible-test-docker-forwards.yml
+    - ansible-test-externally-managed-python.yml
+    - ansible-test-nios-container.yml
+    - ansible-test-pep-668.yml
+    - ansible-test-pylint-update.yml
+    - ansible-test-pytest-8.yml
+    - ansible-test-python-3.12-compat.yml
+    - ansible-test-python-default.yml
+    - ansible-test-remove-freebsd-13.2.yml
+    - ansible-test-remove-rhel-9_2-remote.yml
+    - ansible-test-rhel-9.3.yml
+    - ansible-test-rmv-fedora-38.yml
+    - ansible-test-sanity-no-basestring.yml
+    - ansible-test-sanity-no-dict.yml
+    - ansible-test-sanity-no-main-display.yml
+    - ansible-test-sanity-unicode-literals.yml
+    - ansible-test-shellcheck-exclude.yml
+    - ansible-test-unidiomatic-type-check.yml
+    - ansible-test-validate-modules-non-python.yml
+    - ansible-test-venv.yml
+    - ansible_test_alpine_3.19.yml
+    - ansible_test_fbsd_add.yml
+    - ansible_test_rmv_alpine_318.yml
+    - ansible_test_rmv_macos_132.yml
+    - any_errors_fatal-fixes.yml
+    - apt_install.yml
+    - apt_recommends.yml
+    - argument-spec-context.yml
+    - async-task-check-mode.yml
+    - async_status_check_mode.yml
+    - atomic-move-fix-extended-attrs.yml
+    - check_arguments.yml
+    - clear-distro-interp-map.yml
+    - config_set_option_fix.yml
+    - config_validate_updates.yml
+    - copy_keep_suffix_temp.yml
+    - csvfile-keycol.yml
+    - cve-2023-5115.yml
+    - cve-2023-5764.yml
+    - cve-2024-0690.yml
+    - deb822_repo_idem.yml
+    - debconf_multiselect.yml
+    - dedupe_config_init.yml
+    - delegate_to_invalid.yml
+    - deprecate-v2-galaxy-api.yml
+    - distlib-dataclass-annotation.yml
+    - dnf-installed-checks-api.yml
+    - dnf5-from-rpm-allow_downgrade.yml
+    - dwim_is_role_fix.yml
+    - find-encoding.yml
+    - first_found_fixes.yml
+    - fix-allow-duplicates.yml
+    - fix-ansible-galaxy-info-no-role-found.yml
+    - fix-build-files-manifest-walk.yml
+    - fix-default-ansible-galaxy-role-import-name.yml
+    - fix-dnf-install-missing-url.yml
+    - fix-expect-indefinite-timeout.yml
+    - fix-import_role-_from-options.yml
+    - fix-reboot-plugin.yml
+    - fix-role-name-handler-prefix-listen.yml
+    - fix-runtime-metadata-modules-action_plugin.yml
+    - fix-vars-plugins-in-roles.yml
+    - functools-update-wrapper.yml
+    - galaxy_dep_res_msgs.yml
+    - get_bin_path_required_parameter.yml
+    - import_role_goes_public.yml
+    - improve-tombstone-error.yml
+    - internal_static_vars.yml
+    - interpreter_discovery.yml
+    - inv_available_hosts_to_frozenset.yml
+    - iptables_match_set_flag.yml
+    - j2_load_fix.yml
+    - known_hosts_cert-authority_keys.yml
+    - log_id.yml
+    - log_verbosity.yml
+    - lookups_updated.yml
+    - miracle_linux_distribution_support.yml
+    - mod_args.yml
+    - module-ignore-unknown-options.yml
+    - module_utils-basic-deprecations.yml
+    - no_log_booly.yml
+    - paramiko_globals.yml
+    - pc_fixes.yml
+    - pkg_mgr_peek.yml
+    - ppa_https.yml
+    - prettydoc.yml
+    - pull_file_secrets.yml
+    - pull_unfrack_dest.yml
+    - py-tmpl-hardening.yml
+    - reboot_timeout_fix.yml
+    - request-open-reduce-complexity.yml
+    - restore_role_param_precedence.yml
+    - rm-compat-environ.yml
+    - rm-obsolete-url-role-template.yml
+    - role_fixes.yml
+    - scp_if_ssh.yml
+    - ssh_connection_test.yml
+    - syslog_exception.yml
+    - systemd_service_note.yml
+    - thread_counts.yml
+    - unarchive.yml
+    - unarchive_fix.yml
+    - unsafe-fixes-2.yml
+    - unsafe-intern.yml
+    - uri_action_cmode.yml
+    - url_credentials_decode.yml
+    - urls-no-py2.yml
+    - urls-tls13-post-handshake-auth.yml
+    - user-accept-yescrypt-hash.yml
+    - v2.17.0-initial-commit.yaml
+    - wait_for_mmap.yml
+    - winrm-send-input.yml
+    - winrm-task-timeout.yml
+    - winrm-timeout.yml
+    - yum-removal.yml
+    release_date: '2024-04-08'
+  2.17.0rc1:
+    changes:
+      bugfixes:
+      - Fix handlers not being executed in lockstep using the linear strategy in some
+        cases (https://github.com/ansible/ansible/issues/82307)
+      - ansible-config will now properly template defaults before dumping them.
+      - ansible_managed restored it's 'templatability' by ensuring the possible injection
+        routes are cut off earlier in the process.
+      - dnf5 - replace removed API calls
+      - facts - add a generic detection for VMware in product name.
+      release_summary: '| Release Date: 2024-04-29
+
+        | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
+
+        '
+      removed_features:
+      - Removed Python 2.7 and Python 3.6 as a supported remote version. Python 3.7+
+        is now required for target execution.
+    codename: Gallows Pole
+    fragments:
+    - 2.17.0rc1_summary.yaml
+    - 82307-handlers-lockstep-linear-fix.yml
+    - ansible_managed_restore.yml
+    - config_init_fix.yml
+    - dnf5-api-breaks.yml
+    - python-support.yml
+    - vmware_facts.yml
+    release_date: '2024-04-29'
+  2.17.0rc2:
+    changes:
+      bugfixes:
+      - Add a version ceiling constraint for pypsrp to avoid potential breaking changes
+        in the 1.0.0 release.
+      - ansible-doc - fixed "inicates" typo in output
+      - ansible-doc - format top-level descriptions with multiple paragraphs as multiple
+        paragraphs, instead of concatenating them (https://github.com/ansible/ansible/pull/83155).
+      - ensure we have logger before we log when we have increased verbosity.
+      - uri - update the documentation for follow_redirects.
+      release_summary: '| Release Date: 2024-05-13
+
+        | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
+
+        '
+    codename: Gallows Pole
+    fragments:
+    - 2.17.0rc2_summary.yaml
+    - 83155-ansible-doc-paragraphs.yml
+    - ansible-doc-inicate.yml
+    - fix_log_verbosity.yml
+    - psrp-version-req.yml
+    - uri_follow_redirect_bool.yml
+    release_date: '2024-05-13'
+  2.17.1:
+    changes:
+      minor_changes:
+      - ansible-test - Update ``pypi-test-container`` to version 3.1.0.
+      release_summary: '| Release Date: 2024-06-17
+
+        | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
+
+        '
+    codename: Gallows Pole
+    fragments:
+    - 2.17.1_summary.yaml
+    - ansible-test-pypi-test-container-update.yml
+    release_date: '2024-06-17'
+  2.17.1rc1:
+    changes:
+      bugfixes:
+      - Fix rapid memory usage growth when notifying handlers using the ``listen``
+        keyword (https://github.com/ansible/ansible/issues/83392)
+      - Fix the task attribute ``resolved_action`` to show the FQCN instead of ``None``
+        when ``action`` or ``local_action`` is used in the playbook.
+      - Fix using ``module_defaults`` with ``local_action``/``action`` (https://github.com/ansible/ansible/issues/81905).
+      - fixed unit test test_borken_cowsay to address mock not been properly applied
+        when existing unix system already have cowsay installed.
+      - powershell - Implement more robust deletion mechanism for C# code compilation
+        temporary files. This should avoid scenarios where the underlying temporary
+        directory may be temporarily locked by antivirus tools or other IO problems.
+        A failure to delete one of these temporary directories will result in a warning
+        rather than an outright failure.
+      - shell plugin - properly quote all needed components of shell commands (https://github.com/ansible/ansible/issues/82535)
+      release_summary: '| Release Date: 2024-06-10
+
+        | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
+
+        '
+    codename: Gallows Pole
+    fragments:
+    - 2.17.1rc1_summary.yaml
+    - 82535-properly-quote-shell.yml
+    - 83327.yml
+    - 83392-fix-memory-issues-handlers.yml
+    - PowerShell-AddType-temp.yml
+    - correct-callback-fqcn-old-style-action-invocation.yml
+    release_date: '2024-06-10'
+  2.17.2:
+    changes:
+      release_summary: '| Release Date: 2024-07-15
+
+        | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
+
+        '
+    codename: Gallows Pole
+    fragments:
+    - 2.17.2_summary.yaml
+    release_date: '2024-07-15'
+  2.17.2rc1:
+    changes:
+      bugfixes:
+      - Fix a traceback when an environment variable contains certain special characters
+        (https://github.com/ansible/ansible/issues/83498)
+      - dnf, dnf5 - fix for installing a set of packages by specifying them using
+        a wildcard character (https://github.com/ansible/ansible/issues/83373)
+      - linear strategy now provides a properly templated task name to the v2_runner_on_started
+        callback event.
+      - replace - Updated before/after example (https://github.com/ansible/ansible/issues/83390).
+      - templating hostvars under native jinja will not cause serialization errors
+        anymore.
+      release_summary: '| Release Date: 2024-07-08
+
+        | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
+
+        '
+    codename: Gallows Pole
+    fragments:
+    - 2.17.2rc1_summary.yaml
+    - 83373-dnf5-wildcard.yml
+    - 83498-command-tb-env.yml
+    - hostvars_fix.yml
+    - linear_started_name.yml
+    - replace_regex.yml
+    release_date: '2024-07-08'
+  2.17.2rc2:
+    changes:
+      bugfixes:
+      - dnf - reverted incomplete fix from 2.17.2rc1 (https://github.com/ansible/ansible/pull/83504)
+      - package_facts - ignore warnings sent by apk on stderr (https://github.com/ansible/ansible/issues/83501).
+      release_summary: '| Release Date: 2024-07-09
+
+        | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
+
+        '
+    codename: Gallows Pole
+    fragments:
+    - 2.17.2rc2_summary.yaml
+    - dnf-revert.yaml
+    - package_facts_apk.yml
+    release_date: '2024-07-09'
+  2.17.3:
+    changes:
+      release_summary: '| Release Date: 2024-08-12
+
+        | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
+
+        '
+    codename: Gallows Pole
+    fragments:
+    - 2.17.3_summary.yaml
+    release_date: '2024-08-12'
+  2.17.3rc1:
+    changes:
+      bugfixes:
+      - Warning now includes filename and line number of variable when specifying
+        a list of dictionaries for vars (https://github.com/ansible/ansible/issues/82528).
+      - config, restored the ability to set module compression via a variable
+      - debconf - fix normalization of value representation for boolean vtypes in
+        new packages (https://github.com/ansible/ansible/issues/83594)
+      - 'linear strategy: fix handlers included via ``include_tasks`` handler to be
+        executed in lockstep (https://github.com/ansible/ansible/issues/83019)'
+      minor_changes:
+      - ansible-test - Improve the error message shown when an unknown ``--remote``
+        or ``--docker`` option is given.
+      - ansible-test - Removed the ``vyos/1.1.8`` network remote as it is no longer
+        functional.
+      release_summary: '| Release Date: 2024-08-05
+
+        | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
+
+        '
+    codename: Gallows Pole
+    fragments:
+    - 2.17.3rc1_summary.yaml
+    - 82528summary.yml
+    - 83019-linear-handlers-lockstep-fix.yml
+    - 83601-debconf-normalize-bools.yml
+    - ansible-test-error-message-improvement.yml
+    - ansible-test-vyos.yml
+    - mc_fix.yml
+    release_date: '2024-08-05'
+  2.17.4:
+    changes:
+      release_summary: '| Release Date: 2024-09-09
+
+        | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
+
+        '
+    codename: Gallows Pole
+    fragments:
+    - 2.17.4_summary.yaml
+    release_date: '2024-09-09'
+  2.17.4rc1:
+    changes:
+      bugfixes:
+      - Fix ``SemanticVersion.parse()`` to store the version string so that ``__repr__``
+        reports it instead of ``None`` (https://github.com/ansible/ansible/pull/83831).
+      - Fix an issue where registered variable was not available for templating in
+        ``loop_control.label`` on skipped looped tasks (https://github.com/ansible/ansible/issues/83619)
+      - Fix for ``meta`` tasks breaking host/fork affinity with ``host_pinned`` strategy
+        (https://github.com/ansible/ansible/issues/83294)
+      - Fix using the current task's directory for looking up relative paths within
+        roles (https://github.com/ansible/ansible/issues/82695).
+      - atomic_move - fix using the setgid bit on the parent directory when creating
+        files (https://github.com/ansible/ansible/issues/46742, https://github.com/ansible/ansible/issues/67177).
+      - connection plugins using the 'extras' option feature would need variables
+        to match the plugin's loaded name, sometimes requiring fqcn, which is not
+        the same as the documented/declared/expected variables. Now we fall back to
+        the 'basename' of the fqcn, but plugin authors can still set the expected
+        value directly.
+      - csvfile lookup - give an error when no search term is provided using modern
+        config syntax (https://github.com/ansible/ansible/issues/83689).
+      - include_tasks - Display location when attempting to load a task list where
+        ``include_*`` did not specify any value - https://github.com/ansible/ansible/issues/83874
+      - powershell - Improve CLIXML decoding to decode all control characters and
+        unicode characters that are encoded as surrogate pairs.
+      - psrp - Fix bug when attempting to fetch a file path that contains special
+        glob characters like ``[]``
+      - runtime-metadata sanity test - do not crash on deprecations if ``galaxy.yml``
+        contains an empty ``version`` field (https://github.com/ansible/ansible/pull/83831).
+      - ssh - Fix bug when attempting to fetch a file path with characters that should
+        be quoted when using the ``piped`` transfer method
+      release_summary: '| Release Date: 2024-09-03
+
+        | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
+
+        '
+    codename: Gallows Pole
+    fragments:
+    - 2.17.4rc1_summary.yaml
+    - 46742-atomic_move-fix-setgid.yml
+    - 83294-meta-host_pinned-affinity.yml
+    - 83619-loop-label-register.yml
+    - 83831-runtime-metadata-fix.yml
+    - 83874-include-parse-error-location.yml
+    - dwim_is_role_fix_task_relative.yml
+    - extras_fix.yml
+    - fetch-filename.yml
+    - fix-inconsistent-csvfile-missing-search-error.yml
+    - powershell-clixml.yml
+    release_date: '2024-09-03'
--- a/changelogs/fragments/2.17.0_summary.yaml
+++ b/changelogs/fragments/2.17.0_summary.yaml
@ -0,0 +1,3 @@
+release_summary: |
+   | Release Date: 2024-05-20
+   | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
--- a/changelogs/fragments/2.17.0b1_summary.yaml
+++ b/changelogs/fragments/2.17.0b1_summary.yaml
@ -0,0 +1,3 @@
+release_summary: |
+   | Release Date: 2024-04-08
+   | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
--- a/changelogs/fragments/2.17.0rc1_summary.yaml
+++ b/changelogs/fragments/2.17.0rc1_summary.yaml
@ -0,0 +1,3 @@
+release_summary: |
+   | Release Date: 2024-04-29
+   | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
--- a/changelogs/fragments/2.17.0rc2_summary.yaml
+++ b/changelogs/fragments/2.17.0rc2_summary.yaml
@ -0,0 +1,3 @@
+release_summary: |
+   | Release Date: 2024-05-13
+   | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
--- a/changelogs/fragments/2.17.1_summary.yaml
+++ b/changelogs/fragments/2.17.1_summary.yaml
