OpenVox 9 Release Notes

This page lists the links to the changes in OpenVox 9, its patch releases, and the 9.0.0 prereleases. You can also view known issues in this release.

OpenVox’s version numbers follows the Semantic Versioning schema, which splits a version into three segments: Major.Minor.Patch

  • Major: must increase for major backward-incompatible changes
  • Minor: can increase for backward-compatible new functionality or significant bug fixes
  • Patch: can increase for bug fixes

If you’re upgrading from Puppet Open Source

Puppet Open Source is no longer actively developed.

You can either upgrade to Puppet 7 and then switch to OpenVox 7 and then upgrade through OpenVox 8 to OpenVox 9, or you can upgrade to Puppet 8 and then migrate to OpenVox 8 and then to OpenVox 9.

OpenVox 9.2.1

Released October 23, 2026.

This is a security release of OpenVox. It updates the bundled Ruby to 4.0.9.

All bug fixes, new features and other changes are provided on the project’s github release page.

Notable changes in this release:

  • Ruby is updated from 4.0.8 to 4.0.9, which fixes the regular expression compilation bugs described in Ruby’s advisory on regexp compilation fixes. GitLab found that the bugs could be used for remote code execution and published them as CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264. They are reached only when a program compiles a regular expression from untrusted input. Ruby has not assigned CVE identifiers of its own for them, so they do not appear in scans of OpenVox’s bundled components.

OpenVox 9.2.0

Released October 22, 2026.

This is a bug-fix release of OpenVox. It updates the bundled Ruby to 4.0.8.

All bug fixes, new features and other changes are provided on the project’s github release page.

Notable changes in this release:

  • Ruby is updated from 4.0.7 to 4.0.8, a routine bug-fix release. The agent daemon forks a child process for each run, and two of the fixes concern forked children: on glibc systems the child could be left unable to resolve hostnames (Bug #22406), and on macOS it could abort with pthread_rwlock_destroy: Resource busy (Bug #22445). The release also fixes several memory-safety bugs in String and Array methods. No CVEs reported against OpenVox’s bundled components are resolved by this release.

OpenVox 9.1.1

Released October 21, 2026.

This is a security release of OpenVox. It refreshes the CA trust store.

All bug fixes, new features and other changes are provided on the project’s github release page.

Notable changes in this release:

  • The CA certificate bundle at /opt/puppetlabs/puppet/ssl/cert.pem is rebuilt from the Mozilla root store as shipped in NSS 3.131.1 (puppet-ca-bundle 2.0.0). The rebuild removes the emSign Root CA - C1, emSign ECC Root CA - C3, and emSign ECC Root CA - G3 roots after eMudhra’s private keys were found to be exposed. The bundle is what the agent’s Ruby and OpenSSL trust when connecting to servers with publicly issued certificates, such as the Forge, https file sources, and gem installs. It plays no part in the trust between agents and the OpenVox server, which comes from the OpenVox CA in ssldir.
  • The upgrade replaces cert.pem, so a CA that you appended to that file has to be added again. Adding a custom CA for HTTPS-inspecting proxies describes the ways that survive upgrades.
  • Bundled gems are updated, including fast_gettext 4.1.1 and net-ssh 7.3.6. No CVEs reported against OpenVox’s bundled components are resolved by this release.

OpenVox 9.1.0

Released October 13, 2026.

This is a feature release of OpenVox. It adds support for version 3 of the json gem and updates bundled components.

All bug fixes, new features and other changes are provided on the project’s github release page.

