miharp · Oct 3, 2026 · Oct 3, 2026
@@ -47,7 +47,7 @@ openvox:
       label: "9.x"
       collection: _openvox_9x
       base: /openvox/9.x/
-      ref: "9.0.0-rc1"
+      ref: "9.x"
     - id: 8x
       label: "8.x"
       collection: _openvox_8x
@@ -63,7 +63,7 @@ openfact:
       label: "6.x"
       collection: _openfact_6x
       base: /openfact/6.x/
-      ref: "6.0.0"
+      ref: "6.x"
     - id: 5x
       label: "5.x"
       collection: _openfact_5x

@@ -7,6 +7,24 @@ This page documents the history of the OpenFact 6 series. OpenFact 6 is bundled
 `openvox-agent` 9.x; for the series bundled with the 8.x agent, see the
 [OpenFact 5 release notes](/openfact/5.x/release_notes.html).
 
+## OpenFact 6.2.1
+
+Released on September 29, 2026. This is the version bundled with `openvox-agent` 9.0.0.
+
+A failed EC2 root metadata request is treated as no metadata. See the [GitHub OpenFact release page](https://github.com/OpenVoxProject/openfact/releases/tag/6.2.1).
+
+## OpenFact 6.2.0
+
+Released on September 23, 2026.
+
+The FQDN lookup in the hostname resolvers is bounded, so a slow or unresponsive resolver no longer stalls fact collection indefinitely. See the [GitHub OpenFact release page](https://github.com/OpenVoxProject/openfact/releases/tag/6.2.0).
+
+## OpenFact 6.1.0
+
+Released on September 11, 2026.
+
+Partial EC2 metadata results are rejected, log timestamp formatting is fixed, and the documentation and comments use the OpenVox and OpenFact names. See the [GitHub OpenFact release page](https://github.com/OpenVoxProject/openfact/releases/tag/6.1.0).
+
 ## OpenFact 6.0.0
 
 Released on July 31, 2026

@@ -3,9 +3,6 @@ layout: default
 title: "OpenVox Server 9"
 ---
 
-> **OpenVox Server 9 is in prerelease.** See the [release notes](release_notes.html) for
-> the current build and expect breaking changes before the stable 9.0.0 release.
-
 OpenVox Server is the primary server component in an OpenVox agent/server deployment.
 It compiles configuration catalogs for managed nodes, serves files, manages certificates,
 and receives reports from agents.

@@ -5,6 +5,10 @@ title: "OpenVox Server: Known Issues"
 
 For a list of all known issues, visit the [OpenVox Server issue tracker](https://github.com/OpenVoxProject/openvox-server/issues).
 
+## FIPS packages ship older Bouncy Castle jars
+
+The FIPS builds of `openvox-server` 9.0.1 ship an older set of Bouncy Castle FIPS 1.x jars. The latest Bouncy Castle FIPS 1.x release has a small issue that could cause problems in a very constrained, non-default configuration, so the project is not updating to it. OpenVox Server 9.1 will move to the Bouncy Castle FIPS 2.x line, which is the one fully certified for FIPS on Java 21.
+
 ## Potential JAVA ARGS settings
 
 If you're working outside of lab environment, increase `ReservedCodeCache` to `512m` under normal load. If you're working with 6-12 JRuby instances (or a `max-requests-per-instance` value significantly less

@@ -3,20 +3,130 @@ layout: default
 title: "OpenVox Server: Release Notes"
 ---
 
-> **OpenVox Server 9 is in prerelease.** This page tracks the beta and release-candidate
-> builds ahead of the stable 9.0.0 release. Expect breaking changes between prereleases; see
-> [known issues](known_issues.html) for anything discovered so far.
-
 OpenVox Server 9 pairs with OpenVox 9 (the agent): the `openvox-server` 9.x package
 depends on `openvox-agent` 9.x on the same host. For the changes on the agent side,
 see the [OpenVox 9 release notes](/openvox/9.x/release_notes.html).
 