@ -0,0 +1,3 @@
+release_summary: |
+   | Release Date: 2024-06-17
+   | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
--- a/changelogs/fragments/2.17.1rc1_summary.yaml
+++ b/changelogs/fragments/2.17.1rc1_summary.yaml
@ -0,0 +1,3 @@
+release_summary: |
+   | Release Date: 2024-06-10
+   | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
--- a/changelogs/fragments/2.17.2_summary.yaml
+++ b/changelogs/fragments/2.17.2_summary.yaml
@ -0,0 +1,3 @@
+release_summary: |
+   | Release Date: 2024-07-15
+   | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
--- a/changelogs/fragments/2.17.2rc1_summary.yaml
+++ b/changelogs/fragments/2.17.2rc1_summary.yaml
@ -0,0 +1,3 @@
+release_summary: |
+   | Release Date: 2024-07-08
+   | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
--- a/changelogs/fragments/2.17.2rc2_summary.yaml
+++ b/changelogs/fragments/2.17.2rc2_summary.yaml
@ -0,0 +1,3 @@
+release_summary: |
+   | Release Date: 2024-07-09
+   | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
--- a/changelogs/fragments/2.17.3_summary.yaml
+++ b/changelogs/fragments/2.17.3_summary.yaml
@ -0,0 +1,3 @@
+release_summary: |
+   | Release Date: 2024-08-12
+   | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
--- a/changelogs/fragments/2.17.3rc1_summary.yaml
+++ b/changelogs/fragments/2.17.3rc1_summary.yaml
@ -0,0 +1,3 @@
+release_summary: |
+   | Release Date: 2024-08-05
+   | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
--- a/changelogs/fragments/2.17.4_summary.yaml
+++ b/changelogs/fragments/2.17.4_summary.yaml
@ -0,0 +1,3 @@
+release_summary: |
+   | Release Date: 2024-09-09
+   | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
--- a/changelogs/fragments/2.17.4rc1_summary.yaml
+++ b/changelogs/fragments/2.17.4rc1_summary.yaml
@ -0,0 +1,3 @@
+release_summary: |
+   | Release Date: 2024-09-03
+   | `Porting Guide <https://docs.ansible.com/ansible-core/2.17/porting_guides/porting_guide_core_2.17.html>`__
--- a/changelogs/fragments/46742-atomic_move-fix-setgid.yml
+++ b/changelogs/fragments/46742-atomic_move-fix-setgid.yml
@ -0,0 +1,2 @@
+bugfixes:
+  - atomic_move - fix using the setgid bit on the parent directory when creating files (https://github.com/ansible/ansible/issues/46742, https://github.com/ansible/ansible/issues/67177).
--- a/changelogs/fragments/82307-handlers-lockstep-linear-fix.yml
+++ b/changelogs/fragments/82307-handlers-lockstep-linear-fix.yml
@ -0,0 +1,2 @@
+bugfixes:
+  - Fix handlers not being executed in lockstep using the linear strategy in some cases (https://github.com/ansible/ansible/issues/82307)
--- a/changelogs/fragments/82528summary.yml
+++ b/changelogs/fragments/82528summary.yml
@ -0,0 +1,3 @@
+bugfixes:
+- Warning now includes filename and line number of variable 
+  when specifying a list of dictionaries for vars (https://github.com/ansible/ansible/issues/82528).
--- a/changelogs/fragments/82535-properly-quote-shell.yml
+++ b/changelogs/fragments/82535-properly-quote-shell.yml
@ -0,0 +1,2 @@
+bugfixes:
+- shell plugin - properly quote all needed components of shell commands (https://github.com/ansible/ansible/issues/82535)
--- a/changelogs/fragments/82708-unsafe-plugin-name-error.yml
+++ b/changelogs/fragments/82708-unsafe-plugin-name-error.yml
@ -0,0 +1,2 @@
+bugfixes:
+  - "Fix an issue when setting a plugin name from an unsafe source resulted in ``ValueError: unmarshallable object`` (https://github.com/ansible/ansible/issues/82708)"
--- a/changelogs/fragments/82878-fetch-dest-is-dir.yml
+++ b/changelogs/fragments/82878-fetch-dest-is-dir.yml
@ -0,0 +1,4 @@
+bugfixes:
+- >-
+    fetch - add error message when using ``dest`` with a trailing slash that becomes a local directory -
+    https://github.com/ansible/ansible/issues/82878
--- a/changelogs/fragments/83019-linear-handlers-lockstep-fix.yml
+++ b/changelogs/fragments/83019-linear-handlers-lockstep-fix.yml
@ -0,0 +1,2 @@
+bugfixes:
+  - "linear strategy: fix handlers included via ``include_tasks`` handler to be executed in lockstep (https://github.com/ansible/ansible/issues/83019)"
--- a/changelogs/fragments/83155-ansible-doc-paragraphs.yml
+++ b/changelogs/fragments/83155-ansible-doc-paragraphs.yml
@ -0,0 +1,2 @@
+bugfixes:
+  - "ansible-doc - format top-level descriptions with multiple paragraphs as multiple paragraphs, instead of concatenating them (https://github.com/ansible/ansible/pull/83155)."
--- a/changelogs/fragments/83294-meta-host_pinned-affinity.yml
+++ b/changelogs/fragments/83294-meta-host_pinned-affinity.yml
@ -0,0 +1,2 @@
+bugfixes:
+  - Fix for ``meta`` tasks breaking host/fork affinity with ``host_pinned`` strategy (https://github.com/ansible/ansible/issues/83294)
--- a/changelogs/fragments/83327.yml
+++ b/changelogs/fragments/83327.yml
@ -0,0 +1,3 @@
+---
+bugfixes:
+  - fixed unit test test_borken_cowsay to address mock not been properly applied when existing unix system already have cowsay installed.
--- a/changelogs/fragments/83373-dnf5-wildcard.yml
+++ b/changelogs/fragments/83373-dnf5-wildcard.yml
@ -0,0 +1,2 @@
+bugfixes:
+  - dnf, dnf5 - fix for installing a set of packages by specifying them using a wildcard character (https://github.com/ansible/ansible/issues/83373)
--- a/changelogs/fragments/83392-fix-memory-issues-handlers.yml
+++ b/changelogs/fragments/83392-fix-memory-issues-handlers.yml
@ -0,0 +1,2 @@
+bugfixes:
+  - Fix rapid memory usage growth when notifying handlers using the ``listen`` keyword (https://github.com/ansible/ansible/issues/83392)
--- a/changelogs/fragments/83498-command-tb-env.yml
+++ b/changelogs/fragments/83498-command-tb-env.yml
@ -0,0 +1,2 @@
+bugfixes:
+  - Fix a traceback when an environment variable contains certain special characters (https://github.com/ansible/ansible/issues/83498)
--- a/changelogs/fragments/83601-debconf-normalize-bools.yml
+++ b/changelogs/fragments/83601-debconf-normalize-bools.yml
@ -0,0 +1,3 @@
+---
+bugfixes:
+  - debconf - fix normalization of value representation for boolean vtypes in new packages (https://github.com/ansible/ansible/issues/83594)
--- a/changelogs/fragments/83619-loop-label-register.yml
+++ b/changelogs/fragments/83619-loop-label-register.yml
@ -0,0 +1,2 @@
+bugfixes:
+  - Fix an issue where registered variable was not available for templating in ``loop_control.label`` on skipped looped tasks (https://github.com/ansible/ansible/issues/83619)
--- a/changelogs/fragments/83831-runtime-metadata-fix.yml
+++ b/changelogs/fragments/83831-runtime-metadata-fix.yml
@ -0,0 +1,3 @@
+bugfixes:
+  - "runtime-metadata sanity test - do not crash on deprecations if ``galaxy.yml`` contains an empty ``version`` field (https://github.com/ansible/ansible/pull/83831)."
+  - "Fix ``SemanticVersion.parse()`` to store the version string so that ``__repr__`` reports it instead of ``None`` (https://github.com/ansible/ansible/pull/83831)."
--- a/changelogs/fragments/83874-include-parse-error-location.yml
+++ b/changelogs/fragments/83874-include-parse-error-location.yml
@ -0,0 +1,4 @@
+bugfixes:
+  - >-
+    include_tasks - Display location when attempting to load a task list where ``include_*`` did not specify any value -
+    https://github.com/ansible/ansible/issues/83874
--- a/changelogs/fragments/PowerShell-AddType-temp.yml
+++ b/changelogs/fragments/PowerShell-AddType-temp.yml
@ -0,0 +1,7 @@
+bugfixes:
+- >-
+  powershell - Implement more robust deletion mechanism for C# code compilation
+  temporary files. This should avoid scenarios where the underlying temporary
+  directory may be temporarily locked by antivirus tools or other IO problems.
+  A failure to delete one of these temporary directories will result in a
+  warning rather than an outright failure.
--- a/changelogs/fragments/ansible-doc-inicate.yml
+++ b/changelogs/fragments/ansible-doc-inicate.yml
@ -0,0 +1,2 @@
+bugfixes:
+  - ansible-doc - fixed "inicates" typo in output
--- a/changelogs/fragments/ansible-galaxy-role-install-symlink.yml
+++ b/changelogs/fragments/ansible-galaxy-role-install-symlink.yml
@ -1,2 +1,3 @@
 bugfixes:
  - ansible-galaxy role install - normalize tarfile paths and symlinks using ``ansible.utils.path.unfrackpath`` and consider them valid as long as the realpath is in the tarfile's role directory (https://github.com/ansible/ansible/issues/81965).
+  - ansible-galaxy role install - fix symlinks (https://github.com/ansible/ansible/issues/82702, https://github.com/ansible/ansible/issues/81965).
--- a/changelogs/fragments/ansible-test-error-message-improvement.yml
+++ b/changelogs/fragments/ansible-test-error-message-improvement.yml
@ -0,0 +1,2 @@
+minor_changes:
+  - ansible-test - Improve the error message shown when an unknown ``--remote`` or ``--docker`` option is given.
--- a/changelogs/fragments/ansible-test-pypi-test-container-update.yml
+++ b/changelogs/fragments/ansible-test-pypi-test-container-update.yml
@ -0,0 +1,2 @@
+minor_changes:
+  - ansible-test - Update ``pypi-test-container`` to version 3.1.0.
--- a/changelogs/fragments/ansible-test-vyos.yml
+++ b/changelogs/fragments/ansible-test-vyos.yml
@ -0,0 +1,2 @@
+minor_changes:
+  - ansible-test - Removed the ``vyos/1.1.8`` network remote as it is no longer functional.
--- a/changelogs/fragments/ansible_managed_restore.yml
+++ b/changelogs/fragments/ansible_managed_restore.yml
@ -0,0 +1,2 @@
+bugfixes:
+  - ansible_managed restored it's 'templatability' by ensuring the possible injection routes are cut off earlier in the process.
--- a/changelogs/fragments/config_init_fix.yml
+++ b/changelogs/fragments/config_init_fix.yml
@ -0,0 +1,2 @@
+bugfixes:
+  - ansible-config will now properly template defaults before dumping them.
--- a/changelogs/fragments/correct-callback-fqcn-old-style-action-invocation.yml
+++ b/changelogs/fragments/correct-callback-fqcn-old-style-action-invocation.yml
@ -0,0 +1,3 @@
+bugfixes:
+  - Fix the task attribute ``resolved_action`` to show the FQCN instead of ``None`` when ``action`` or ``local_action`` is used in the playbook.
+  - Fix using ``module_defaults`` with ``local_action``/``action`` (https://github.com/ansible/ansible/issues/81905).
--- a/changelogs/fragments/cve-2023-5764.yml
+++ b/changelogs/fragments/cve-2023-5764.yml
@ -0,0 +1,6 @@
+security_fixes:
+- templating - Address issues where internal templating can cause unsafe
+  variables to lose their unsafe designation (CVE-2023-5764)
+breaking_changes:
+- assert - Nested templating may result in an inability for the conditional
+  to be evaluated. See the porting guide for more information.
--- a/changelogs/fragments/dnf-revert.yaml
+++ b/changelogs/fragments/dnf-revert.yaml
@ -0,0 +1,2 @@
+bugfixes:
+  - dnf - reverted incomplete fix from 2.17.2rc1 (https://github.com/ansible/ansible/pull/83504)
--- a/changelogs/fragments/dnf5-api-breaks.yml
+++ b/changelogs/fragments/dnf5-api-breaks.yml
@ -0,0 +1,2 @@
+bugfixes:
+  - dnf5 - replace removed API calls
--- a/changelogs/fragments/dwim_is_role_fix_task_relative.yml
+++ b/changelogs/fragments/dwim_is_role_fix_task_relative.yml
@ -0,0 +1,2 @@
+bugfixes:
+  - Fix using the current task's directory for looking up relative paths within roles (https://github.com/ansible/ansible/issues/82695).
--- a/changelogs/fragments/extras_fix.yml
+++ b/changelogs/fragments/extras_fix.yml
@ -0,0 +1,4 @@
+bugfixes:
+  - connection plugins using the 'extras' option feature would need variables to match the plugin's loaded name,
+    sometimes requiring fqcn, which is not the same as the documented/declared/expected variables.
+    Now we fall back to the 'basename' of the fqcn, but plugin authors can still set the expected value directly.
--- a/changelogs/fragments/fetch-filename.yml
+++ b/changelogs/fragments/fetch-filename.yml
@ -0,0 +1,3 @@
+bugfixes:
+  - psrp - Fix bug when attempting to fetch a file path that contains special glob characters like ``[]``
+  - ssh - Fix bug when attempting to fetch a file path with characters that should be quoted when using the ``piped`` transfer method
--- a/changelogs/fragments/fix-inconsistent-csvfile-missing-search-error.yml
+++ b/changelogs/fragments/fix-inconsistent-csvfile-missing-search-error.yml
@ -0,0 +1,2 @@
+bugfixes:
+  - csvfile lookup - give an error when no search term is provided using modern config syntax (https://github.com/ansible/ansible/issues/83689).
--- a/changelogs/fragments/fix_log_verbosity.yml
+++ b/changelogs/fragments/fix_log_verbosity.yml
@ -0,0 +1,2 @@
+bugfixes:
+  - ensure we have logger before we log when we have increased verbosity.
--- a/changelogs/fragments/hostvars_fix.yml
+++ b/changelogs/fragments/hostvars_fix.yml
@ -0,0 +1,2 @@
+bugfixes:
+  - templating hostvars under native jinja will not cause serialization errors anymore.
--- a/changelogs/fragments/linear_started_name.yml
+++ b/changelogs/fragments/linear_started_name.yml
@ -0,0 +1,2 @@
+bugfixes:
+  - linear strategy now provides a properly templated task name to the v2_runner_on_started callback event.
--- a/changelogs/fragments/mc_fix.yml
+++ b/changelogs/fragments/mc_fix.yml
@ -0,0 +1,2 @@
+bugfixes:
+  - config, restored the ability to set module compression via a variable
--- a/changelogs/fragments/package_facts_apk.yml
+++ b/changelogs/fragments/package_facts_apk.yml
@ -0,0 +1,3 @@
+---
+bugfixes:
+  - package_facts - ignore warnings sent by apk on stderr (https://github.com/ansible/ansible/issues/83501).
--- a/changelogs/fragments/powershell-clixml.yml
+++ b/changelogs/fragments/powershell-clixml.yml
@ -0,0 +1,3 @@
+bugfixes:
+  - powershell - Improve CLIXML decoding to decode all control characters and
+    unicode characters that are encoded as surrogate pairs.
--- a/changelogs/fragments/psrp-version-req.yml
+++ b/changelogs/fragments/psrp-version-req.yml
@ -0,0 +1,2 @@
+bugfixes:
+- Add a version ceiling constraint for pypsrp to avoid potential breaking changes in the 1.0.0 release.
--- a/changelogs/fragments/python-support.yml
+++ b/changelogs/fragments/python-support.yml
@ -0,0 +1,2 @@
+removed_features:
+  - Removed Python 2.7 and Python 3.6 as a supported remote version. Python 3.7+ is now required for target execution.
--- a/changelogs/fragments/replace_regex.yml
+++ b/changelogs/fragments/replace_regex.yml
@ -0,0 +1,3 @@
+---
+bugfixes:
+  - replace - Updated before/after example (https://github.com/ansible/ansible/issues/83390).
--- a/changelogs/fragments/unsafe-fixes-2.yml
+++ b/changelogs/fragments/unsafe-fixes-2.yml
@ -0,0 +1,3 @@
+bugfixes:
+- unsafe data - Address an incompatibility with ``AnsibleUnsafeText`` and ``AnsibleUnsafeBytes`` when pickling with ``protocol=0``
+- unsafe data - Address an incompatibility when iterating or getting a single index from ``AnsibleUnsafeBytes``
--- a/changelogs/fragments/unsafe-intern.yml
+++ b/changelogs/fragments/unsafe-intern.yml
@ -0,0 +1,3 @@
+bugfixes:
+- unsafe data - Enable directly using ``AnsibleUnsafeText`` with Python ``pathlib``
+  (https://github.com/ansible/ansible/issues/82414)
--- a/changelogs/fragments/uri_follow_redirect_bool.yml
+++ b/changelogs/fragments/uri_follow_redirect_bool.yml
@ -0,0 +1,3 @@
+---
+bugfixes:
+  - uri - update the documentation for follow_redirects.
--- a/changelogs/fragments/vmware_facts.yml
+++ b/changelogs/fragments/vmware_facts.yml
@ -0,0 +1,3 @@
+---
+bugfixes:
+  - facts - add a generic detection for VMware in product name.
--- a/lib/ansible/cli/config.py
+++ b/lib/ansible/cli/config.py
@ -269,7 +269,7 @@ class ConfigCLI(CLI):
            if not settings[setting].get('description'):
                continue

