OpenVox Server 8.12.0 Release: This version represents a significant change in how openvox-server is built. Most of this is under the hood, but should lower the bar to development and allow us to make changes more easily and rapidly. Some of the important changes in this version: • Platform support ◦ Removed: EL 7 ◦ Added: Amazon Linux 2, Fedora 42, Fedora 43, Redhatfips 8, Redhatfips 9 ◦ Note that Amazon Linux 2 support will be removed when it goes EOL in June of 2026 ◦ Note that the platform name

redhatfips

is used since Puppet uses this nomenclature, but it should work on any FIPS-enabled Enterprise Linux-based platform. • Java 11 support has been removed, and either Java 17 or Java 21 must be used. • Removes Janino support. Logback removed support for it due to CVEs. This means that logbook evaluator filters are no longer supported. These were not commonly used so unless you specifically included tags in your logback config, you should not be affected. • Also due to the removal of Janino, Trapperkeeper’s ‘post-config-script’ option for injecting Java code directly into Jetty for controlling low-level Jetty settings that are not exposed by Trapperkeeper is no longer supported. This is also a feature not commonly used, and was a potential security risk in itself. • This version of openvox-server and all related components have now been migrated to the org.openvoxproject namespace and are available on Clojars, with fixed up testing and release workflows. • The systemd service now sets

PrivateTmp=true

. This improves security by eliminating a common target for malicious activity. • Lots and lots of dependency updates that you should not notice, but brings the code up to a more maintainable standard. • The following third-party components were updated to address CVEs: ◦ JRuby 9.4.8.0 -> 9.4.12.1: CVE-2025-46551 ◦ Jetty 10.0.20 -> 10.0.26: CVE-2025-5115, CVE-2024-8184 ◦ jackson-databind 2.14.0 -> 2.20.1: CVE-2025-52999 ◦ logback 1.3.14 -> 1.3.16: CVE-2024-12798, CVE-2024-12801, CVE-2025-11226 ◦ commons-beanutils 1.9.4 -> 1.11.0: CVE-2025-48734 ◦ Bouncy Castle non-FIPS 1.78.1 -> 1.83: CVE-2025-8916 ◦ Additionally, this is the first FIPS release of OpenVox server, but compared to the baseline FIPS config from before the fork: ▪︎ bcpkix-fips 1.0.7 -> 1.0.8: CVE-2025-8916 ▪︎ bc-fips 1.0.2.5 -> 1.0.2.6: CVE-2025-8885

official FIPS support! yay2