The versions pinned in your Ansible requirements.yml go stale and bumping them by hand never happens on time. Renovate's built-in Ansible manager reads requirements.yml, watches your collections and roles, and opens one PR per update so CI checks each bump before you merge. Small to set up, with one git-tag-prefix trap to avoid.
tag: #ansible
3 posts
When CVE-2026-31431 dropped on April 29 with a public proof-of-concept and no vendor patches available, every Linux machine in the homelab was affected. Two weeks later the OpenSSH GSSAPIKeyExchange flaw shipped as DSA-6204-1 and the question arose again. This post is the short writeup of how Ansible turned both incidents into routine work.
A brief summary of what this post is about.