-            default = settings[setting].get('default', '')
+            default = self.config.template_default(settings[setting].get('default', ''), get_constants())
            if subkey == 'env':
                stype = settings[setting].get('type', '')
                if stype == 'boolean':
@ -351,7 +351,7 @@ class ConfigCLI(CLI):
                if entry['key'] not in seen[entry['section']]:
                    seen[entry['section']].append(entry['key'])

-                    default = opt.get('default', '')
+                    default = self.config.template_default(opt.get('default', ''), get_constants())
                    if opt.get('type', '') == 'list' and not isinstance(default, string_types):
                        # python lists are not valid ini ones
                        default = ', '.join(default)
@ -413,14 +413,16 @@ class ConfigCLI(CLI):
            if context.CLIARGS['format'] == 'display':
                if isinstance(config[setting], Setting):
                    # proceed normally
+                    value = config[setting].value
                    if config[setting].origin == 'default':
                        color = 'green'
+                        value = self.config.template_default(value, get_constants())
                    elif config[setting].origin == 'REQUIRED':
                        # should include '_terms', '_input', etc
                        color = 'red'
                    else:
                        color = 'yellow'
-                    msg = "%s(%s) = %s" % (setting, config[setting].origin, config[setting].value)
+                    msg = "%s(%s) = %s" % (setting, config[setting].origin, value)
                else:
                    color = 'green'
                    msg = "%s(%s) = %s" % (setting, 'default', config[setting].get('default'))
--- a/lib/ansible/cli/doc.py
+++ b/lib/ansible/cli/doc.py
@ -1296,14 +1296,15 @@ class DocCLI(CLI, RoleMixin):

