Our Puppet version is 4.8.2-5 across trusty, jessie and stretch. (4.8.2-5 is what is actually in stretch)
It was tested to build 4.8.2-5 for buster, that turned out to be a major rabbit role; Puppet 4 is incompatible with Ruby 2.5 (which is in buster) and building a separate ruby2.3 on buster fails as 2.3 requires OpenSSL 1.0.2 which is no longer in buster.
On buster we'll use Puppet 5 on the client side. Eventually the rest of the fleet and the puppet masters will also be migrated to 5.