Happy Wednesday everyone! wednesday This week, we are pleased to announce the OpenVox Server 8.15.1 and OpenVoxDB 8.15.0 maintenance releases. These releases contain fixes for CVEs in several Java libraries: notably the Jackson XML and JSON parser, and the BouncyCastle TLS library. Please see the release notes for details: - github.com/OpenVoxProject/openvox-server/…/8.15.0 - github.com/OpenVoxProject/openvoxdb/…/8.15.0 The CVE fix list for OpenVoxDB is longer as we missed a Jackson update in the 8.14.1 release that only went into OpenVox Server. This sort of miss should be eliminated going forward as we have automation in place to open update PRs after upstream components release combined with SBOM generation to help us audit what is in the builds. At this point we're shipping component updates faster than some CVEs get published to vulnerability databases --- the fix lists in the release notes will likely update in a week or two after BouncyCastle publishes the CVE list fixed in their 1.85 release. The OpenVox Server release also contains one significant functional change: - The JRuby version has been updated from 9.4.12.1 to 9.4.15.0. We had been pinned to the older version for a while due to a memory leak that showed up in 9.4.13.0 that has now been root caused and fixed. We are now up to date with the latest fixes and enhancements on the JRuby 9.4 line. We couldn't ship the 8.15.0 build of OpenVox Server as the BouncyCastle 1.85 update broke the process for building JRuby in FIPS mode. That issue has been fixed with the 8.15.1 build. If you have questions about, or encounter issues with these releases, reach out in #C088QSEH1RA here on Slack or

#voxpupuli-openvox

on IRC. See voxpupuli.org/connect for details.