            if doc.get('description'):
                if isinstance(doc['description'], list):
-                    desc = " ".join(doc['description'])
+                    descs = doc['description']
                else:
-                    desc = doc['description']
-                text.append("%s" % DocCLI.warp_fill(DocCLI.tty_ify(desc), limit, initial_indent=opt_indent, subsequent_indent=opt_indent))
+                    descs = [doc['description']]
+                for desc in descs:
+                    text.append("%s" % DocCLI.warp_fill(DocCLI.tty_ify(desc), limit, initial_indent=opt_indent, subsequent_indent=opt_indent))
                text.append('')

            if doc.get('options'):
-                text.append(_format("Options", 'bold') + " (%s inicates it is required):" % ("=" if C.ANSIBLE_NOCOLOR else 'red'))
+                text.append(_format("Options", 'bold') + " (%s indicates it is required):" % ("=" if C.ANSIBLE_NOCOLOR else 'red'))
                DocCLI.add_fields(text, doc.pop('options'), limit, opt_indent)

            if doc.get('attributes', False):
@ -1355,12 +1356,13 @@ class DocCLI(CLI, RoleMixin):
        text.append("> %s %s (%s)" % (plugin_type.upper(), _format(doc.pop('plugin_name'), 'bold'), doc.pop('filename')))

        if isinstance(doc['description'], list):
-            desc = " ".join(doc.pop('description'))
+            descs = doc.pop('description')
        else:
-            desc = doc.pop('description')
+            descs = [doc.pop('description')]

        text.append('')
-        text.append(DocCLI.warp_fill(DocCLI.tty_ify(desc), limit, initial_indent=base_indent, subsequent_indent=base_indent))
+        for desc in descs:
+            text.append(DocCLI.warp_fill(DocCLI.tty_ify(desc), limit, initial_indent=base_indent, subsequent_indent=base_indent))

        if display.verbosity > 0:
            doc['added_in'] = DocCLI._format_version_added(doc.pop('version_added', 'historical'), doc.pop('version_added_collection', 'ansible-core'))
@ -1385,7 +1387,7 @@ class DocCLI(CLI, RoleMixin):

        if doc.get('options', False):
            text.append("")
-            text.append(_format("OPTIONS", 'bold') + " (%s inicates it is required):" % ("=" if C.ANSIBLE_NOCOLOR else 'red'))
+            text.append(_format("OPTIONS", 'bold') + " (%s indicates it is required):" % ("=" if C.ANSIBLE_NOCOLOR else 'red'))
            DocCLI.add_fields(text, doc.pop('options'), limit, opt_indent, man=(display.verbosity == 0))

        if doc.get('attributes', False):
--- a/lib/ansible/config/base.yml
+++ b/lib/ansible/config/base.yml
@ -855,8 +855,8 @@ DEFAULT_MODULE_COMPRESSION:
  env: []
  ini:
  - {key: module_compression, section: defaults}
-# vars:
-#   - name: ansible_module_compression
+  vars:
+    - name: ansible_module_compression
 DEFAULT_MODULE_NAME:
  name: Default adhoc module
  default: command
@ -948,7 +948,7 @@ DEFAULT_PRIVATE_ROLE_VARS:
    - This was introduced as a way to reset role variables to default values if a role is used more than once
      in a playbook.
    - Starting in version '2.17' M(ansible.builtin.include_roles) and M(ansible.builtin.import_roles) can
-      indivudually override this via the C(public) parameter.
+      individually override this via the C(public) parameter.
    - Included roles only make their variables public at execution, unlike imported roles which happen at playbook compile time.
  env: [{name: ANSIBLE_PRIVATE_ROLE_VARS}]
  ini:
@ -1733,7 +1733,7 @@ INJECT_FACTS_AS_VARS:
  default: True
  description:
    - Facts are available inside the `ansible_facts` variable, this setting also pushes them as their own vars in the main namespace.
-    - Unlike inside the `ansible_facts` dictionary, these will have an `ansible_` prefix.
+    - Unlike inside the `ansible_facts` dictionary where the prefix `ansible_` is removed from fact names, these will have the exact names that are returned by the module.
  env: [{name: ANSIBLE_INJECT_FACT_VARS}]
  ini:
  - {key: inject_facts_as_vars, section: defaults}
--- a/lib/ansible/config/manager.py
+++ b/lib/ansible/config/manager.py
@ -302,6 +302,17 @@ class ConfigManager(object):
        # ensure we always have config def entry
        self._base_defs['CONFIG_FILE'] = {'default': None, 'type': 'path'}

+    def template_default(self, value, variables):
+        if isinstance(value, string_types) and (value.startswith('{{') and value.endswith('}}')) and variables is not None:
+            # template default values if possible
+            # NOTE: cannot use is_template due to circular dep
+            try:
+                t = NativeEnvironment().from_string(value)
+                value = t.render(variables)
+            except Exception:
+                pass  # not templatable
+        return value
+
    def _read_config_yaml_file(self, yml_file):
        # TODO: handle relative paths as relative to the directory containing the current playbook instead of CWD
        # Currently this is only used with absolute paths to the `ansible/config` directory
@ -555,18 +566,9 @@ class ConfigManager(object):
                                           to_native(_get_entry(plugin_type, plugin_name, config)))
                else:
                    origin = 'default'
-                    value = defs[config].get('default')
-                    if isinstance(value, string_types) and (value.startswith('{{') and value.endswith('}}')) and variables is not None:
-                        # template default values if possible
-                        # NOTE: cannot use is_template due to circular dep
-                        try:
-                            t = NativeEnvironment().from_string(value)
-                            value = t.render(variables)
-                        except Exception:
-                            pass  # not templatable
-
-            # ensure correct type, can raise exceptions on mismatched types
+                    value = self.template_default(defs[config].get('default'), variables)
            try:
+                # ensure correct type, can raise exceptions on mismatched types
                value = ensure_type(value, defs[config].get('type'), origin=origin, origin_ftype=origin_ftype)
            except ValueError as e:
                if origin.startswith('env:') and value == '':
--- a/lib/ansible/executor/play_iterator.py
+++ b/lib/ansible/executor/play_iterator.py
@ -427,13 +427,13 @@ class PlayIterator:
                    # might be there from previous flush
                    state.handlers = self.handlers[:]
                    state.update_handlers = False
-                    state.cur_handlers_task = 0

                while True:
                    try:
                        task = state.handlers[state.cur_handlers_task]
                    except IndexError:
                        task = None
+                        state.cur_handlers_task = 0
                        state.run_state = state.pre_flushing_run_state
                        state.update_handlers = True
                        break
--- a/lib/ansible/executor/powershell/exec_wrapper.ps1
+++ b/lib/ansible/executor/powershell/exec_wrapper.ps1
@ -178,6 +178,7 @@ $($ErrorRecord.InvocationInfo.PositionMessage)

    Write-AnsibleLog "INFO - converting json raw to a payload" "exec_wrapper"
    $payload = ConvertFrom-AnsibleJson -InputObject $json_raw
+    $payload.module_args._ansible_exec_wrapper_warnings = [System.Collections.Generic.List[string]]@()

