Repository navigation
chore(audit): refresh the minimum version table - #115
Merged
Merged
Conversation
The daily refresh job read the upstream advisory feeds and wrote the new minimums.
github-actions
Bot
requested review from
JordanNanos,
Prathmesh234,
aliencaocao and
samharshe
as code owners
November 7, 2026 07:27
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
The audit compares each cluster component against a minimum safe
version, which this repository calls a minimum. The upstream vendors
publish new advisories, and the minimums must follow them. The daily
refresh job made this pull request.
What changed
Discovered Ubuntu kernel CVEs
The refresh found these kernel CVEs on the Ubuntu tracker (priority critical, or high with CVSS 9.0 or more). Counts are the changed per-kernel rows by tracker state. Review each new CVE before merge.
cmax/scripts/1-audit/minimum-versions.json: 138 values changed in 3 components.ubuntuJammy
packages.linuxSctpSendall.prioritypackages.linuxSctpSendallAllwinner5_19.prioritypackages.linuxSctpSendallAws.prioritypackages.linuxSctpSendallAws5_19.prioritypackages.linuxSctpSendallAws6_2.prioritypackages.linuxSctpSendallAws6_5.prioritypackages.linuxSctpSendallAws6_8.prioritypackages.linuxSctpSendallAwsFips.prioritypackages.linuxSctpSendallAzure.prioritypackages.linuxSctpSendallAzure5_19.prioritypackages.linuxSctpSendallAzure6_2.prioritypackages.linuxSctpSendallAzure6_5.prioritypackages.linuxSctpSendallAzure6_8.prioritypackages.linuxSctpSendallAzureFde.prioritypackages.linuxSctpSendallAzureFde5_19.prioritypackages.linuxSctpSendallAzureFde6_2.prioritypackages.linuxSctpSendallAzureFde6_8.prioritypackages.linuxSctpSendallAzureFips.prioritypackages.linuxSctpSendallFips.prioritypackages.linuxSctpSendallGcp.prioritypackages.linuxSctpSendallGcp5_19.prioritypackages.linuxSctpSendallGcp6_2.prioritypackages.linuxSctpSendallGcp6_5.prioritypackages.linuxSctpSendallGcp6_8.prioritypackages.linuxSctpSendallGcpFips.prioritypackages.linuxSctpSendallGke.prioritypackages.linuxSctpSendallGkeop.prioritypackages.linuxSctpSendallHwe5_19.prioritypackages.linuxSctpSendallHwe6_2.prioritypackages.linuxSctpSendallHwe6_5.prioritypackages.linuxSctpSendallHwe6_8.prioritypackages.linuxSctpSendallIbm.prioritypackages.linuxSctpSendallIbm6_8.prioritypackages.linuxSctpSendallIntelIotRealtime.prioritypackages.linuxSctpSendallIntelIotg.prioritypackages.linuxSctpSendallKvm.prioritypackages.linuxSctpSendallLowlatency.prioritypackages.linuxSctpSendallLowlatencyHwe5_19.prioritypackages.linuxSctpSendallLowlatencyHwe6_2.prioritypackages.linuxSctpSendallLowlatencyHwe6_5.prioritypackages.linuxSctpSendallLowlatencyHwe6_8.prioritypackages.linuxSctpSendallNvidia.prioritypackages.linuxSctpSendallNvidia6_2.prioritypackages.linuxSctpSendallNvidia6_5.prioritypackages.linuxSctpSendallNvidia6_8.prioritypackages.linuxSctpSendallNvidiaTegra.prioritypackages.linuxSctpSendallNvidiaTegraIgx.prioritypackages.linuxSctpSendallOem5_17.prioritypackages.linuxSctpSendallOem6_0.prioritypackages.linuxSctpSendallOem6_1.prioritypackages.linuxSctpSendallOem6_5.prioritypackages.linuxSctpSendallOracle.prioritypackages.linuxSctpSendallOracle6_5.prioritypackages.linuxSctpSendallOracle6_8.prioritypackages.linuxSctpSendallRaspi.prioritypackages.linuxSctpSendallRealtime.prioritypackages.linuxSctpSendallRealtime6_8.prioritypackages.linuxSctpSendallStarfive5_19.prioritypackages.linuxSctpSendallStarfive6_2.prioritypackages.linuxSctpSendallStarfive6_5.prioritypackages.linuxSctpSendallXilinxZynqmp.priorityUpstream sources:
ubuntuNoble