+## OpenVox Server 9.0.1
+
+Released October 2, 2026.
+
+This is the first stable release of OpenVox Server 9. There is no 9.0.0 release: that
+version number was taken by an artifact published to Clojars by mistake during the beta
+(see 9.0.0-beta4 below), so the series starts at 9.0.1. See the
+[project's GitHub release page](https://github.com/OpenVoxProject/openvox-server/releases/tag/9.0.1)
+for the full list of changes and the
+[OpenVox 9 release notes](/openvox/9.x/release_notes.html) for the agent-side changes,
+including the "Upgrading from OpenVox 8" checklist linked from there.
+
+Breaking changes compared with OpenVox Server 8:
+
+- **Java 21 or 25 is required.** The package depends on a Java 25 or Java 21 runtime
+  package and prefers Java 25 wherever the platform provides it; Enterprise Linux 8
+  provides Java 21 only. The FIPS packages run on Java 21 only, because the Bouncy
+  Castle FIPS libraries are certified up to Java 21. Java 17 is no longer supported.
+- **The systemd unit runs the JVM directly.** It starts
+  `/opt/puppetlabs/server/apps/puppetserver/bin/java`, a launcher that runs the first
+  installed Java from the supported list (25, then 21). The unit is `Type=notify`, so
+  systemd reports the service as started only once OpenVox Server is up; on systemd 253
+  or newer (Debian 13, Ubuntu 24.04 and 26.04, EL 10, Fedora, SLES 16) it is
+  `Type=notify-reload`, while EL 8, EL 9, Amazon Linux 2023, SLES 15, Ubuntu 22.04, and
+  the FIPS packages keep the `puppetserver reload` subcommand behind `ExecReload`.
+  `systemctl reload puppetserver` works everywhere. The `puppetserver start` and
+  `puppetserver stop` subcommands are removed; use `systemctl`. `puppetserver foreground`
+  remains.
+- **`JAVA_BIN` in the defaults file is optional.** The shipped
+  `/etc/sysconfig/puppetserver` and `/etc/default/puppetserver` no longer set it, and a
+  `JAVA_BIN="/usr/bin/java"` line left over from an 8.x install is ignored. Any other
+  value is used as it is without validation, so it must point at Java 21 or 25, or at
+  Java 21 for a FIPS package. `JAVA_ARGS`,
+  `JAVA_ARGS_CLI`, and `TK_ARGS` work as before. The unit adds the `--add-opens` and
+  `--enable-native-access` options the JVM needs through `JAVA_ARGS_DIST`, and
+  `-Djruby.logger.class=...Slf4jLogger` is no longer part of the default `JAVA_ARGS`.
+- **JRuby 10.1.** Server-side Ruby code (functions, report processors, custom types and
+  providers used during compilation, and gems installed with `puppetserver gem`) runs on
+  JRuby 10.1, which targets Ruby 4.0.
+- **Filebucket reads require an administrative certificate.** The default
+  [`auth.conf`](./config_file_auth.html) allows `GET` and `POST` on
+  `/puppet/v3/file_bucket_file` only to certificates with the `pp_cli_auth` extension.
+  Agents keep `HEAD` and `PUT`, which is all they need to store backups. The package
+  manager keeps a modified `auth.conf` and drops the new default next to it as
+  `auth.conf.rpmnew` or `auth.conf.dpkg-dist`; merge it to pick up this rule and the
+  environment-cache rule below.
+- **The embedded web server is Jetty 12**, and the `gettext` gem is no longer vendored
+  with the JRuby gems.
+- **The package requires `openvox-agent` 9.0.0 or newer** on the same host.
+- **The `pe_serverversion` fact is removed.**
+- **Reports are off by default**, because the agent's `reports` setting now defaults to
+  `none`. Set `reports = store` on the server if you rely on YAML reports in `reportdir`.
+- **Platforms.** Packages are no longer built for Debian 11, Debian 12, Ubuntu 25.04,
+  Amazon Linux 2, or Fedora 42; see
+  [Supported platforms](/openvox/9.x/supported_platforms.html).
+
+Other notable changes:
+
+- The server can clear its own environment cache after a code deployment: the default
+  `auth.conf` allows `DELETE /puppet-admin-api/v1/environment-cache` for certificates with
+  the `pp_cli_auth` extension, which the server's own certificate carries. An r10k or g10k
+  post-deploy hook can call the API with the server's certificate.
+- Requests that include the system trust store, such as report processors posting to
