Release 4.2.0 (#10394)

2026-05-28 04:34:11 -04:00 · 2025-08-05 12:32:36 -07:00 · 2025-08-05 12:32:36 -07:00 · f55ea6e70f
commit f55ea6e70f
parent e9cf7e8a9b ffb2196e21
30 changed files with 63 additions and 30 deletions
--- a/acme/docs/jws-help.txt
+++ b/acme/docs/jws-help.txt
@ -3,6 +3,6 @@ usage: jws [-h] [--compact] {sign,verify} ...
 positional arguments:
  {sign,verify}

-optional arguments:
+options:
  -h, --help     show this help message and exit
  --compact
--- a/acme/setup.py
+++ b/acme/setup.py
@ -1,7 +1,7 @@
 from setuptools import find_packages
 from setuptools import setup

-version = '4.2.0.dev0'
+version = '5.0.0.dev0'

 install_requires = [
    'cryptography>=43.0.0',
--- a/certbot-apache/setup.py
+++ b/certbot-apache/setup.py
@ -1,7 +1,7 @@
 from setuptools import find_packages
 from setuptools import setup

-version = '4.2.0.dev0'
+version = '5.0.0.dev0'

 install_requires = [
    # We specify the minimum acme and certbot version as the current plugin
--- a/certbot-compatibility-test/setup.py
+++ b/certbot-compatibility-test/setup.py
@ -1,7 +1,7 @@
 from setuptools import find_packages
 from setuptools import setup

-version = '4.2.0.dev0'
+version = '5.0.0.dev0'

 install_requires = [
    'certbot',
--- a/certbot-dns-cloudflare/setup.py
+++ b/certbot-dns-cloudflare/setup.py
@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup

-version = '4.2.0.dev0'
+version = '5.0.0.dev0'

 install_requires = [
    # for now, do not upgrade to cloudflare>=2.20 to avoid deprecation warnings and the breaking
--- a/certbot-dns-digitalocean/setup.py
+++ b/certbot-dns-digitalocean/setup.py
@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup

-version = '4.2.0.dev0'
+version = '5.0.0.dev0'

 install_requires = [
    'python-digitalocean>=1.11', # 1.15.0 or newer is recommended for TTL support
--- a/certbot-dns-dnsimple/setup.py
+++ b/certbot-dns-dnsimple/setup.py
@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup

-version = '4.2.0.dev0'
+version = '5.0.0.dev0'

 install_requires = [
    # This version of lexicon is required to address the problem described in
--- a/certbot-dns-dnsmadeeasy/setup.py
+++ b/certbot-dns-dnsmadeeasy/setup.py
@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup

-version = '4.2.0.dev0'
+version = '5.0.0.dev0'

 install_requires = [
    'dns-lexicon>=3.14.1',
--- a/certbot-dns-gehirn/setup.py
+++ b/certbot-dns-gehirn/setup.py
@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup

-version = '4.2.0.dev0'
+version = '5.0.0.dev0'

 install_requires = [
    'dns-lexicon>=3.14.1',
--- a/certbot-dns-google/setup.py
+++ b/certbot-dns-google/setup.py
@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup

-version = '4.2.0.dev0'
+version = '5.0.0.dev0'

 install_requires = [
    'google-api-python-client>=1.6.5',
--- a/certbot-dns-linode/setup.py
+++ b/certbot-dns-linode/setup.py
@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup

-version = '4.2.0.dev0'
+version = '5.0.0.dev0'

 install_requires = [
    'dns-lexicon>=3.14.1',
--- a/certbot-dns-luadns/setup.py
+++ b/certbot-dns-luadns/setup.py
@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup

-version = '4.2.0.dev0'
+version = '5.0.0.dev0'

 install_requires = [
    'dns-lexicon>=3.14.1',
--- a/certbot-dns-nsone/setup.py
+++ b/certbot-dns-nsone/setup.py
@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup

-version = '4.2.0.dev0'
+version = '5.0.0.dev0'

 install_requires = [
    'dns-lexicon>=3.14.1',
--- a/certbot-dns-ovh/setup.py
+++ b/certbot-dns-ovh/setup.py
@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup

-version = '4.2.0.dev0'
+version = '5.0.0.dev0'

 install_requires = [
    'dns-lexicon>=3.15.1',
--- a/certbot-dns-rfc2136/setup.py
+++ b/certbot-dns-rfc2136/setup.py
@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup

-version = '4.2.0.dev0'
+version = '5.0.0.dev0'

 install_requires = [
    # This version was chosen because it is the version packaged in RHEL 9 and Debian unstable. It
--- a/certbot-dns-route53/setup.py
+++ b/certbot-dns-route53/setup.py
@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup

-version = '4.2.0.dev0'
+version = '5.0.0.dev0'

 install_requires = [
    'boto3>=1.15.15',
--- a/certbot-dns-sakuracloud/setup.py
+++ b/certbot-dns-sakuracloud/setup.py
@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup

-version = '4.2.0.dev0'
+version = '5.0.0.dev0'

 install_requires = [
    'dns-lexicon>=3.14.1',
--- a/certbot-nginx/setup.py
+++ b/certbot-nginx/setup.py
@ -1,7 +1,7 @@
 from setuptools import find_packages
 from setuptools import setup

-version = '4.2.0.dev0'
+version = '5.0.0.dev0'

 install_requires = [
    # We specify the minimum acme and certbot version as the current plugin
--- a/certbot/CHANGELOG.md
+++ b/certbot/CHANGELOG.md
@ -3,6 +3,45 @@
 Certbot adheres to [Semantic Versioning](https://semver.org/).

 <!-- towncrier release notes start -->
+
+## 4.2.0 - 2025-08-05
+
+### Added
+
+- Added `--eab-hmac-alg` parameter to support custom HMAC algorithm for
+  External Account Binding.
+  ([#10281](https://github.com/certbot/certbot/issues/10281))
+
+### Changed
+
+- Catches and ignores errors during the directory fetch for ARI checking so
+  that these errors do not hinder the actual certificate issuance.
+  ([#10342](https://github.com/certbot/certbot/issues/10342))
+- Removed the dependency on `pytz`.
+  ([#10350](https://github.com/certbot/certbot/issues/10350))
+- Deprecated `acme.crypto_util.probe_sni`
+  ([#10386](https://github.com/certbot/certbot/issues/10386))
+- Support for Python 3.9 was deprecated and will be removed in our next planned
+  release. ([#10390](https://github.com/certbot/certbot/issues/10390))
+
+### Fixed
+
+- The Certbot snap no longer sets the environment variable PYTHONPATH stopping
+  it from picking up Python files in the current directory and polluting the
+  environment for Certbot hooks written in Python.
+  ([#10176](https://github.com/certbot/certbot/issues/10176),
+  [#10257](https://github.com/certbot/certbot/issues/10257))
+- Previously, we claimed to set FAILED_DOMAINS and RENEWED_DOMAINS env
+  variables for use by post-hooks when certificate renewals fail, but we were
+  not actually setting them. Now, we are.
+  ([#10259](https://github.com/certbot/certbot/issues/10259))
+- Certbot now always uses the server value from the renewal configuration file
+  for ARI checks instead of the server value from the current invocation of
+  Certbot. This helps prevent ARI requests from going to the wrong server if
+  the user changes CAs.
+  ([#10339](https://github.com/certbot/certbot/issues/10339))
+
+
 ## 4.1.1 - 2025-06-12

 ### Fixed
--- a/certbot/docs/cli-help.txt
+++ b/certbot/docs/cli-help.txt
@ -36,7 +36,7 @@ manage your account:
  --agree-tos       Agree to the ACME server's Subscriber Agreement
   -m EMAIL         Email address for important account notifications

