Fixed security issues
This release updates the openssl trust store. It vendors the same certificates as the Mozilla NSS 3.131.1 release. Most notably is the removal of 3 emSign / eMudhra CA certificates because of their weak/leaked private keys (see also):
- emSign ECC Root CA - C3
- emSign ECC Root CA - G3
- emSign Root CA - C1
openvox-agent 9 doesn't ship a separate Java Truststore anymore.
Fixed CVEs
None
Open CVEs
| Identifier | CVSS 3.1 Score | Affects |
|---|---|---|
| CVE-2026-54696 | 3.7 | pkg:gem/json@2.18.0
|
| CVE-2026-33210 | N/A | pkg:gem/json@2.18.0
|
What's Changed
Dependency Updates ⬆️
- build(deps-dev): update rubocop requirement from ~> 1.91.0 to ~> 1.92.0 by @dependabot[bot] in #729
Other Changes
- Promote puppet-runtime 2026.10.21.1 into main by @OpenVoxProjectBot in #734
Full Changelog: 9.1.0...9.1.1