+  external HTTPS endpoints, fall back to the PEM bundle at
+  `/opt/puppetlabs/puppet/ssl/cert.pem`, because the OpenVox 9 agent runtime no longer
+  ships a Java keystore.
+- `puppetserver gem`, `puppetserver ruby`, and `puppetserver irb` use JRuby's standard
+  error logger instead of printing debug logging, and `puppetserver gem list` works on
+  Java 21 and newer.
+- The uberjar no longer contains JRuby's Windows binaries and rdoc, which makes it smaller.
+
+### Security issues resolved in 9.0.1
+
+Compared with OpenVox Server 8.16.0. The Bouncy Castle scores are CVSS 4.0 base scores
+from NVD; the project's release page lists them as not yet scored.
+
+| Identifier                                                        | CVSS Score | Resolved By                                                             |
+| :---------------------------------------------------------------- | :--------: | :---------------------------------------------------------------------- |
+| [CVE-2026-71885](https://nvd.nist.gov/vuln/detail/CVE-2026-71885) |    9.2     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-17507](https://nvd.nist.gov/vuln/detail/CVE-2026-17507) |    8.7     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-71888](https://nvd.nist.gov/vuln/detail/CVE-2026-71888) |    8.7     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-71889](https://nvd.nist.gov/vuln/detail/CVE-2026-71889) |    8.7     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-71890](https://nvd.nist.gov/vuln/detail/CVE-2026-71890) |    8.7     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-18036](https://nvd.nist.gov/vuln/detail/CVE-2026-18036) |    8.2     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-71886](https://nvd.nist.gov/vuln/detail/CVE-2026-71886) |    8.2     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-71887](https://nvd.nist.gov/vuln/detail/CVE-2026-71887) |    8.2     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-85515](https://nvd.nist.gov/vuln/detail/CVE-2026-85515) |    8.2     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) |    7.5     | `pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.7`              |
+| [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) |    7.5     | `pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.7`              |
+| [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) |    7.5     | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.7`          |
+| [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) |    7.5     | `pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.7`          |
+| [CVE-2026-71891](https://nvd.nist.gov/vuln/detail/CVE-2026-71891) |    7.1     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-71892](https://nvd.nist.gov/vuln/detail/CVE-2026-71892) |    6.9     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-18040](https://nvd.nist.gov/vuln/detail/CVE-2026-18040) |    5.9     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+| [CVE-2026-17508](https://nvd.nist.gov/vuln/detail/CVE-2026-17508) |    5.3     | `pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.86`                        |
+
+## OpenVox Server 9.0.0-rc2
+
+Released September 29, 2026.
+
+This was the last release candidate before 9.0.1. See the
+[project's GitHub release page](https://github.com/OpenVoxProject/openvox-server/releases/tag/9.0.0-rc2)
+for the full list of changes.
+
+Notable changes in this build:
+
+- Packages are built with EZbake 4.2.0. The systemd unit starts the JVM through the
+  `bin/java` launcher described in the 9.0.1 entry, which runs the first installed Java
+  from the supported list and honors `JAVA_BIN` from the defaults file when it points at
+  a supported version. This replaces the 9.0.0-rc1 behavior of running the Java binary
+  chosen at package build time.
+- The default `auth.conf` lets the server's own certificate clear the environment cache
+  through `DELETE /puppet-admin-api/v1/environment-cache`.
+- JRuby 10.1.2.0, Bouncy Castle 1.86, Jackson 2.21.7, and logback 1.6.4.
+
 ## OpenVox Server 9.0.0-rc1
 
