New release v2.18.18rc1 (#87098)

changelogs/CHANGELOG-v2.18.rst

@@ -4,6 +4,20 @@ ansible-core 2.18 "Fool in the Rain" Release Notes
 
 .. contents:: Topics
 
+v2.18.18rc1
+===========
+
+Release Summary
+---------------
+
+| Release Date: 2026-06-11
+| `Porting Guide <https://docs.ansible.com/ansible-core/2.18/porting_guides/porting_guide_core_2.18.html>`__
+
+Security Fixes
+--------------
+
+- ansible-galaxy install - Ensure role requirements are passed as positional arguments to :command:`git clone`. Previously, a malicious role author could inject arbitrary git configuration in role dependencies. (CVE-2026-11332)
+
 v2.18.17
 ========
 

changelogs/changelog.yaml

@@ -869,6 +869,22 @@ releases:
     - core_ci_remote_alias.yml
     - winrm-psrp-nolog.yml
     release_date: '2026-05-11'
+  2.18.18rc1:
+    changes:
+      release_summary: '| Release Date: 2026-06-11
+
+        | `Porting Guide <https://docs.ansible.com/ansible-core/2.18/porting_guides/porting_guide_core_2.18.html>`__
+
+        '
+      security_fixes:
+      - ansible-galaxy install - Ensure role requirements are passed as positional
+        arguments to :command:`git clone`. Previously, a malicious role author could
+        inject arbitrary git configuration in role dependencies. (CVE-2026-11332)
+    codename: Fool in the Rain
+    fragments:
+    - 2.18.18rc1_summary.yaml
+    - fix-cloning-malformed-role-requirements.yml
+    release_date: '2026-06-11'
   2.18.1rc1:
     changes:
       bugfixes:

changelogs/fragments/2.18.18rc1_summary.yaml

@@ -0,0 +1,3 @@
+release_summary: |
+   | Release Date: 2026-06-11
+   | `Porting Guide <https://docs.ansible.com/ansible-core/2.18/porting_guides/porting_guide_core_2.18.html>`__

lib/ansible/release.py

@@ -17,6 +17,6 @@
 
 from __future__ import annotations
 
-__version__ = '2.18.17.post0'
+__version__ = '2.18.18rc1'
 __author__ = 'Ansible, Inc.'
 __codename__ = "Fool in the Rain"