Notable changes in this release:

  • The agent works with version 3 of the json gem (#706). An agent installed from the openvox gem or from a distribution package, on a Ruby that has json 3 installed (Debian testing and unstable ship it), failed every request to the server with Failed to deserialize ... from json: wrong number of arguments (given 2, expected 1), and puppet facts show failed with uninitialized constant JSON::PRETTY_STATE_PROTOTYPE. The openvox-agent packages bundle json 2 and were not affected. On json 3, a JSON document with a duplicated key, such as a module’s metadata.json, is rejected instead of silently keeping the last value.
  • Packages are built for the FIPS variant of Enterprise Linux 10 (redhatfips-10-x86_64).
  • The generated configuration reference now documents the reports default as none, which it has been since 9.0.0.
  • Bundled components are updated, including Augeas 1.15.0. It is the first Augeas release since 2023 and adds an Aptsources822 lens for Deb822-style apt .sources files, leapseclist in the Chrony lens, /usr/share/iproute2 in the IPRoute2 lens, and /etc/nginx/snippets in the Nginx lens, among other lens changes listed in the Augeas release notes. Augeas 1.15.0 also carries the upstream fix for CVE-2025-2588, which OpenVox agents have had as a patch to Augeas 1.14.1 since 8.23.0, so this release resolves no new security issues.

OpenVox 9.0.0

Released October 2, 2026.

This is the first stable release of OpenVox 9. It moves the agent to current versions of its core dependencies and removes code that was deprecated during OpenVox 8; new features are planned for OpenVox 10. The project’s github release page has the full list of changes, a component-by-component comparison with 8.29.0, and an “Upgrading from OpenVox 8” checklist to work through before you upgrade. The release announcement summarizes the changes most likely to affect you.

OpenVox 8 stays available in the openvox8 repositories and continues to receive high-priority and security fixes for at least six months. OpenVox 8 agents can keep running against OpenVox 9 servers while you upgrade the rest of your fleet.

Bundled components

  • Ruby 4.0.7 (OpenVox 8 bundles Ruby 3.2). Gems you installed into the agent’s Ruby with /opt/puppetlabs/puppet/bin/gem must be installed again after the upgrade, because the gem directory moves from lib/ruby/gems/3.2.0 to lib/ruby/gems/4.0.0.
  • OpenSSL 3.5.9, the OpenSSL long-term-support line (OpenVox 8 bundles OpenSSL 3.0).
  • OpenFact 6.2.1 (OpenVox 8 bundles OpenFact 5).
  • puppet-resource_api 2.0.1, and new major versions of the vendored *_core modules. The zone_core module is no longer vendored; Solaris zone management needs the module installed separately.
  • No longer shipped: the curl binary, the Java keystore at /opt/puppetlabs/puppet/ssl/puppet-cacerts (the PEM bundle at /opt/puppetlabs/puppet/ssl/cert.pem remains), and the base64 and multi_json gems.

Breaking changes

  • No default server. The server setting no longer defaults to puppet. An agent run that would fall back on an unset server fails with an error that tells you to set it. Agents that use server_list, DNS SRV records, or an explicit server on the command line are not affected, and ca_server and report_server satisfy the check for the CA and report services.
  • Reports are off by default. The default of the reports setting changed from store to none. A server that should keep writing YAML reports to reportdir needs reports = store in puppet.conf. Servers that set reports explicitly (for example puppetdb) are not affected.
  • Deferred values are evaluated before the catalog is applied again. preprocess_deferred defaults to true. Set it to false to keep the lazy evaluation that OpenVox 8 used by default.
  • File content that looks like a checksum is literal content. A content value such as {md5}... no longer triggers a filebucket lookup and no longer warns.
  • Removed settings, options, and APIs. --configprint and the configprint setting (use puppet config print), the pluginsync setting, the hiera indirector terminus and the data_binding_terminus setting, the encoding argument of regsubst, the legacy PAL script evaluation APIs, and the pe_serverversion fact.
  • The systemd service provider no longer falls back to SysVInit on Debian. invoke-rc.d and init script inspection are no longer consulted to decide whether a service is enabled.
  • OpenFact 6 is required. The openvox gem depends on openfact ~> 6.0 and needs Ruby 3.2 or newer.
  • The openvox gem ships platform builds. Besides the generic gem there are universal-darwin and x64-mingw-ucrt builds. The x64-mingw32 and x86-mingw32 platforms are dropped.