packages.linuxIpv4InetOptUafVmware.statuspackages.linuxIpv4InetOptUafVmware.trackerNotepackages.linuxSctpSendall.prioritypackages.linuxSctpSendallAws.prioritypackages.linuxSctpSendallAws6_14.prioritypackages.linuxSctpSendallAws6_17.prioritypackages.linuxSctpSendallAws7_0.prioritypackages.linuxSctpSendallAwsFips.prioritypackages.linuxSctpSendallAzure.prioritypackages.linuxSctpSendallAzure6_11.prioritypackages.linuxSctpSendallAzure6_14.prioritypackages.linuxSctpSendallAzure6_17.prioritypackages.linuxSctpSendallAzure7_0.prioritypackages.linuxSctpSendallAzureFde.prioritypackages.linuxSctpSendallAzureFde6_14.prioritypackages.linuxSctpSendallAzureFde6_17.prioritypackages.linuxSctpSendallAzureFde7_0.prioritypackages.linuxSctpSendallAzureFips.prioritypackages.linuxSctpSendallAzureNvidia.prioritypackages.linuxSctpSendallAzureNvidia6_14.prioritypackages.linuxSctpSendallFips.prioritypackages.linuxSctpSendallGcp.prioritypackages.linuxSctpSendallGcp6_11.prioritypackages.linuxSctpSendallGcp6_14.prioritypackages.linuxSctpSendallGcp6_17.prioritypackages.linuxSctpSendallGcp7_0.prioritypackages.linuxSctpSendallGcpFips.prioritypackages.linuxSctpSendallGke.prioritypackages.linuxSctpSendallGkeop.prioritypackages.linuxSctpSendallHwe6_11.prioritypackages.linuxSctpSendallHwe6_14.prioritypackages.linuxSctpSendallHwe6_17.prioritypackages.linuxSctpSendallHwe7_0.prioritypackages.linuxSctpSendallIbm.prioritypackages.linuxSctpSendallLowlatency.prioritypackages.linuxSctpSendallLowlatencyHwe6_11.prioritypackages.linuxSctpSendallNvidia.prioritypackages.linuxSctpSendallNvidia6_11.prioritypackages.linuxSctpSendallNvidia6_17.prioritypackages.linuxSctpSendallNvidia7_0.prioritypackages.linuxSctpSendallNvidiaLowlatency.prioritypackages.linuxSctpSendallNvidiaTegra.prioritypackages.linuxSctpSendallOem6_11.prioritypackages.linuxSctpSendallOem6_14.prioritypackages.linuxSctpSendallOem6_17.prioritypackages.linuxSctpSendallOem6_8.prioritypackages.linuxSctpSendallOracle.prioritypackages.linuxSctpSendallOracle6_14.prioritypackages.linuxSctpSendallOracle6_17.prioritypackages.linuxSctpSendallOracle7_0.prioritypackages.linuxSctpSendallRaspi.prioritypackages.linuxSctpSendallRaspiRealtime.prioritypackages.linuxSctpSendallRealtime.prioritypackages.linuxSctpSendallRealtime6_14.prioritypackages.linuxSctpSendallRealtime6_17.prioritypackages.linuxSctpSendallVmware.abipackages.linuxSctpSendallVmware.fixAvailability.feedpackages.linuxSctpSendallVmware.fixAvailability.statuspackages.linuxSctpSendallVmware.fixAvailability.urlpackages.linuxSctpSendallVmware.fixAvailability.versionpackages.linuxSctpSendallVmware.fixedpackages.linuxSctpSendallVmware.prioritypackages.linuxSctpSendallVmware.statuspackages.linuxSctpSendallXilinx.priorityUpstream sources:
ubuntuResolute
packages.linuxSctpSendall.prioritypackages.linuxSctpSendallAws.prioritypackages.linuxSctpSendallAzure.prioritypackages.linuxSctpSendallAzureFde.prioritypackages.linuxSctpSendallGcp.prioritypackages.linuxSctpSendallGke.prioritypackages.linuxSctpSendallIbm.prioritypackages.linuxSctpSendallNvidia.prioritypackages.linuxSctpSendallNvidiaBos.prioritypackages.linuxSctpSendallOem7_0.prioritypackages.linuxSctpSendallOracle.prioritypackages.linuxSctpSendallRaspi.prioritypackages.linuxSctpSendallRealtime.priorityUpstream sources:
New upstream bulletins
The generator found no new relevant bulletin.
Effect
that did not change. Read each source link above before you
approve this change.
stay unchanged. The table keeps schema version 1.
Technical terms
minimum: the lowest version of a component that has no knownapplicable vulnerability.
CVE: Common Vulnerabilities and Exposures. A public identifierfor one vulnerability.
CSAF: Common Security Advisory Framework. The machine-readableadvisory format that NVIDIA publishes.
fix availability: the confirmed date when the exact fixedrelease became available from the upstream vendor.
Validation
python3 -m cmax.minimum_refresh --write cmax/scripts/1-audit/minimum-versions.json: pass. Thegenerator stops with an error and writes nothing if a populated
component extracts empty. It also records confirmed or
unconfirmed availability for every generated minimum.
python3 -m pytest -q tests/audit/: pass. The policytests grade each minimum at the minimum and below the minimum.
Merge plan
Design decisions for approval
and correct the generator.
upstream source link above, including the fixed-release link.
Automation notes:
minimum-versions-refreshworkflow made this pull requestfrom run https://github.com/SemiAnalysisAI/ClusterMAX/actions/runs/42350793910.
masterand force-pushes it. Do not add commits to this branch.To change the table, change the generator
cmax/minimum_refresh.py.a workflow token created. Close and reopen this pull request to
start the usual checks.