Happy Wednesday everyone! Mostly all quiet on the release front this week as holidays are happening and folks are enjoying some time in the sun. There is one item I wanted to announce and that is we have completed our first inventory of dependencies included in the

openvox-agent

,

openbolt

,

openvox-server

, and

openvoxdb

packages. These packages each contain dozens of Ruby gems, Java JARs, and C libraries from upstream open source projects --- it is nice to finally have a list of "Who's Who in the Zoo". This inventory is auto-generated from Vanagon build configurations and Maven depedency trees. From there, we are able to auto-generate the CVE fix lists that are now included in release notes for each of the projects. The tooling for all of this automation can be found in this Git repo: github.com/OpenVoxProject/openvox-sbom-tools Of particular note is this sub-directory, which contains Software Bill of Material (SBOM) files, in CycloneDX-JSON format, for each release we have done in 2026: github.com/OpenVoxProject/…/sbom This is a first step, and we will be working to fill in components that the automation currently doesn't find (e.g. Ruby Gems bundled with JRuby) and enrich the output with any information required by U.S. Executive Order 14028 or the EU Cyber Resilience Act (CRA). If you have any questions, please reach out in #sig-release here on Slack or

#voxpupuli-sig-release

on IRC at libera.chat. Looking forward, we will likely be moving toward a release of

openvox-agent

in the next couple of weeks to clear out CVEs addressed by last week's

curl

release. If you have PRs for small bugs waiting for merge, let us know in the #openvox channel on Slack, or

#voxpupuli-openvox

on IRC. That's all for today! Hope everyone is having a pleasant summer, and a very happy Canada Day canadaflag