    # TODO: handle binary modules
    # TODO: handle persistence
--- a/lib/ansible/executor/powershell/module_powershell_wrapper.ps1
+++ b/lib/ansible/executor/powershell/module_powershell_wrapper.ps1
@ -29,7 +29,18 @@ if ($csharp_utils.Count -gt 0) {

    # add any C# references so the module does not have to do so
    $new_tmp = [System.Environment]::ExpandEnvironmentVariables($Payload.module_args["_ansible_remote_tmp"])
-    Add-CSharpType -References $csharp_utils -TempPath $new_tmp -IncludeDebugInfo
+
+    # We use a fake module object to capture warnings
+    $fake_module = [PSCustomObject]@{
+        Tmpdir = $new_tmp
+        Verbosity = 3
+    }
+    $warning_func = New-Object -TypeName System.Management.Automation.PSScriptMethod -ArgumentList Warn, {
+        param($message)
+        $Payload.module_args._ansible_exec_wrapper_warnings.Add($message)
+    }
+    $fake_module.PSObject.Members.Add($warning_func)
+    Add-CSharpType -References $csharp_utils -AnsibleModule $fake_module
 }

 if ($Payload.ContainsKey("coverage") -and $null -ne $host.Runspace -and $null -ne $host.Runspace.Debugger) {
--- a/lib/ansible/executor/task_executor.py
+++ b/lib/ansible/executor/task_executor.py
@ -31,7 +31,7 @@ from ansible.utils.listify import listify_lookup_plugin_terms
 from ansible.utils.unsafe_proxy import to_unsafe_text, wrap_var
 from ansible.vars.clean import namespace_facts, clean_facts
 from ansible.utils.display import Display
-from ansible.utils.vars import combine_vars, isidentifier
+from ansible.utils.vars import combine_vars

 display = Display()

@ -332,6 +332,13 @@ class TaskExecutor:
            (self._task, tmp_task) = (tmp_task, self._task)
            (self._play_context, tmp_play_context) = (tmp_play_context, self._play_context)
            res = self._execute(variables=task_vars)
+
+            if self._task.register:
+                # Ensure per loop iteration results are registered in case `_execute()`
+                # returns early (when conditional, failure, ...).
+                # This is needed in case the registered variable is used in the loop label template.
+                task_vars[self._task.register] = res
+
            task_fields = self._task.dump_attrs()
            (self._task, tmp_task) = (tmp_task, self._task)
            (self._play_context, tmp_play_context) = (tmp_play_context, self._play_context)
@ -657,9 +664,6 @@ class TaskExecutor:
            # update the local copy of vars with the registered value, if specified,
            # or any facts which may have been generated by the module execution
            if self._task.register:
-                if not isidentifier(self._task.register):
-                    raise AnsibleError("Invalid variable name in 'register' specified: '%s'" % self._task.register)
-
                vars_copy[self._task.register] = result

            if self._task.async_val > 0:
@ -1048,7 +1052,7 @@ class TaskExecutor:
        # add extras if plugin supports them
        if getattr(self._connection, 'allow_extras', False):
            for k in variables:
-                if k.startswith('ansible_%s_' % self._connection._load_name) and k not in options:
+                if k.startswith('ansible_%s_' % self._connection.extras_prefix) and k not in options:
                    options['_extras'][k] = templar.template(variables[k])

        task_keys = self._task.dump_attrs()
--- a/lib/ansible/galaxy/data/apb/meta/main.yml.j2
+++ b/lib/ansible/galaxy/data/apb/meta/main.yml.j2
@ -16,21 +16,6 @@ galaxy_info:
  # - CC-BY-4.0
  license: {{ license }}

-  #
-  # platforms is a list of platforms, and each platform has a name and a list of versions.
-  #
-  # platforms:
-  # - name: Fedora
-  #   versions:
-  #   - all
-  #   - 25
-  # - name: SomePlatform
-  #   versions:
-  #   - all
-  #   - 1.0
-  #   - 7
-  #   - 99.99
-
  galaxy_tags:
    - apb
    # List tags for your role here, one per line. A tag is a keyword that describes
--- a/lib/ansible/galaxy/data/network/meta/main.yml.j2
+++ b/lib/ansible/galaxy/data/network/meta/main.yml.j2
@ -21,21 +21,6 @@ galaxy_info:
  # If this a Container Enabled role, provide the minimum Ansible Container version.
  # min_ansible_container_version:

-  #
-  # platforms is a list of platforms, and each platform has a name and a list of versions.
-  #
-  # platforms:
-  # - name: VYOS
-  #   versions:
-  #   - all
-  #   - 25
-  # - name: SomePlatform
-  #   versions:
-  #   - all
-  #   - 1.0
-  #   - 7
-  #   - 99.99
-
  galaxy_tags: []
    # List tags for your role here, one per line. A tag is a keyword that describes
    # and categorizes the role. Users find roles by searching for tags. Be sure to
--- a/lib/ansible/galaxy/role.py
+++ b/lib/ansible/galaxy/role.py
@ -386,6 +386,8 @@ class GalaxyRole(object):
                        else:
                            os.makedirs(self.path)

+                        resolved_archive = unfrackpath(archive_parent_dir, follow=False)
+
                        # We strip off any higher-level directories for all of the files
                        # contained within the tar file here. The default is 'github_repo-target'.
                        # Gerrit instances, on the other hand, does not have a parent directory at all.
@ -400,33 +402,29 @@ class GalaxyRole(object):
                                if not (attr_value := getattr(member, attr, None)):
                                    continue

-                                if attr_value.startswith(os.sep) and not is_subpath(attr_value, archive_parent_dir):
-                                    err = f"Invalid {attr} for tarfile member: path {attr_value} is not a subpath of the role {archive_parent_dir}"
-                                    raise AnsibleError(err)
-
                                if attr == 'linkname':
                                    # Symlinks are relative to the link
-                                    relative_to_archive_dir = os.path.dirname(getattr(member, 'name', ''))
-                                    archive_dir_path = os.path.join(archive_parent_dir, relative_to_archive_dir, attr_value)
+                                    relative_to = os.path.dirname(getattr(member, 'name', ''))
                                else:
                                    # Normalize paths that start with the archive dir
                                    attr_value = attr_value.replace(archive_parent_dir, "", 1)
                                    attr_value = os.path.join(*attr_value.split(os.sep))  # remove leading os.sep
-                                    archive_dir_path = os.path.join(archive_parent_dir, attr_value)
+                                    relative_to = ''

-                                resolved_archive = unfrackpath(archive_parent_dir)
-                                resolved_path = unfrackpath(archive_dir_path)
-                                if not is_subpath(resolved_path, resolved_archive):
-                                    err = f"Invalid {attr} for tarfile member: path {resolved_path} is not a subpath of the role {resolved_archive}"
+                                full_path = os.path.join(resolved_archive, relative_to, attr_value)
+                                if not is_subpath(full_path, resolved_archive, real=True):
+                                    err = f"Invalid {attr} for tarfile member: path {full_path} is not a subpath of the role {resolved_archive}"
                                    raise AnsibleError(err)

-                                relative_path = os.path.join(*resolved_path.replace(resolved_archive, "", 1).split(os.sep)) or '.'
+                                relative_path_dir = os.path.join(resolved_archive, relative_to)
+                                relative_path = os.path.join(*full_path.replace(relative_path_dir, "", 1).split(os.sep))
                                setattr(member, attr, relative_path)

                            if _check_working_data_filter():
                                # deprecated: description='extract fallback without filter' python_version='3.11'
                                role_tar_file.extract(member, to_native(self.path), filter='data')  # type: ignore[call-arg]
                            else:
+                                # Remove along with manual path filter once Python 3.12 is minimum supported version
                                role_tar_file.extract(member, to_native(self.path))

                        # write out the install info file for later use
--- a/lib/ansible/module_utils/basic.py
+++ b/lib/ansible/module_utils/basic.py
@ -1686,8 +1686,12 @@ class AnsibleModule(object):
            umask = os.umask(0)
            os.umask(umask)
            os.chmod(b_dest, S_IRWU_RWG_RWO & ~umask)
+            dest_dir_stat = os.stat(os.path.dirname(b_dest))
            try:
-                os.chown(b_dest, os.geteuid(), os.getegid())
+                if dest_dir_stat.st_mode & stat.S_ISGID:
+                    os.chown(b_dest, os.geteuid(), dest_dir_stat.st_gid)
+                else:
+                    os.chown(b_dest, os.geteuid(), os.getegid())
            except OSError:
                # We're okay with trying our best here.  If the user is not
                # root (or old Unices) they won't be able to chown.
--- a/lib/ansible/module_utils/common/json.py
+++ b/lib/ansible/module_utils/common/json.py
@ -28,7 +28,7 @@ def _preprocess_unsafe_encode(value):
    Used in ``AnsibleJSONEncoder.iterencode``
    """
    if _is_unsafe(value):
-        value = {'__ansible_unsafe': to_text(value, errors='surrogate_or_strict', nonstring='strict')}
+        value = {'__ansible_unsafe': to_text(value._strip_unsafe(), errors='surrogate_or_strict', nonstring='strict')}
    elif is_sequence(value):
        value = [_preprocess_unsafe_encode(v) for v in value]
    elif isinstance(value, Mapping):
@ -61,7 +61,7 @@ class AnsibleJSONEncoder(json.JSONEncoder):
                value = {'__ansible_vault': to_text(o._ciphertext, errors='surrogate_or_strict', nonstring='strict')}
        elif getattr(o, '__UNSAFE__', False):
            # unsafe object, this will never be triggered, see ``AnsibleJSONEncoder.iterencode``
-            value = {'__ansible_unsafe': to_text(o, errors='surrogate_or_strict', nonstring='strict')}
+            value = {'__ansible_unsafe': to_text(o._strip_unsafe(), errors='surrogate_or_strict', nonstring='strict')}
        elif isinstance(o, Mapping):
            # hostvars and other objects
            value = dict(o)
--- a/lib/ansible/module_utils/csharp/Ansible.Basic.cs
+++ b/lib/ansible/module_utils/csharp/Ansible.Basic.cs
@ -1025,7 +1025,16 @@ namespace Ansible.Basic
            foreach (DictionaryEntry entry in param)
            {
                string paramKey = (string)entry.Key;
-                if (!legalInputs.Contains(paramKey, StringComparer.OrdinalIgnoreCase))
+                if (paramKey == "_ansible_exec_wrapper_warnings")
+                {
+                    // Special key used in module_powershell_wrapper to pass
+                    // along any warnings that should be returned back to
+                    // Ansible.
+                    removedParameters.Add(paramKey);
+                    foreach (string warning in (IList<string>)entry.Value)
+                        Warn(warning);
+                }
+                else if (!legalInputs.Contains(paramKey, StringComparer.OrdinalIgnoreCase))
                    unsupportedParameters.Add(paramKey);
                else if (!legalInputs.Contains(paramKey))
                    // For backwards compatibility we do not care about the case but we need to warn the users as this will
--- a/lib/ansible/module_utils/distro/init.py
+++ b/lib/ansible/module_utils/distro/init.py
@ -22,7 +22,7 @@ Compat distro library.
 from __future__ import annotations