 Released September 9, 2026.
 
-This is the first **release candidate** of OpenVox Server 9 and is not yet the stable
-release. See the
+This was the first **release candidate** of OpenVox Server 9. See the
 [project's GitHub release page](https://github.com/OpenVoxProject/openvox-server/releases/tag/9.0.0-rc1)
 for the full list of changes.
 
@@ -45,7 +155,7 @@ Other notable changes:
 
 Released August 12, 2026.
 
-This is a **prerelease** of OpenVox Server 9 and is not yet the stable release. See the
+This was a **prerelease** of OpenVox Server 9. See the
 [project's GitHub release page](https://github.com/OpenVoxProject/openvox-server/releases/tag/9.0.0-beta5)
 for the full list of changes.
 
@@ -70,7 +180,7 @@ was published to Clojars by mistake. See the
 
 Released August 6, 2026. Packages for this build were not published; use 9.0.0-beta4.
 
-This is a **prerelease** of OpenVox Server 9 and is not yet the stable release. It includes
+This was a **prerelease** of OpenVox Server 9. It includes
 breaking changes; see the
 [project's GitHub release page](https://github.com/OpenVoxProject/openvox-server/releases/tag/9.0.0-beta3)
 for the full list of changes.
@@ -88,7 +198,7 @@ Notable breaking changes in this build:
 
 Released July 27, 2026.
 
-This is a **prerelease** of OpenVox Server 9 and is not yet the stable release. It includes
+This was a **prerelease** of OpenVox Server 9. It includes
 breaking changes; see the
 [project's GitHub release page](https://github.com/OpenVoxProject/openvox-server/releases/tag/9.0.0-beta2)
 for the full list of changes.
@@ -105,7 +215,7 @@ Notable changes in this build:
 
 Released July 15, 2026.
 
-This is the first **prerelease** of OpenVox Server 9 and is not yet the stable release. It
+This was the first **prerelease** of OpenVox Server 9. It
 includes breaking changes; see the
 [project's GitHub release page](https://github.com/OpenVoxProject/openvox-server/releases/tag/9.0.0-beta1)
 for the full list of changes.

@@ -3,9 +3,6 @@ layout: default
 title: "OpenVox 9"
 ---
 
-> **OpenVox 9 is in prerelease.** See the [release notes](release_notes.html) for the
-> current build and expect breaking changes before the stable 9.0.0 release.
-
 OpenVox is a community-maintained implementation of Puppet — a configuration management system for Linux, Unix, and Windows. It manages system state through a declarative language, compiling node-specific catalogs and enforcing them on each managed host.
 
 When Perforce discontinued public distribution of Puppet Open Source in late 2024, Overlook InfraTech stepped in with community packaging, and the project was subsequently adopted under [Vox Pupuli](https://voxpupuli.org/) stewardship as OpenVox. A Puppet Standards Steering Committee guides language and feature evolution going forward.

@@ -6,4 +6,22 @@ title: "OpenVox 9 known issues"
 
 As known issues are discovered in OpenVox 9 and its patch releases, they'll be added to the [project's issue tracker](https://github.com/OpenVoxProject/openvox/issues). Once a known issue is resolved, it is listed as a resolved issue in the release notes for that release, and removed from this list.
 
-No known issues have been reported for OpenVox 9 yet.
+## OpenVox 9.0.0
+
+### The agent daemon can hang while applying a catalog
+
+A small number of users have seen the `puppet agent` daemon stop checking in, leaving a forked `puppet agent: applying configuration` process that never exits ([openvox#485](https://github.com/OpenVoxProject/openvox/issues/485)). The reports so far come from small single-vCPU Linux VMs, where it happened every few days.
+
+The cause is a rare race between Ruby's background DNS lookup threads, which changed in Ruby 3.3 and 3.4, and the `fork` that starts each agent run. If the fork lands at the wrong moment, the child inherits a locked glibc resolver lock and every name lookup in that child blocks. OpenVox 8, which bundles Ruby 3.2, is not affected.
+
+OpenVox 9.0.0 includes changes that make the hang much less likely and let the daemon recover on its own: the daemon no longer does name lookups right before forking a run, a run that outlives [`runtimeout`](configuration.html#runtimeout) is killed so the daemon carries on with the next run, and OpenFact bounds the FQDN lookup in its hostname resolvers.
+
+If you still see it, setting `RUBY_TCP_NO_FAST_FALLBACK=1` in a systemd override for the `puppet` service may reduce how often it happens:
+
+```ini
+# systemctl edit puppet
+[Service]
+Environment=RUBY_TCP_NO_FAST_FALLBACK=1
+```
+
+Restarting the `puppet` service does not clean up a child process that is already stuck; kill it with `SIGKILL`. If you hit this on 9.0.0, add details to [openvox#485](https://github.com/OpenVoxProject/openvox/issues/485).