Repository navigation
Add release notes for OpenVox Server and OpenVoxDB 9.1.1 and 8.17.1 - #556
Merged
miharp merged 5 commits intoOct 30, 2026
Merged
Conversation
All four were released on October 29, 2026, alongside openvox-agent 8.31.2. Each entry covers: - The new agent requirement: the server and openvoxdb packages now depend on openvox-agent >= 9.2.1 (9.x) or >= 8.31.2 (8.x), so an upgrade pulls in the agent's Ruby and OpenSSL fixes. - jackson-databind 2.21.8, which fixes CVE-2026-110879 (GHSA-m8xf-2cr7-77ph, PolymorphicTypeValidator bypass through generic type arguments). - JOni 2.2.8 in the server (openvox-server#738/#739), the JRuby counterpart of the Ruby regexp fixes. - Bundled component updates, from the SBOM diffs in openvox-sbom-tools. There is no security table. Grype and OSV report no fixed CVEs for any of the four releases, because CVE-2026-110879 is in NVD (awaiting analysis) but not yet in the GitHub advisory database. The Jetty 12.1.13 and 12.1.14 changelogs list no CVEs, so Jetty appears only in the component list. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Michael Harp <mike@mikeharp.com>
Requested in review: the 9.1.1 and 8.17.1 server and OpenVoxDB entries lacked the "Security Issues Resolved" table that 8.17.0 and earlier entries have. The row is added by hand. `cves_fixed` cannot report it yet because GHSA-m8xf-2cr7-77ph has not been reviewed into the GitHub advisory database, so neither grype nor OSV matches jackson-databind 2.21.7. The 9.8 score is the CNA's CVSS 3.1 score on the NVD record; NVD's own analysis is still pending. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Michael Harp <mike@mikeharp.com>
Review feedback from alaunay: "JOni" is not how the jruby/joni project writes its name, and the ASM update (9.11 -> 9.11.1 on 9.x, 9.10.1 -> 9.11.1 on 8.x) was missing from the server component lists. Also list jcodings 1.0.64, which moved with Joni on 8.x. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Michael Harp <mike@mikeharp.com>
Review feedback from alaunay: each entry listed Jackson twice, as "jackson-databind 2.21.8" in the CVE bullet and as "Jackson 2.21.8" in the bundled components. The CVE bullet now says Jackson is updated to 2.21.8 and fixes the CVE in jackson-databind, and Jackson is dropped from the component lists, the same way Joni is handled. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Michael Harp <mike@mikeharp.com>
Charlie Sharpsteen added CVE tables to the four GitHub releases, built with Snyk because the CVEs are not yet in the GitHub advisory database that grype reads. Copy them in place of the hand-added one-row tables. Besides jackson-databind, they list the Jackson CBOR and Smile, Jetty, ASM, and (OpenVoxDB 8.17.1 only) PostgreSQL JDBC fixes. The scores are Snyk's, as on the releases. For most rows that is a CVSS 4.0 score, so CVE-2026-110879 now shows 9.3 rather than the CNA's CVSS 3.1 score of 9.8. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Michael Harp <mike@mikeharp.com>
4 of 6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds release-notes entries for OpenVox Server and OpenVoxDB 9.1.1 and 8.17.1, all released October 29 alongside openvox-agent 8.31.2 (#555).
Each entry covers:
openvox-serverandopenvoxdbpackages now requireopenvox-agent>= 9.2.1 on 9.x (Depend on openvox-agent >= 9.2.1 openvox-server#729, require openvox-agent 9.2.1 openvoxdb#625) and >= 8.31.2 on 8.x (require openvox-agent 8.31.2 openvox-server#747, require openvox-agent 8.31.2 openvoxdb#624). Upgrading the server or OpenVoxDB therefore also upgrades the agent on that host.PolymorphicTypeValidatorbypass in jackson-databind through generic type arguments and array element types.The tables are copied as published, including the scores. Those are Snyk's scores, and for most rows that is a CVSS 4.0 score even though the column header says CVSS 3.1. For example, CVE-2026-110879 shows 9.3, while NVD has the CNA's CVSS 3.1 score of 9.8.
Assisted by Claude.