 # The following makes it easier for us to script updates of the bundled code
-_BUNDLED_METADATA = {"pypi_name": "distro", "version": "1.6.0"}
+_BUNDLED_METADATA = {"pypi_name": "distro", "version": "1.8.0"}

 # The following additional changes have been made:
 # * Remove optparse since it is not needed for our use.
--- a/lib/ansible/module_utils/facts/virtual/linux.py
+++ b/lib/ansible/module_utils/facts/virtual/linux.py
@ -175,7 +175,7 @@ class LinuxVirtual(Virtual):
                    virtual_facts['virtualization_type'] = 'RHEV'
                    found_virt = True

-        if product_name in ('VMware Virtual Platform', 'VMware7,1', 'VMware20,1'):
+        if product_name and product_name.startswith(("VMware",)):
            guest_tech.add('VMware')
            if not found_virt:
                virtual_facts['virtualization_type'] = 'VMware'
--- a/lib/ansible/module_utils/powershell/Ansible.ModuleUtils.AddType.psm1
+++ b/lib/ansible/module_utils/powershell/Ansible.ModuleUtils.AddType.psm1
@ -75,7 +75,7 @@ Function Add-CSharpType {
        [Switch]$IgnoreWarnings,
        [Switch]$PassThru,
        [Parameter(Mandatory = $true, ParameterSetName = "Module")][Object]$AnsibleModule,
-        [Parameter(ParameterSetName = "Manual")][String]$TempPath = $env:TMP,
+        [Parameter(ParameterSetName = "Manual")][String]$TempPath,
        [Parameter(ParameterSetName = "Manual")][Switch]$IncludeDebugInfo,
        [String[]]$CompileSymbols = @()
    )
@ -280,9 +280,11 @@ Function Add-CSharpType {
            $include_debug = $AnsibleModule.Verbosity -ge 3
        }
        else {
-            $temp_path = $TempPath
+            $temp_path = [System.IO.Path]::GetTempPath()
            $include_debug = $IncludeDebugInfo.IsPresent
        }
+        $temp_path = Join-Path -Path $temp_path -ChildPath ([Guid]::NewGuid().Guid)
+
        $compiler_options = [System.Collections.ArrayList]@("/optimize")
        if ($defined_symbols.Count -gt 0) {
            $compiler_options.Add("/define:" + ([String]::Join(";", $defined_symbols.ToArray()))) > $null
@ -304,8 +306,12 @@ Function Add-CSharpType {
        )

        # create a code snippet for each reference and check if we need
-        # to reference any extra assemblies
-        $ignore_warnings = [System.Collections.ArrayList]@()
+        # to reference any extra assemblies.
+        # CS1610 is a warning when csc.exe failed to delete temporary files.
+        # We use our own temp dir deletion mechanism so this doesn't become a
+        # fatal error.
+        # https://github.com/ansible-collections/ansible.windows/issues/598
+        $ignore_warnings = [System.Collections.ArrayList]@('1610')
        $compile_units = [System.Collections.Generic.List`1[System.CodeDom.CodeSnippetCompileUnit]]@()
        foreach ($reference in $References) {
            # scan through code and add any assemblies that match
@ -373,7 +379,26 @@ Function Add-CSharpType {
                }
            }

-            $compile = $provider.CompileAssemblyFromDom($compile_parameters, $compile_units)
+            $null = New-Item -Path $temp_path -ItemType Directory -Force
+            try {
+                $compile = $provider.CompileAssemblyFromDom($compile_parameters, $compile_units)
+            }
+            finally {
+                # Try to delete the temp path, if this fails and we are running
+                # with a module object write a warning instead of failing.
+                try {
+                    [System.IO.Directory]::Delete($temp_path, $true)
+                }
+                catch {
+                    $msg = "Failed to cleanup temporary directory '$temp_path' used for compiling C# code."
+                    if ($AnsibleModule) {
+                        $AnsibleModule.Warn("$msg Files may still be present after the task is complete. Error: $_")
+                    }
+                    else {
+                        throw "$msg Error: $_"
+                    }
+                }
+            }
        }
        finally {
            foreach ($kvp in $originalEnv.GetEnumerator()) {
--- a/lib/ansible/modules/debconf.py
+++ b/lib/ansible/modules/debconf.py
@ -173,8 +173,6 @@ def set_selection(module, pkg, question, vtype, value, unseen):
    if unseen:
        cmd.append('-u')

-    if vtype == 'boolean':
-        value = value.lower()
    data = ' '.join([pkg, question, vtype, value])

    return module.run_command(cmd, data=data)
@ -209,15 +207,17 @@ def main():
        if vtype is None or value is None:
            module.fail_json(msg="when supplying a question you must supply a valid vtype and value")

+        # ensure we compare booleans supplied to the way debconf sees them (true/false strings)
+        if vtype == 'boolean':
+            value = to_text(value).lower()
+
        # if question doesn't exist, value cannot match
        if question not in prev:
            changed = True
        else:
            existing = prev[question]

-            # ensure we compare booleans supplied to the way debconf sees them (true/false strings)
            if vtype == 'boolean':
-                value = to_text(value).lower()
                existing = to_text(prev[question]).lower()
            elif vtype == 'password':
                existing = get_password_value(module, pkg, question, vtype)
--- a/lib/ansible/modules/dnf.py
+++ b/lib/ansible/modules/dnf.py
@ -19,9 +19,15 @@ description:
 options:
  use_backend:
    description:
-      - By default, this module will select the backend based on the C(ansible_pkg_mgr) fact.
+      - Backend module to use.
    default: "auto"
-    choices: [ auto, yum, yum4, dnf4, dnf5 ]
+    choices:
+        auto: Automatically select the backend based on the C(ansible_facts.pkg_mgr) fact.
+        yum: Alias for V(auto) (see Notes)
+        dnf: M(ansible.builtin.dnf)
+        yum4: Alias for V(dnf)
+        dnf4: Alias for V(dnf)
+        dnf5: M(ansible.builtin.dnf5)
    type: str
    version_added: 2.15
  name:
@ -287,6 +293,11 @@ notes:
    upstream dnf's API doesn't properly mark groups as installed, therefore upon
    removal the module is unable to detect that the group is installed
    (https://bugzilla.redhat.com/show_bug.cgi?id=1620324)
+  - While O(use_backend=yum) and the ability to call the action plugin as
+    M(ansible.builtin.yum) are provided for syntax compatibility, the YUM
+    backend was removed in ansible-core 2.17 because the required libraries are
+    not available for any supported version of Python. If you rely on this
+    functionality, use an older version of Ansible.
 requirements:
  - "python >= 2.6"
  - python-dnf
@ -723,9 +734,14 @@ class DnfModule(YumDnf):
        self.module.exit_json(msg="", results=results)

    def _is_installed(self, pkg):
-        return bool(
-            dnf.subject.Subject(pkg).get_best_query(sack=self.base.sack).installed().run()
-        )
+        installed_query = dnf.subject.Subject(pkg).get_best_query(sack=self.base.sack).installed()
+        if dnf.util.is_glob_pattern(pkg):
+            available_query = dnf.subject.Subject(pkg).get_best_query(sack=self.base.sack).available()
+            return not (
+                {p.name for p in available_query} - {p.name for p in installed_query}
+            )
+        else:
+            return bool(installed_query)

    def _is_newer_version_installed(self, pkg_name):
        try:
@ -1336,7 +1352,7 @@ def main():
    #   list=repos
    #   list=pkgspec

-    yumdnf_argument_spec['argument_spec']['use_backend'] = dict(default='auto', choices=['auto', 'yum', 'yum4', 'dnf4', 'dnf5'])
+    yumdnf_argument_spec['argument_spec']['use_backend'] = dict(default='auto', choices=['auto', 'dnf', 'yum', 'yum4', 'dnf4', 'dnf5'])

    module = AnsibleModule(
        **yumdnf_argument_spec
--- a/lib/ansible/modules/dnf5.py
+++ b/lib/ansible/modules/dnf5.py
@ -357,10 +357,23 @@ libdnf5 = None

 def is_installed(base, spec):
    settings = libdnf5.base.ResolveSpecSettings()
-    query = libdnf5.rpm.PackageQuery(base)
-    query.filter_installed()
-    match, nevra = query.resolve_pkg_spec(spec, settings, True)
-    return match
+    installed_query = libdnf5.rpm.PackageQuery(base)
+    installed_query.filter_installed()
+    match, nevra = installed_query.resolve_pkg_spec(spec, settings, True)
+
+    # FIXME use `is_glob_pattern` function when available:
+    # https://github.com/rpm-software-management/dnf5/issues/1563
+    glob_patterns = set("*[?")
+    if any(set(char) & glob_patterns for char in spec):
+        available_query = libdnf5.rpm.PackageQuery(base)
+        available_query.filter_available()
+        available_query.resolve_pkg_spec(spec, settings, True)
+
+        return not (
+            {p.get_name() for p in available_query} - {p.get_name() for p in installed_query}
+        )
+    else:
+        return match


 def is_newer_version_installed(base, spec):
@ -504,7 +517,7 @@ class Dnf5Module(YumDnf):
            conf.config_file_path = self.conf_file

        try:
-            base.load_config_from_file()
+            base.load_config()
        except RuntimeError as e:
            self.module.fail_json(
                msg=str(e),
@ -544,7 +557,8 @@ class Dnf5Module(YumDnf):
        log_router = base.get_logger()
        global_logger = libdnf5.logger.GlobalLogger()
        global_logger.set(log_router.get(), libdnf5.logger.Logger.Level_DEBUG)
-        logger = libdnf5.logger.create_file_logger(base)
+        # FIXME hardcoding the filename does not seem right, should libdnf5 expose the default file name?
+        logger = libdnf5.logger.create_file_logger(base, "dnf5.log")
        log_router.add_logger(logger)

        if self.update_cache:
@ -569,7 +583,11 @@ class Dnf5Module(YumDnf):
            for repo in repo_query:
                repo.enable()

-        sack.update_and_load_enabled_repos(True)
+        try:
+            sack.load_repos()
+        except AttributeError:
+            # dnf5 < 5.2.0.0
+            sack.update_and_load_enabled_repos(True)

        if self.update_cache and not self.names and not self.list:
            self.module.exit_json(
@ -601,7 +619,11 @@ class Dnf5Module(YumDnf):
            self.module.exit_json(msg="", results=results, rc=0)

        settings = libdnf5.base.GoalJobSettings()
-        settings.group_with_name = True
+        try:
+            settings.set_group_with_name(True)
+        except AttributeError:
+            # dnf5 < 5.2.0.0
+            settings.group_with_name = True
        if self.bugfix or self.security:
            advisory_query = libdnf5.advisory.AdvisoryQuery(base)
            types = []
--- a/lib/ansible/modules/package_facts.py
+++ b/lib/ansible/modules/package_facts.py
@ -440,7 +440,7 @@ class APK(CLIMgr):

    def list_installed(self):
        rc, out, err = module.run_command([self._cli, 'info', '-v'])
-        if rc != 0 or err:
+        if rc != 0:
            raise Exception("Unable to list packages rc=%s : %s" % (rc, err))
        return out.splitlines()

--- a/lib/ansible/modules/replace.py
+++ b/lib/ansible/modules/replace.py
@ -140,7 +140,7 @@ EXAMPLES = r'''
  ansible.builtin.replace:
    path: /etc/hosts
    after: '(?m)^<VirtualHost [*]>'
-    before: '(?m)^</VirtualHost>'
+    before: '</VirtualHost>'
    regexp: '^(.+)$'
    replace: '# \1'

--- a/lib/ansible/modules/uri.py
+++ b/lib/ansible/modules/uri.py
@ -107,14 +107,15 @@ options:
    default: no
  follow_redirects:
    description:
-      - Whether or not the URI module should follow redirects. V(all) will follow all redirects.
-        V(safe) will follow only "safe" redirects, where "safe" means that the client is only
-        doing a GET or HEAD on the URI to which it is being redirected. V(none) will not follow
-        any redirects. Note that V(true) and V(false) choices are accepted for backwards compatibility,
-        where V(true) is the equivalent of V(all) and V(false) is the equivalent of V(safe). V(true) and V(false)
-        are deprecated and will be removed in some future version of Ansible.
+      - Whether or not the URI module should follow redirects.
+    choices:
+      all: Will follow all redirects.
+      none: Will not follow any redirects.
+      safe: Only redirects doing GET or HEAD requests will be followed.
+      urllib2: Defer to urllib2 behavior (As of writing this follows HTTP redirects).
+      'no': (DEPRECATED, will be removed in the future version) alias of V(none).
+      'yes': (DEPRECATED, will be removed in the future version) alias of V(all).
    type: str
-    choices: ['all', 'no', 'none', 'safe', 'urllib2', 'yes']
    default: safe
  creates:
    description:
--- a/lib/ansible/parsing/dataloader.py
+++ b/lib/ansible/parsing/dataloader.py
@ -329,11 +329,10 @@ class DataLoader:
                if (is_role or self._is_role(path)) and b_pb_base_dir.endswith(b'/tasks'):
                    search.append(os.path.join(os.path.dirname(b_pb_base_dir), b_dirname, b_source))
                    search.append(os.path.join(b_pb_base_dir, b_source))
-                else:
-                    # don't add dirname if user already is using it in source
-                    if b_source.split(b'/')[0] != dirname:
-                        search.append(os.path.join(b_upath, b_dirname, b_source))
-                    search.append(os.path.join(b_upath, b_source))
+                # don't add dirname if user already is using it in source
+                if b_source.split(b'/')[0] != dirname:
+                    search.append(os.path.join(b_upath, b_dirname, b_source))
+                search.append(os.path.join(b_upath, b_source))

            # always append basedir as last resort
            # don't add dirname if user already is using it in source
--- a/lib/ansible/parsing/mod_args.py
+++ b/lib/ansible/parsing/mod_args.py
@ -53,6 +53,17 @@ BUILTIN_TASKS = frozenset(add_internal_fqcns((
 )))


+def _get_action_context(action_or_module, collection_list):
+    module_context = module_loader.find_plugin_with_context(action_or_module, collection_list=collection_list)
+    if module_context and module_context.resolved and module_context.action_plugin:
+        action_or_module = module_context.action_plugin
+
+    context = action_loader.find_plugin_with_context(action_or_module, collection_list=collection_list)
+    if not context or not context.resolved:
+        context = module_context
+    return context
+
+
 class ModuleArgsParser:

    """
@ -291,6 +302,11 @@ class ModuleArgsParser:
            delegate_to = 'localhost'
            action, args = self._normalize_parameters(thing, action=action, additional_args=additional_args)

+        if action is not None and not skip_action_validation:
+            context = _get_action_context(action, self._collection_list)
+            if context is not None and context.resolved:
+                self.resolved_action = context.resolved_fqcn
+
        # module: <stuff> is the more new-style invocation

        # filter out task attributes so we're only querying unrecognized keys as actions/modules
@ -306,9 +322,7 @@ class ModuleArgsParser:
                is_action_candidate = True
            else:
                try:
-                    context = action_loader.find_plugin_with_context(item, collection_list=self._collection_list)
-                    if not context.resolved:
-                        context = module_loader.find_plugin_with_context(item, collection_list=self._collection_list)
+                    context = _get_action_context(item, self._collection_list)
                except AnsibleError as e:
                    if e.obj is None:
                        e.obj = self._task_ds
--- a/lib/ansible/parsing/yaml/dumper.py
+++ b/lib/ansible/parsing/yaml/dumper.py
@ -22,7 +22,7 @@ import yaml
 from ansible.module_utils.six import text_type, binary_type
 from ansible.module_utils.common.yaml import SafeDumper
 from ansible.parsing.yaml.objects import AnsibleUnicode, AnsibleSequence, AnsibleMapping, AnsibleVaultEncryptedUnicode
-from ansible.utils.unsafe_proxy import AnsibleUnsafeText, AnsibleUnsafeBytes, NativeJinjaUnsafeText, NativeJinjaText
+from ansible.utils.unsafe_proxy import AnsibleUnsafeText, AnsibleUnsafeBytes, NativeJinjaUnsafeText, NativeJinjaText, _is_unsafe
 from ansible.template import AnsibleUndefined
 from ansible.vars.hostvars import HostVars, HostVarsVars
 from ansible.vars.manager import VarsWithSources
@ -45,10 +45,14 @@ def represent_vault_encrypted_unicode(self, data):


 def represent_unicode(self, data):
+    if _is_unsafe(data):
+        data = data._strip_unsafe()
    return yaml.representer.SafeRepresenter.represent_str(self, text_type(data))


 def represent_binary(self, data):
+    if _is_unsafe(data):
+        data = data._strip_unsafe()
    return yaml.representer.SafeRepresenter.represent_binary(self, binary_type(data))


--- a/lib/ansible/playbook/base.py
+++ b/lib/ansible/playbook/base.py
@ -589,10 +589,11 @@ class FieldAttributeBase:
                _validate_variable_keys(ds)
                return combine_vars(self.vars, ds)
            elif isinstance(ds, list):
+                line_file = getattr(ds, 'ansible_pos', ("unknown", 0))
                display.deprecated(
                    (
                        'Specifying a list of dictionaries for vars is deprecated in favor of '
-                        'specifying a dictionary.'
+                        'specifying a dictionary. Error occurred in the file: %s, line: %d' % (line_file[0], line_file[1])
                    ),
                    version='2.18'
                )
--- a/lib/ansible/playbook/conditional.py
+++ b/lib/ansible/playbook/conditional.py
@ -19,7 +19,7 @@ from __future__ import annotations

 import typing as t

-from ansible.errors import AnsibleError, AnsibleUndefinedVariable
+from ansible.errors import AnsibleError, AnsibleUndefinedVariable, AnsibleTemplateError
 from ansible.module_utils.common.text.converters import to_native
 from ansible.playbook.attribute import FieldAttribute
 from ansible.template import Templar
@ -100,14 +100,14 @@ class Conditional:
                    return False

            # If the result of the first-pass template render (to resolve inline templates) is marked unsafe,
-            # explicitly disable lookups on the final pass to prevent evaluation of untrusted content in the
-            # constructed template.
-            disable_lookups = hasattr(conditional, '__UNSAFE__')
+            # explicitly fail since the next templating operation would never evaluate
+            if hasattr(conditional, '__UNSAFE__'):
+                raise AnsibleTemplateError('Conditional is marked as unsafe, and cannot be evaluated.')

            # NOTE The spaces around True and False are intentional to short-circuit literal_eval for
            #      jinja2_native=False and avoid its expensive calls.
            return templar.template(
                "{%% if %s %%} True {%% else %%} False {%% endif %%}" % conditional,
-                disable_lookups=disable_lookups).strip() == "True"
+            ).strip() == "True"
        except AnsibleUndefinedVariable as e:
            raise AnsibleUndefinedVariable("error while evaluating conditional (%s): %s" % (original, e))
--- a/lib/ansible/playbook/handler.py
+++ b/lib/ansible/playbook/handler.py
@ -37,6 +37,16 @@ class Handler(Task):
        ''' returns a human-readable representation of the handler '''
        return "HANDLER: %s" % self.get_name()

+    def _validate_listen(self, attr, name, value):
+        new_value = self.get_validated_value(name, attr, value, None)
+        if self._role is not None:
+            for listener in new_value.copy():
+                new_value.extend([
+                    f"{self._role.get_name(include_role_fqcn=True)} : {listener}",
+                    f"{self._role.get_name(include_role_fqcn=False)} : {listener}",
+                ])
+        setattr(self, name, new_value)
+
    @staticmethod
    def load(data, block=None, role=None, task_include=None, variable_manager=None, loader=None):
        t = Handler(block=block, role=role, task_include=task_include)
--- a/lib/ansible/playbook/task.py
+++ b/lib/ansible/playbook/task.py
@ -37,6 +37,7 @@ from ansible.playbook.taggable import Taggable
 from ansible.utils.collection_loader import AnsibleCollectionConfig
 from ansible.utils.display import Display
 from ansible.utils.sentinel import Sentinel
+from ansible.utils.vars import isidentifier

 __all__ = ['Task']

@ -208,6 +209,7 @@ class Task(Base, Conditional, Taggable, CollectionSearch, Notifiable, Delegatabl
            # But if it wasn't, we can add the yaml object now to get more detail
            raise AnsibleParserError(to_native(e), obj=ds, orig_exc=e)
        else:
+            # Set the resolved action plugin (or if it does not exist, module) for callbacks.
            self.resolved_action = args_parser.resolved_action

        # the command/shell/script modules used to support the `cmd` arg,
@ -273,6 +275,10 @@ class Task(Base, Conditional, Taggable, CollectionSearch, Notifiable, Delegatabl
        if not isinstance(value, list):
            setattr(self, name, [value])

