Ansible 2.21.3

Remember when Ansible was a single ansible package you installed with pip and a folder of YAML files that "just worked"? Those days are long gone — and that's a good thing. The 2.21 line, codenamed "The Rain Song," has become a well-oiled machine of monthly patches, and v2.21.3, released August 10, 2026, is the latest proof.

The Trajectory

What began in 2026 as the 2.21 feature release (May 18) quickly turned into a maintenance rhythm: 2.21.1 in June brought a serious security fix for ansible-galaxy install (CVE-2026-11332, a git configuration injection in role dependencies), 2.21.2 in July cleaned up parallel fact gathering and bcrypt handling, and now 2.21.3 lands a focused set of bugfixes with zero breaking changes.

That cadence — a new patch roughly every month, each one smaller than the last — is the sign of a mature codebase. The team isn't chasing features anymore; they're polishing the engine.

What's in 2.21.3

• ansible-galaxy — fixed a failure mode where a short response from a collection server caused a mismatched artifact hash error on the first download attempt, instead of simply retrying the download.
• ansible-test — target filtering now preserves user-specified versions that aren't in the completion configuration.
• Collection loader — pkgutil.iter_modules now correctly returns Python modules when a package inside a collection path contains compiled extension modules.
• powershell exec_wrapper — when multiple pwsh executables match, the first result is now selected deterministically instead of failing.
• rpm_key — PGP armor data gets a trailing newline before being handed to librpm, fixing parse failures on systems where pgpParsePkts requires it.
• Callbacks — the tree and oneline callbacks now expose deprecation status in their DOCUMENTATION.

Looking Back, Looking Ahead

Seven years ago, running Ansible meant vendoring a pile of roles from Galaxy and hoping for the best. Today, "The Rain Song" ships with a porting guide, per-release changelogs, and a security response that actually lands fixes. The 2.21 line will keep getting patches through its support window, and 2.22 is already on the horizon.

If you're on any 2.21.x release, the upgrade to 2.21.3 is a no-brainer: pip install ansible-core==2.21.3 and re-run your playbooks. Nothing else to it.