Release Date: December 15, 2025.

## Component Updates

### Test Kitchen

- Updated Test Kitchen to v3.9.1.

### Knife

- Updated Knife from v18.8.13 to v18.8.68 to address code scanning alerts.

### chef-cli

- Updated chef-cli from v5.6.21 to v5.6.23 to to address code scanning alerts

## Security

- Updated cURL from v8.14.1 to v8.16.0 to resolve the following CVE:

  - [CVE-2025-10148](https://curl.se/docs/CVE-2025-10148.html)

- Updated OpenSSL from v3.2.4 to v3.2.6 to resolve the following CVE:

  - [CVE-2025-9230](https://openssl-library.org/news/vulnerabilities/#CVE-2025-9230)
  - [CVE-2025-9231](https://openssl-library.org/news/vulnerabilities/#CVE-2025-9231)
  - [CVE-2025-9232](https://openssl-library.org/news/vulnerabilities/#CVE-2025-9232)

- Updated libxml2 from v2.13.8 to v2.14.4 to resolve the following CVE:

  - [CVE-2025-6021](https://www.cvedetails.com/cve/CVE-2025-6021/)

- Updated git-windows from v2.47.0 to v2.48.1 to resolve the following CVE:

  - [CVE-2025-0725](https://curl.se/docs/CVE-2025-0725.html)

- Updated REXML to v3.4.4 to address [CVE-2025-58767](https://github.com/advisories/GHSA-c2f4-jgmc-q2r5)
- Updated google-protobuf to v3.25.5 to address [CVE-2024-7254](https://github.com/advisories/GHSA-735f-pc8j-v9w8)
- Updated rack to v3.2.4 to address [CVE-2025-61919](https://github.com/rack/rack/security/advisories/GHSA-6xw4-3v39-52mm)
- Updated net-imap to v0.2.5 to address [CVE-2025-43857](https://github.com/advisories/GHSA-j3g3-5qv5-52mj)
- Updated resolv to v0.2.3 to address [CVE-2025-24294](https://github.com/advisories/GHSA-xh69-987w-hrp8)
- Updated golang.org/x/text (
[Go](https://github.com/advisories?query=ecosystem%3Ago)
) to v 0.3.8 to address [CVE-2022-32149](https://github.com/advisories/GHSA-69ch-w2m2-3vjp)
- Updated [golang.org/spf13/cobra](https://github.com/spf13/cobra) from v1.10.1 to v1.10.2.
- Updated [golang.org/x/sys](https://github.com/golang/sys) from v0.28.0 to v0.38.0.
- Updated the chef-zero Ruby gem to v15.0.26.
- Updated the activesupport Ruby gem to v7.0.10.
- Updated the kitchen-vagrant Ruby gem to v2.2.0.
- Updated the license_scout Ruby gem to 1.4.1.
- Updated the uri Ruby gem to 1.0.4.

## Bug Fixes

- Updated Test Kitchen to v3.9.1 to resolve a Windows convergence issue introduced in v3.9.0. The issue prevented Chef configuration files (client.rb, dna.json, and cookbooks) from being detected on the guest system.

## Packaging

We no longer build packages for:

- macOS 12 x86-64
- macOS 12 ARM64