chore(audit): refresh the minimum version table - #12
Merged
Conversation
The daily refresh job read the upstream advisory feeds and wrote the new minimums.
github-actions
Bot
force-pushed
the
automation/minimum-versions
branch
from
August 30, 2026 07:26
b310aec to
55d31d9
Compare
github-actions
Bot
requested review from
JordanNanos,
Prathmesh234 and
samharshe
as code owners
August 30, 2026 07:26
JordanNanos
approved these changes
Aug 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
The audit compares each cluster component against a minimum safe
version, which this repository calls a minimum. The upstream vendors
publish new advisories, and the minimums must follow them. The daily
refresh job made this pull request.
What changed
cmax/scripts/1-audit/minimum-versions.json: 74 values changed in 2 components.docker
advisoriessource.feedsource.majorssource.reasonsource.releasedsource.urlUpstream sources:
rocm
advisorycvesfloorAvailability.MI210.aIdfloorAvailability.MI210.availablefloorAvailability.MI210.bulletinReleasedfloorAvailability.MI210.feedfloorAvailability.MI210.statusfloorAvailability.MI210.urlfloorAvailability.MI210.versionfloorAvailability.MI250.aIdfloorAvailability.MI250.availablefloorAvailability.MI250.bulletinReleasedfloorAvailability.MI250.feedfloorAvailability.MI250.statusfloorAvailability.MI250.urlfloorAvailability.MI250.versionfloorAvailability.MI300A.aIdfloorAvailability.MI300A.availablefloorAvailability.MI300A.bulletinReleasedfloorAvailability.MI300A.feedfloorAvailability.MI300A.statusfloorAvailability.MI300A.urlfloorAvailability.MI300A.versionfloorAvailability.MI300X.aIdfloorAvailability.MI300X.availablefloorAvailability.MI300X.bulletinReleasedfloorAvailability.MI300X.feedfloorAvailability.MI300X.statusfloorAvailability.MI300X.urlfloorAvailability.MI300X.versionfloorAvailability.MI308X.aIdfloorAvailability.MI308X.availablefloorAvailability.MI308X.bulletinReleasedfloorAvailability.MI308X.feedfloorAvailability.MI308X.statusfloorAvailability.MI308X.urlfloorAvailability.MI308X.versionfloorAvailability.MI325X.aIdfloorAvailability.MI325X.availablefloorAvailability.MI325X.bulletinReleasedfloorAvailability.MI325X.feedfloorAvailability.MI325X.statusfloorAvailability.MI325X.urlfloorAvailability.MI325X.versionkindprogramCves.MI210programCves.MI250programCves.MI300AprogramCves.MI300XprogramCves.MI308XprogramCves.MI325XprogramSources.MI210programSources.MI250programSources.MI300AprogramSources.MI300XprogramSources.MI308XprogramSources.MI325Xprograms.MI210programs.MI250programs.MI300Aprograms.MI300Xprograms.MI308Xprograms.MI325Xsource.aIdsource.feedsource.releasedsource.urlsourcesUpstream sources:
New upstream bulletins
The generator found no new bulletin. It reports each deferred bulletin and its written reason on every run, so the decision stays visible.
Effect
that did not change. Read each source link above before you
approve this change.
stay unchanged. The table keeps schema version 1.
Technical terms
minimum: the lowest version of a component that has no knownapplicable vulnerability.
CVE: Common Vulnerabilities and Exposures. A public identifierfor one vulnerability.
CSAF: Common Security Advisory Framework. The machine-readableadvisory format that NVIDIA publishes.
fix availability: the confirmed date when the exact fixedrelease became available from the upstream vendor.
Validation
python3 -m cmax.minimum_refresh --write cmax/scripts/1-audit/minimum-versions.json: pass. Thegenerator stops with an error and writes nothing if a populated
component extracts empty. It also records confirmed or
unconfirmed availability for every generated minimum.
python3 -m pytest -q tests/audit/: pass. The policytests grade each minimum at the minimum and below the minimum.
Merge plan
Design decisions for approval
and correct the generator.
upstream source link above, including the fixed-release link.
Automation notes:
minimum-versions-refreshworkflow made this pull requestfrom run https://github.com/SemiAnalysisAI/ClusterMAX/actions/runs/33299141202.
masterand force-pushes it. Do not add commits to this branch.To change the table, change the generator
cmax/minimum_refresh.py.a workflow token created. Close and reopen this pull request to
start the usual checks.
Note
Medium Risk
Updates audit policy data for Docker Engine and ROCm by GPU program; operators may see new fail or upgrade recommendations without any cluster change.
Overview
Automated daily refresh of
cmax/scripts/1-audit/minimum-versions.jsonso cluster audits track current vendor security floors.Docker now records GHSA-hfg8-hc9c-6c3h and switches provenance from a manual source to the
docker-release-notesfeed (Engine 29 release notes), withsource.majorsset to 29. Minimum 29.7.0 and fix metadata for CVE-2026-17106 are unchanged in substance; attribution and advisory linkage are updated.ROCM gains a full
programMapentry: per-accelerator minimum ROCm versions (MI210–MI325X), mapped CVEs,floorAvailabilitywith confirmed AMD bulletin evidence, andsourcesspanning AMD-SB-6018, 6024, and 6027. Clusters below these program-specific floors can start failing audit after the grace window.The file
generatedtimestamp moves to 2026-08-30;nvhpcappears only as JSON reordering alongside the new rocm block.Reviewed by Cursor Bugbot for commit d712484. Bugbot is set up for automated code reviews on this repo. Configure here.