Skip to content

fix: select base images and hotfixes during PAN-OS upgrades - #632

Open
anandhx wants to merge 1 commit into
PaloAltoNetworks:developfrom
anandhx:fix/hotfix-upgrade-version-selection
Open

anandhx wants to merge 1 commit into
PaloAltoNetworks:developfrom
anandhx:fix/hotfix-upgrade-version-selection

Conversation

@anandhx

@anandhx anandhx commented Nov 6, 2026

Copy link
Copy Markdown

Summary

  • upgrade_to_version('10.1.13-h1') from 10.1.13 raised TypeError: '<' not supported between instances of 'NoneType' and 'int' because a base release has no hotfix number. A missing hotfix now ranks as 0, so the base-to-hotfix step is a normal direct upgrade. Fixes Upgrade from standard to hotfix release fails on 1.12.0 #565.
  • Walking to the next minor release picked 10.2.0-h3 when 10.2.0 was also published. PAN-OS then refused the download until the base image was loaded. The lowest patch is still chosen, and on that patch the base image is preferred over a hotfix. Fixes Paloalto firewall upgrade fails with error in upgrade.py #572.

Test plan

  • python -m pytest tests/test_updater.py -q (267 passed)
  • Dry-run fw.software.upgrade_to_version('10.1.13-h1') from a device on 10.1.13
  • Dry-run an upgrade from 10.1.x toward 11.1.x when both 10.2.0 and 10.2.0-h3 are listed, and confirm the next hop is 10.2.0

Made with Cursor

Upgrading 10.1.13 to 10.1.13-h1 crashed because a release with no hotfix was compared as None. The next minor hop also picked 10.2.0-h3 when 10.2.0 was available, and PAN-OS will not load that hotfix until the base image is downloaded.

Co-authored-by: Cursor <cursoragent@cursor.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Paloalto firewall upgrade fails with error in upgrade.py Upgrade from standard to hotfix release fails on 1.12.0

1 participant