-optional arguments:
+options:
  -h, --help            show this help message and exit
  -c CONFIG_FILE, --config CONFIG_FILE
                        path to config file (default: /etc/letsencrypt/cli.ini
@ -72,6 +72,9 @@ optional arguments:
                        None)
  --eab-hmac-key EAB_HMAC_KEY
                        HMAC key for External Account Binding (default: None)
+  --eab-hmac-alg EAB_HMAC_ALG
+                        HMAC algorithm for External Account Binding (default:
+                        HS256)
  --cert-name CERTNAME  Certificate name to apply. This name is used by
                        Certbot for housekeeping and in file paths; it doesn't
                        affect the content of the certificate itself.
@ -139,7 +142,7 @@ optional arguments:
                        case, and to know when to deprecate support for past
                        Python versions and flags. If you wish to hide this
                        information from the Let's Encrypt server, set this to
-                        "". (default: CertbotACMEClient/4.1.1 (certbot;
+                        "". (default: CertbotACMEClient/4.2.0 (certbot;
                        OS_NAME OS_VERSION) Authenticator/XXX Installer/YYY
                        (SUBCOMMAND; flags: FLAGS) Py/major.minor.patchlevel).
                        The flags encoded in the user agent are: --duplicate,
--- a/certbot/src/certbot/init.py
+++ b/certbot/src/certbot/init.py
@ -3,7 +3,7 @@ import sys
 import warnings

 # version number like 1.2.3a0, must have at least 2 parts, like 1.2
-__version__ = '4.2.0.dev0'
+__version__ = '5.0.0.dev0'


 if sys.version_info[:2] == (3, 9):
--- a/newsfragments/10176.fixed
+++ b/newsfragments/10176.fixed
@ -1 +0,0 @@
-The Certbot snap no longer sets the environment variable PYTHONPATH stopping it from picking up Python files in the current directory and polluting the environment for Certbot hooks written in Python.
--- a/newsfragments/10257.fixed
+++ b/newsfragments/10257.fixed
@ -1 +0,0 @@
-The Certbot snap no longer sets the environment variable PYTHONPATH stopping it from picking up Python files in the current directory and polluting the environment for Certbot hooks written in Python.
--- a/newsfragments/10259.fixed
+++ b/newsfragments/10259.fixed
@ -1 +0,0 @@
-Previously, we claimed to set FAILED_DOMAINS and RENEWED_DOMAINS env variables for use by post-hooks when certificate renewals fail, but we were not actually setting them. Now, we are.
--- a/newsfragments/10281.added
+++ b/newsfragments/10281.added
@ -1 +0,0 @@
-Added `--eab-hmac-alg` parameter to support custom HMAC algorithm for External Account Binding.
--- a/newsfragments/10339.fixed
+++ b/newsfragments/10339.fixed
@ -1 +0,0 @@
-Certbot now always uses the server value from the renewal configuration file for ARI checks instead of the server value from the current invocation of Certbot. This helps prevent ARI requests from going to the wrong server if the user changes CAs.
--- a/newsfragments/10342.changed
+++ b/newsfragments/10342.changed
@ -1 +0,0 @@
-Catches and ignores errors during the directory fetch for ARI checking so that these errors do not hinder the actual certificate issuance.
--- a/newsfragments/10350.changed
+++ b/newsfragments/10350.changed
@ -1 +0,0 @@
-Removed the dependency on `pytz`.
--- a/newsfragments/10386.changed
+++ b/newsfragments/10386.changed
@ -1 +0,0 @@
-Deprecated `acme.crypto_util.probe_sni`
--- a/newsfragments/10390.changed
+++ b/newsfragments/10390.changed
@ -1 +0,0 @@
-Support for Python 3.9 was deprecated and will be removed in our next planned release.
				`@ -1 +0,0 @@`
				`The Certbot snap no longer sets the environment variable PYTHONPATH stopping it from picking up Python files in the current directory and polluting the environment for Certbot hooks written in Python.`
				`@ -1 +0,0 @@`
				`Previously, we claimed to set FAILED_DOMAINS and RENEWED_DOMAINS env variables for use by post-hooks when certificate renewals fail, but we were not actually setting them. Now, we are.`
				`@ -1 +0,0 @@`
				Added `--eab-hmac-alg` parameter to support custom HMAC algorithm for External Account Binding.
				`@ -1 +0,0 @@`
				`Certbot now always uses the server value from the renewal configuration file for ARI checks instead of the server value from the current invocation of Certbot. This helps prevent ARI requests from going to the wrong server if the user changes CAs.`
				`@ -1 +0,0 @@`
				`Catches and ignores errors during the directory fetch for ARI checking so that these errors do not hinder the actual certificate issuance.`
				`@ -1 +0,0 @@`
				`Support for Python 3.9 was deprecated and will be removed in our next planned release.`