Happy to report that the CVEs fixed in Puppet Core's 8.16.0 are already fixed in openvox 8.24.1 (I didn't check earlier versions). I checked the following: • Thor (already at 1.4.0)

/opt/puppetlabs/puppet/lib/ruby/gems/3.2.0/gems/thor-1.4.0

• curl (already at 8.17.0)

# /opt/puppetlabs/puppet/bin/curl --version
curl 8.17.0 (x86_64-pc-linux-gnu) libcurl/8.17.0 OpenSSL/3.0.18 zlib/1.2.11
Release-Date: 2025-11-05
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns mqtt pop3 pop3s rtsp smtp smtps telnet tftp ws wss
Features: alt-svc AsynchDNS HSTS HTTPS-proxy IPv6 Largefile libz SSL threadsafe TLS-SRP UnixSockets

• openssl (already at 3.0.18):

# /opt/puppetlabs/puppet/bin/openssl version
OpenSSL 3.0.18 30 Sep 2025 (Library: OpenSSL 3.0.18 30 Sep 2025)

• rexml (already at 3.4.4)

/opt/puppetlabs/puppet/lib/ruby/gems/3.2.0/gems/rexml-3.4.4

I don't know how to check URI gem. I think, in the future, CVEs need to be highlighted in release notes, as InfoSec and PHBs love to see those fixes.