Platforms

Packages are no longer built for Enterprise Linux 7, Amazon Linux 2, Fedora 42, Debian 11, or Ubuntu 25.04; see Supported platforms. The Windows agent is now built with MSYS2 and the UCRT toolchain (the x64-mingw-ucrt Ruby platform), so precompiled gems such as nokogiri install on Windows nodes without build tools. Installers for 9.x are in the openvox9 directories at downloads.voxpupuli.org.

Other changes

  • The agent logs an error when the catalog it received was compiled for a different certname, which happens with cloned images that keep a cached catalog or with a misrouting load balancer.
  • A forked agent run is killed when it outlives runtimeout, a RunTimeoutError during fact collection is no longer swallowed, and the daemon waits for its certificate in the forked child instead of blocking the daemon.
  • Puppet.features.posix? no longer depends on the syslog library, which fixes Cannot determine basic system flavour on Ruby installations without it.
  • Debian packages install /etc/default/puppet, which sets PUPPET_EXTRA_OPTS for the systemd unit.
  • Help output, default configuration files, and the generated reference pages use the OpenVox name and link to this site.

Security Issues Resolved in 9.0.0

Compared with openvox-agent 8.29.0. The prerelease entries below list the issues fixed earlier in the 9.0.0 cycle. libxml2 2.15.4 also contains security fixes that have no CVE identifiers.

Identifier CVSS 3.1 Score Resolved By
CVE-2026-84782 8.2 pkg:github/openssl/openssl@3.5.9
CVE-2026-80212 7.5 pkg:gem/resolv@0.7.2 (Ruby 4.0.7)
CVE-2026-35189 5.3 pkg:github/openssl/openssl@3.5.9
CVE-2026-75805 5.3 pkg:github/openssl/openssl@3.5.9
CVE-2026-75806 5.3 pkg:github/openssl/openssl@3.5.9
CVE-2026-80213 4.0 pkg:gem/resolv@0.7.2 (Ruby 4.0.7)
CVE-2026-54872 3.7 pkg:github/openssl/openssl@3.5.9
CVE-2026-77696 3.7 pkg:github/openssl/openssl@3.5.9

OpenVox 9.0.0-rc4

Released September 29, 2026.

This was the last release candidate before 9.0.0. It updates OpenFact to 6.2.1 and puppet-runtime to 2026.09.29.1, which moves OpenSSL to 3.5.9 (the fixes are listed in the 9.0.0 security table above). See the project’s github release page.

OpenVox 9.0.0-rc3

Released September 25, 2026.

This release candidate fixes the packaging so that every systemd-based distribution gets the puppet service unit. See the project’s github release page.

OpenVox 9.0.0-rc2

Released September 25, 2026.

This was a release candidate for OpenVox 9. See the project’s github release page for the full list of changes.

Notable changes in this build:

  • The server check introduced in 9.0.0-rc1 accepts server_list, DNS SRV records, and an explicit server on the command line, and ca_server and report_server satisfy it for the CA and report services. 9.0.0-rc1 accepted only the server setting.
  • A forked agent run is killed when it outlives runtimeout, a RunTimeoutError during fact collection is no longer swallowed, and the daemon waits for its certificate in the forked child instead of blocking the daemon.
  • Debian packages install /etc/default/puppet, and the systemd unit no longer warns about an unset variable.
  • Loading facts is logged once per run.
  • OpenFact 6.2.0 and puppet-runtime 2026.09.24.1 (Ruby 4.0.7).

OpenVox 9.0.0-rc1

Released September 4, 2026.

This was the first release candidate for OpenVox 9. It includes breaking changes; see the project’s github release page for the full list of changes.

Notable breaking changes in this build:

  • Running as root without a server setting is now an error instead of a deprecation warning. OpenVox 9 does not default to server=puppet, so set the server explicitly in puppet.conf.
  • The systemd service provider no longer falls back to invoke-rc.d and init script inspection on Debian to decide whether a service is enabled.
  • The openvox gem now ships platform-specific builds for universal-darwin and x64-mingw-ucrt alongside the generic gem. The legacy x64-mingw32 and 32-bit x86-mingw32 gem platforms have been dropped.

