Shipped · DevOps and infrastructure

What chef/chef shipped

The public repository of Chef · github.com/chef/chef

Written by FoxPlug from the repository's own releases; not affiliated with Chef. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/chef/chef; Chef did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.

Get a weekly update like this for your product, free

Or Use it as a GitHub Action

See the update FoxPlug writes for chef, free

Week of November 2, 2026

What shipped

Why it matters

Users on current and future macOS GitHub images keep working CI coverage now that the macOS 14 runners are retired, and Debian 12 testing builds Ruby directly on the official image. Solaris Target Mode users get a fix for user_ulimit shell-quoting failures, Chef360 users with spaces in their OrgName can use Knife and Chef push again, and authenticator log noise is reduced. Kitchen builds also get the license key they need to run.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Shipped this week: macOS 14 runners replaced with macos-15 and macos-latest coverage, Debian tests on the official debian:12 image, a Solaris user_ulimit Target Mode fix, less authenticator log noise, fixes for Chef360 OrgNames with spaces, and a chef_license_key fix for Kitchen

Post for LinkedIn

Changes in the Chef repository this week: the retired macOS 14 runners were removed and affected CI matrices now cover macos-15 and macos-latest. Debian unit, component and functional jobs run on the official debian:12 image for x86_64 and ARM64, installing their own build dependencies. The user_ulimit resource no longer hits a shell syntax error on Solaris in Target Mode, and debug output from the authenticator was removed to cut repeated log noise. Knife and Chef push commands now handle Chef360 OrgNames containing spaces, and Kitchen build tests pass the chef_license_key so Chef-18 builds no longer fail on missing license errors.

Week of October 26, 2026

What shipped

Why it matters

This week brought fixes across the client runtime, including quieter authenticator output and a systemd timer that now honors the user property, plus Solaris target mode corrections for the timezone and user_ulimit resources. CI also needed adjustments as ubuntu-latest moved to newer images, which affected the kitchen and cookstyle jobs.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

This week: quieter authenticator logging, chef_client_systemd_timer now writes User= when set, Solaris target mode fixes for timezone and user_ulimit, a dsc_resource sensitive crash fix, and CI updates for newer Ubuntu images. Releases v19.4.49 through v19.4.52 tagged.

Post for LinkedIn

This week's Chef changes include removing noisy authenticator logging that filled screen and log output with no key detected entries, and fixing chef_client_systemd_timer so the user property is written as User= in the service unit. Solaris target mode got corrections: the timezone resource no longer reports success while doing nothing, and user_ulimit no longer hard-fails on a Linux-PAM limits file. Setting sensitive true on a dsc_resource no longer crashes at the end of convergence. On CI, Hab environment variables are preserved explicitly in the x86_64 kitchen job, license config was backported to chef-18, and the cookstyle job is pinned to ubuntu-24.04. Releases v19.4.49 through v19.4.52 were tagged.

Week of October 12, 2026

What shipped

Why it matters

This week brings a startup and repeated-run fix for Windows users who install the Chef Infra Client through the migration tool and MSI, plus a cleanup that puts the archive DLL locator in the resource helpers namespace. It also tightens dependency change rules in pull requests and switches spellchecking to typos, which reduces the dictionary maintenance the repository carries.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

V19.4.46 is tagged. Archive DLL loading on Windows is fixed for migration tool plus MSI installs. ArchiveDllLocator moved to resource helpers. Spellchecking now uses typos instead of cspell. Gemfile.lock changes require conservative bundle updates with the command and diff in the

Post for LinkedIn

Chef v19.4.46 is released. This week fixes archive DLL loading on Windows, where the Chef Infra Client installed via the migration tool plus MSI failed at startup and on later runs; ArchiveDllLocator also moved from Chef::Resource to Chef::ResourceHelpers and is required from archive_file. Spellchecking now uses typos instead of cspell, replacing the dictionary-based allowlist. Pull requests that change Gemfile.lock must use conservative bundle updates and include the exact command, its output and the resulting diff. The NOTICE file version was corrected for the release.

Week of October 5, 2026

What shipped

Why it matters

This week brought four version tags, from 19.4.42 through 19.4.45, so users tracking the release line have a steady set of updates to move onto. One update matters directly for anyone using the winrm file system: Rubyzip is pulled through chef-winrm-fs, and the old 2.4.1 version was subject to a CVE, so bumping to 3.7.0 and chef-winrm-fs 1.4.4 removes that dependency. The other changes are smaller maintenance work, a Notice file refresh for 19.4.43 and a property option change that skips a repeated symbolization step when properties are defined.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

This week: Rubyzip bumped to 3.7.0 and chef-winrm-fs to 1.4.4 to drop a CVE-flagged transitive dependency, Notice file updated for 19.4.43, property options symbolized once instead of twice, workflow approval gate expanded, and tags v19.4.42 through v19.4.45 cut.

Post for LinkedIn

This week in Chef: Rubyzip was bumped to 3.7.0 and chef-winrm-fs to 1.4.4, removing a transitive Rubyzip 2.4.1 dependency that a Grype scan flagged for a CVE. The Notice file was updated for Chef 19.4.43, including manual entries for chef-winrm-fs and gems that came back unmatched in a Blackduck scan. Property option hashes are now symbolized once instead of twice, avoiding a duplicate inject pass whenever a property is defined. The approval gate for pull_request_target workflows was expanded so any.expeditor/ change needs manual approval, and the step-security/harden-runner steps were reverted. Version tags v19.4.42 through v19.4.45 were created.

Week of September 28, 2026

What shipped

Why it matters

This week includes three patch releases across the 19.4 and 18.11 release lines, addressing macOS CI failures in Homebrew integration and fixing a crash when dsc_resource uses sensitive mode. Infrastructure updates ensure compatibility with Ubuntu 24.04 in the build pipeline.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Chef 19.4.41, 18.11.26, and 18.11.25 are out. Updates include macOS Homebrew CI fixes, dsc_resource sensitive mode crash resolution, and Ubuntu 24.04 compatibility.

Post for LinkedIn

Chef released three patch versions this week: 19.4.41, 18.11.26, and 18.11.25. Updates address macOS Homebrew integration issues, fix a crash when dsc_resource uses sensitive true, and ensure build pipeline compatibility with Ubuntu 24.04.

Week of September 21, 2026

What shipped

Why it matters

This week includes fixes for Solaris target support and flaky tests that improve reliability for users running Chef in different environments. Security-related dependency updates for OpenSSL ensure Chef stays current with critical fixes.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Chef 19.4 releases this week include Solaris mount provider Target Mode support, fixes for flaky snap package tests, and OpenSSL 3.5.8 updates.

Post for LinkedIn

Chef releases this week bring Solaris mount provider support for Target Mode, resolving errors when managing mount resources on Solaris targets. We also fixed flaky Kitchen tests for snap packages and updated OpenSSL dependencies to address recent CVEs. These changes improve reliability for Chef users across different platforms and security posture.

Week of September 14, 2026

What shipped

Why it matters

Multiple bug fixes improve stability across Target Mode operations, package management, and resource state handling. Critical security fix prevents sensitive data leakage in logs. Infrastructure updates ensure CI reliability and maintainability.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Chef 19.4.36 and 18.11.24 ship this week with fixes for sensitive property logging, Target Mode tmp directories, and Homebrew tap trust.

Post for LinkedIn

New releases of Chef (19.4.36, 18.11.24) include important fixes: sensitive properties no longer leak to logs on validation failure, Target Mode correctly resolves remote tmp directories for privileged operations, and homebrew_tap works with Homebrew's Tap Trust enforcement. Additional fixes improve group provider state handling and homebrew_package timeout support.

Weeks with too little public activity are left out rather than filled in. Last updated 2026-11-10.

Is this your repo? Ask us to remove this page.