Add openvox 9 support

[dependabot]

Updates the requirements on openvox to permit the latest version.

Release notes

Sourced from openvox's releases.

9.0.0

🎉 This is the first release in the OpenVox 9 series! Major thanks to the amazing Vox Pupuli community for making this release happen. This release would not exist without everyone who submitted pull requests, filed bugs, tested pre-releases, and joined the discussions about what should change. 🎉

Major changes:

• Ruby 4.0.7
• OpenFact 6.2.1
• OpenSSL 3.5.9 (the OpenSSL LTS)
• Windows agents are now built against msys2. The filename now denotes it as windows-msys2-x64.msi. This brings improvements to our build process, but should be transparent to users.

Upgrading from OpenVox 8

1. Configure the openvox9 repositories. Install the openvox9-release package for your platform from https://yum.voxpupuli.org/ or https://apt.voxpupuli.org/. MacOS packages are at https://downloads.voxpupuli.org/mac/openvox9/ and the Windows package is at https://downloads.voxpupuli.org/windows/openvox9/.
2. Upgrade server hosts as a set. The 8.x openvox-server and openvoxdb packages require openvox-agent < 9.0.0, and the 9.x packages require openvox-agent >= 9.0.0. Upgrade the agent, server, and database packages on a server host, then the agents in the rest of your fleet.
3. Ensure server is set in puppet.conf on every agent before upgrading if they currently rely on the default puppet. OpenVox 9 no longer falls back to the server name puppet by default when server is not set. Agents configured with server_list, DNS SRV records, or ca_server and report_server are not affected.
4. Decide what happens to reports. The default of the reports setting changed from store to none. A server that should keep writing YAML reports to reportdir needs reports = store in puppet.conf. Servers that set reports explicitly (for example puppetdb or foreman) are not affected.
5. Ensure Java 21 or 25 are available on server hosts. If /etc/sysconfig/puppetserver, /etc/default/puppetserver, /etc/sysconfig/puppetdb, or /etc/default/puppetdb sets JAVA_BIN to anything other than /usr/bin/java, ensure it points to a Java 21 or 25 binary or remove the line.
6. Check Ruby code against Ruby 4.0. Custom types, providers, functions, facts, report processors, and gems now run on Ruby 4.0 on agents and on JRuby 10.1 on the server. Gems installed into the agent's Ruby with /opt/puppetlabs/puppet/bin/gem must be installed again after the upgrade because the gem directory moves from lib/ruby/gems/3.2.0 to lib/ruby/gems/4.0.0. Gems installed with puppetserver gem stay in place but must work on Ruby 4.0.
7. Replace --configprint. The puppet agent --configprint option and the configprint setting are gone. Use puppet config print.
8. Merge the new default auth.conf on the server. The package manager keeps a modified /etc/puppetlabs/puppetserver/conf.d/auth.conf and drops the new default next to it (auth.conf.rpmnew or auth.conf.dpkg-dist). The new default restricts filebucket reads and allows the server to clear its own environment cache
9. Check the Jetty 12 bootstrap entry if you skipped 8.14.1. Server and database hosts that were upgraded from 8.14.0 or earlier with a modified /etc/puppetlabs/puppetdb/bootstrap.cfg need jetty10-service replaced with puppetlabs.trapperkeeper.services.webserver.jetty-service/jetty-service. See the 8.14.1 entries in the OpenVox Server and OpenVoxDB 8 release notes.
10. Check platform support. See the platform lists in each section below.

Components

Component	8.29.0	9.0.0
Ruby	3.2.11	4.0.7
OpenSSL	3.0.22	3.5.9
OpenSSL FIPS provider build (FIPS packages)	2025.12.17.1	2025.12.17.1
OpenFact	5.6.1	6.2.1
puppet-resource_api	1.9.2	2.0.1
puppet-ca-bundle	1.1.0 (PEM bundle and Java keystore)	1.2.0 (PEM bundle only)
libxml2	2.15.3	2.15.4
curl	8.22.0	not shipped
ruby-shadow	2.5.1	patched fork (commit bc7752a9)

Vendored modules:

Module	8.29.0	9.0.0
puppetlabs-augeas_core	1.5.0	2.0.1
puppetlabs-cron_core	1.3.0	2.0.2
puppetlabs-host_core	1.3.0	2.0.1
puppetlabs-mount_core	1.3.0	1.3.0
puppetlabs-scheduled_task	3.2.0	5.0.0
puppetlabs-selinux_core	1.4.0	2.0.1
puppetlabs-sshkeys_core	2.5.0	3.0.2
puppetlabs-yumrepo_core	2.1.0	3.0.1
puppetlabs-zfs_core	1.6.1	2.0.1
puppetlabs-zone_core	1.2.0	removed

... (truncated)

Changelog

Sourced from openvox's changelog.

9.0.0 (2026-10-02)

Full Changelog

Fixed bugs:

• [Bug]: Ruby crashes on child side of fork pre-exec macOS 26 (Tahoe) #538

Merged pull requests:

• Skip the tests that need jruby-openssl in FIPS mode #696 (nmburgan)

9.0.0-rc4 (2026-09-29)

Full Changelog

Fixed bugs:

• openfact: Update 6.2.0 -> 6.2.1 #692 (OpenVoxProjectBot)

Merged pull requests:

• Promote puppet-runtime 2026.09.29.1 into main #694 (OpenVoxProjectBot)

9.0.0-rc3 (2026-09-25)

Full Changelog

Fixed bugs:

• packaging: ensure every systemd-distro get a service file #688 (bastelfreak)

9.0.0-rc2 (2026-09-25)

Full Changelog

Implemented enhancements:

• openfact: update 6.1.0 -> 6.2.0 #677 (OpenVoxProjectBot)
• Promote openfact 6.1.0 into main #668 (OpenVoxProjectBot)

Fixed bugs:

• [Bug]: use of "server_list" (instead of server) throws an error #658
• Wait for certificates in the forked child, not in the daemon #683 (silug)
• Only require the server setting when no explicit server is given #659 (silug)
• print "Loading facts" just once #656 (bastelfreak)
• Pin json below 3 to unblock CI #655 (miharp)
• Install the service defaults file on Debian #645 (jcharaoui)
• Do not swallow RunTimeoutError while collecting facts #643 (silug)

... (truncated)

Commits

• e5e371f Merge pull request #703 from OpenVoxProject/release-9.0.0
• 1e852b8 Release 9.0.0
• 216b4c1 Merge pull request #696 from OpenVoxProject/fips-test-gates
• 9436ecb Skip the tests that need jruby-openssl in FIPS mode
• 76d6e85 Merge pull request #695 from OpenVoxProject/release-9.0.0-rc4
• 600bf06 Release 9.0.0-rc4
• 62e1a2d Merge pull request #694 from OpenVoxProject/promote/main/puppet-runtime/2026....
• 49b4f50 Promote puppet-runtime 2026.09.29.1 into main
• f58bfa9 Merge pull request #691 from OpenVoxProject/dependabot/github_actions/ruby/se...
• 4deefa3 Merge pull request #692 from OpenVoxProject/promote/main/openfact/6.2.1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[nmburgan]

We’re going to need a new OpenBolt 6 that targets OpenVox 9, so we probably don’t want to merge this.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.