+    def _validate_register(self, attr, name, value):
+        if value is not None and not isidentifier(value):
+            raise AnsibleParserError(f"Invalid variable name in 'register' specified: '{value}'")
+
    def post_validate(self, templar):
        '''
        Override of base class post_validate, to also do final validation on
@ -287,6 +293,30 @@ class Task(Base, Conditional, Taggable, CollectionSearch, Notifiable, Delegatabl

        super(Task, self).post_validate(templar)

+    def _post_validate_args(self, attr, value, templar):
+        # smuggle an untemplated copy of the task args for actions that need more control over the templating of their
+        # input (eg, debug's var/msg, assert's "that" conditional expressions)
+        self.untemplated_args = value
+
+        # now recursively template the args dict
+        args = templar.template(value)
+
+        # FIXME: could we just nuke this entirely and/or wrap it up in ModuleArgsParser or something?
+        if '_variable_params' in args:
+            variable_params = args.pop('_variable_params')
+            if isinstance(variable_params, dict):
+                if C.INJECT_FACTS_AS_VARS:
+                    display.warning("Using a variable for a task's 'args' is unsafe in some situations "
+                                    "(see https://docs.ansible.com/ansible/devel/reference_appendices/faq.html#argsplat-unsafe)")
+                variable_params.update(args)
+                args = variable_params
+            else:
+                # if we didn't get a dict, it means there's garbage remaining after k=v parsing, just give up
+                # see https://github.com/ansible/ansible/issues/79862
+                raise AnsibleError(f"invalid or malformed argument: '{variable_params}'")
+
+        return args
+
    def _post_validate_loop(self, attr, value, templar):
        '''
        Override post validation for the loop field, which is templated
--- a/lib/ansible/playbook/task_include.py
+++ b/lib/ansible/playbook/task_include.py
@ -74,7 +74,7 @@ class TaskInclude(Task):
        if not task.args.get('_raw_params'):
            task.args['_raw_params'] = task.args.pop('file', None)
            if not task.args['_raw_params']:
-                raise AnsibleParserError('No file specified for %s' % task.action)
+                raise AnsibleParserError('No file specified for %s' % task.action, obj=data)

        apply_attrs = task.args.get('apply', {})
        if apply_attrs and task.action not in C._ACTION_INCLUDE_TASKS:
--- a/lib/ansible/plugins/init.py
+++ b/lib/ansible/plugins/init.py
@ -50,16 +50,23 @@ def get_plugin_class(obj):

 class AnsiblePlugin(ABC):

-    # allow extra passthrough parameters
-    allow_extras = False
-
    # Set by plugin loader
    _load_name: str

+    # allow extra passthrough parameters
+    allow_extras: bool = False
+    _extras_prefix: str | None = None
+
    def __init__(self):
        self._options = {}
        self._defs = None

+    @property
+    def extras_prefix(self):
+        if not self._extras_prefix:
+            self._extras_prefix = self._load_name.split('.')[-1]
+        return self._extras_prefix
+
    def matches_name(self, possible_names):
        possible_fqcns = set()
        for name in possible_names:
--- a/lib/ansible/plugins/action/assert.py
+++ b/lib/ansible/plugins/action/assert.py
@ -63,8 +63,29 @@ class ActionModule(ActionBase):

        quiet = boolean(self._task.args.get('quiet', False), strict=False)

+        # directly access 'that' via untemplated args from the task so we can intelligently trust embedded
+        # templates and preserve the original inputs/locations for better messaging on assert failures and
+        # errors.
+        # FIXME: even in devel, things like `that: item` don't always work properly (truthy string value
+        # is not really an embedded expression)
+        # we could fix that by doing direct var lookups on the inputs
+        # FIXME: some form of this code should probably be shared between debug, assert, and
+        # Task.post_validate, since they
+        # have a lot of overlapping needs
+        try:
+            thats = self._task.untemplated_args['that']
+        except KeyError:
+            # in the case of "we got our entire args dict from a template", we can just consult the
+            # post-templated dict (the damage has likely already been done for embedded templates anyway)
+            thats = self._task.args['that']
+
+        # FIXME: this is a case where we only want to resolve indirections, NOT recurse containers
+        # (and even then, the leaf-most expression being wrapped is at least suboptimal
+        # (since its expression will be "eaten").
+        if isinstance(thats, str):
+            thats = self._templar.template(thats)
+
        # make sure the 'that' items are a list
-        thats = self._task.args['that']
        if not isinstance(thats, list):
            thats = [thats]

--- a/lib/ansible/plugins/action/fetch.py
+++ b/lib/ansible/plugins/action/fetch.py
@ -149,6 +149,10 @@ class ActionModule(ActionBase):
                    # destination filename
                    base = os.path.basename(source_local)
                    dest = os.path.join(dest, base)
+
+                    if os.path.isdir(to_bytes(dest, errors='surrogate_or_strict')):
+                        raise AnsibleActionFail(
+                            f"calculated dest '{dest}' is an existing directory, use another path that does not point to an existing directory")
                if not dest.startswith("/"):
                    # if dest does not start with "/", we'll assume a relative path
                    dest = self._loader.path_dwim(dest)
--- a/lib/ansible/plugins/callback/init.py
+++ b/lib/ansible/plugins/callback/init.py
@ -36,7 +36,7 @@ from ansible.parsing.yaml.objects import AnsibleUnicode
 from ansible.plugins import AnsiblePlugin
 from ansible.utils.color import stringc
 from ansible.utils.display import Display
-from ansible.utils.unsafe_proxy import AnsibleUnsafeText, NativeJinjaUnsafeText
+from ansible.utils.unsafe_proxy import AnsibleUnsafeText, NativeJinjaUnsafeText, _is_unsafe
 from ansible.vars.clean import strip_internal_keys, module_response_deepcopy

 import yaml
@ -111,6 +111,8 @@ def _munge_data_for_lossy_yaml(scalar):

 def _pretty_represent_str(self, data):
    """Uses block style for multi-line strings"""
+    if _is_unsafe(data):
+        data = data._strip_unsafe()
    data = text_type(data)
    if _should_use_block(data):
        style = '|'
--- a/lib/ansible/plugins/connection/psrp.py
+++ b/lib/ansible/plugins/connection/psrp.py
@ -13,7 +13,7 @@ description:
  underlying transport but instead runs in a PowerShell interpreter.
 version_added: "2.7"
 requirements:
- pypsrp>=0.4.0 (Python library)
+- pypsrp>=0.4.0, <1.0.0 (Python library)
 extends_documentation_fragment:
    - connection_pipelining
 options:
@ -632,39 +632,41 @@ end {
        buffer_size = max_b64_size - (max_b64_size % 1024)

        # setup the file stream with read only mode
-        setup_script = '''$ErrorActionPreference = "Stop"
-$path = '%s'
+        setup_script = '''param([string]$Path)
+$ErrorActionPreference = "Stop"

-if (Test-Path -Path $path -PathType Leaf) {
+if (Test-Path -LiteralPath $path -PathType Leaf) {
    $fs = New-Object -TypeName System.IO.FileStream -ArgumentList @(
        $path,
        [System.IO.FileMode]::Open,
        [System.IO.FileAccess]::Read,
        [System.IO.FileShare]::Read
    )
-    $buffer_size = %d
 } elseif (Test-Path -Path $path -PathType Container) {
    Write-Output -InputObject "[DIR]"
 } else {
    Write-Error -Message "$path does not exist"
    $host.SetShouldExit(1)
-}''' % (self._shell._escape(in_path), buffer_size)
+}'''

        # read the file stream at the offset and return the b64 string
-        read_script = '''$ErrorActionPreference = "Stop"
-$fs.Seek(%d, [System.IO.SeekOrigin]::Begin) > $null
-$buffer = New-Object -TypeName byte[] -ArgumentList $buffer_size
-$bytes_read = $fs.Read($buffer, 0, $buffer_size)
+        read_script = '''param([int64]$Offset, [int]$BufferSize)
+$ErrorActionPreference = "Stop"
+$fs.Seek($Offset, [System.IO.SeekOrigin]::Begin) > $null
+$buffer = New-Object -TypeName byte[] -ArgumentList $BufferSize
+$read = $fs.Read($buffer, 0, $buffer.Length)

-if ($bytes_read -gt 0) {
-    $bytes = $buffer[0..($bytes_read - 1)]
-    Write-Output -InputObject ([System.Convert]::ToBase64String($bytes))
+if ($read -gt 0) {
+    [System.Convert]::ToBase64String($buffer, 0, $read)
 }'''

        # need to run the setup script outside of the local scope so the
        # file stream stays active between fetch operations
-        rc, stdout, stderr = self._exec_psrp_script(setup_script,
-                                                    use_local_scope=False)
+        rc, stdout, stderr = self._exec_psrp_script(
+            setup_script,
+            use_local_scope=False,
+            arguments=[in_path],
+        )
        if rc != 0:
            raise AnsibleError("failed to setup file stream for fetch '%s': %s"
                               % (out_path, to_native(stderr)))
@ -679,7 +681,10 @@ if ($bytes_read -gt 0) {
            while True:
                display.vvvvv("PSRP FETCH %s to %s (offset=%d" %
                              (in_path, out_path, offset), host=self._psrp_host)
-                rc, stdout, stderr = self._exec_psrp_script(read_script % offset)
+                rc, stdout, stderr = self._exec_psrp_script(
+                    read_script,
+                    arguments=[offset, buffer_size],
+                )
                if rc != 0:
                    raise AnsibleError("failed to transfer file to '%s': %s"
                                       % (out_path, to_native(stderr)))
@ -813,7 +818,7 @@ if ($bytes_read -gt 0) {
        script: str,
        input_data: bytes | str | t.Iterable | None = None,
        use_local_scope: bool = True,
-        arguments: t.Iterable[str] | None = None,
+        arguments: t.Iterable[t.Any] | None = None,
    ) -> tuple[int, bytes, bytes]:
        # Check if there's a command on the current pipeline that still needs to be closed.
        if self._last_pipeline:
--- a/lib/ansible/plugins/connection/ssh.py
+++ b/lib/ansible/plugins/connection/ssh.py
@ -1250,7 +1250,7 @@ class Connection(ConnectionBase):
                if sftp_action == 'get':
                    # we pass sudoable=False to disable pty allocation, which
                    # would end up mixing stdout/stderr and screwing with newlines
-                    (returncode, stdout, stderr) = self.exec_command('dd if=%s bs=%s' % (in_path, BUFSIZE), sudoable=False)
+                    (returncode, stdout, stderr) = self.exec_command('dd if=%s bs=%s' % (self._shell.quote(in_path), BUFSIZE), sudoable=False)
                    with open(to_bytes(out_path, errors='surrogate_or_strict'), 'wb+') as out_file:
                        out_file.write(stdout)
                else:
--- a/Show More
+++ b/Show More