Security Issues Resolved in 9.0.0-rc1

Identifier CVSS 3.1 Score Resolved By
CVE-2026-63073 9.8 pkg:github/openssl/openssl@3.5.8
CVE-2026-75803 9.1 pkg:github/openssl/openssl@3.5.8
CVE-2026-14456 7.5 pkg:github/openssl/openssl@3.5.8
CVE-2026-14457 7.5 pkg:github/openssl/openssl@3.5.8
CVE-2026-18798 7.5 pkg:github/openssl/openssl@3.5.8
CVE-2026-54874 7.5 pkg:github/openssl/openssl@3.5.8
CVE-2026-63072 7.5 pkg:github/openssl/openssl@3.5.8
CVE-2026-63075 7.5 pkg:github/openssl/openssl@3.5.8
CVE-2026-63076 7.5 pkg:github/openssl/openssl@3.5.8
CVE-2026-63074 5.9 pkg:github/openssl/openssl@3.5.8

OpenVox 9.0.0-beta2

Released August 6, 2026.

This was a prerelease of OpenVox 9. It includes breaking changes; see the project’s github release page for the full list of changes.

Notable breaking changes in this build:

  • The default for the reports setting changed from store to none, so report processing is now opt-in.
  • OpenFact 6.x is now required.
  • The deprecated hiera indirector and the data-binding settings have been removed.
  • The zone_core vendored module has been removed.
  • Java keystores have been removed from the runtime.

OpenVox 9.0.0-beta1

Released July 15, 2026.

This was a prerelease of OpenVox 9. It includes breaking changes; see the project’s github release page for the full list of changes.

Security Issues Resolved in 9.0.0-beta1

Identifier CVSS 3.1 Score Resolved By
CVE-2026-54906 9.8 pkg:gem/concurrent-ruby@1.3.7
CVE-2026-54904 7.5 pkg:gem/concurrent-ruby@1.3.7
CVE-2026-54905 5.5 pkg:gem/concurrent-ruby@1.3.7

OpenVox 9.0.0-alpha2

Released June 10, 2026.

This was a prerelease of OpenVox 9. It includes breaking changes; see the project’s github release page for the full list of changes.

Security Issues Resolved in 9.0.0-alpha2

Identifier CVSS 3.1 Score Resolved By
CVE-2026-34182 9.1 pkg:github/openssl/openssl@3.5.7
CVE-2026-45447 8.8 pkg:github/openssl/openssl@3.5.7
CVE-2026-7383 8.1 pkg:github/openssl/openssl@3.5.7
CVE-2026-45445 7.5 pkg:github/openssl/openssl@3.5.7
CVE-2026-42764 7.5 pkg:github/openssl/openssl@3.5.7
CVE-2026-34183 7.5 pkg:github/openssl/openssl@3.5.7
CVE-2026-34180 7.5 pkg:github/openssl/openssl@3.5.7
CVE-2026-9076 7.5 pkg:github/openssl/openssl@3.5.7
CVE-2026-34181 7.4 pkg:github/openssl/openssl@3.5.7
CVE-2026-42767 5.9 pkg:github/openssl/openssl@3.5.7
CVE-2026-42766 5.9 pkg:github/openssl/openssl@3.5.7
CVE-2026-42769 5.3 pkg:github/openssl/openssl@3.5.7
CVE-2026-45446 4.8 pkg:github/openssl/openssl@3.5.7
CVE-2026-42770 3.7 pkg:github/openssl/openssl@3.5.7
CVE-2026-42768 3.7 pkg:github/openssl/openssl@3.5.7

OpenVox 9.0.0-alpha1

Released May 21, 2026.

This was a prerelease of OpenVox 9. See the project’s github release page for the full list of changes.

Last updated: