Repository navigation
chore(audit): refresh the minimum version table - #85
Merged
Merged
Conversation
The daily refresh job read the upstream advisory feeds and wrote the new minimums.
github-actions
Bot
requested review from
JordanNanos,
Prathmesh234 and
samharshe
as code owners
October 26, 2026 09:52
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
The audit compares each cluster component against a minimum safe
version, which this repository calls a minimum. The upstream vendors
publish new advisories, and the minimums must follow them. The daily
refresh job made this pull request.
What changed
cmax/scripts/1-audit/minimum-versions.json: 218 values changed in 6 components.connectxFirmware
sourcesUpstream sources:
nvidiaDriver
advisorybranchSources.580branchSources.595branchSources.610branchSources.615branches.580branches.595branches.610branches.615floorAvailability.580.availablefloorAvailability.580.bulletinReleasedfloorAvailability.580.tagfloorAvailability.580.urlfloorAvailability.580.versionfloorAvailability.595.availablefloorAvailability.595.bulletinReleasedfloorAvailability.595.tagfloorAvailability.595.urlfloorAvailability.595.versionfloorAvailability.610.availablefloorAvailability.610.bulletinReleasedfloorAvailability.610.feedfloorAvailability.610.repofloorAvailability.610.statusfloorAvailability.610.tagfloorAvailability.610.urlfloorAvailability.610.versionfloorAvailability.615.availablefloorAvailability.615.bulletinReleasedfloorAvailability.615.feedfloorAvailability.615.repofloorAvailability.615.statusfloorAvailability.615.tagfloorAvailability.615.urlfloorAvailability.615.versionsource.aIdsource.releasedsource.titlesource.urlsourcesUpstream sources:
rocm
advisorycvesfloorAvailability.MI210.aIdfloorAvailability.MI210.availablefloorAvailability.MI210.bulletinReleasedfloorAvailability.MI210.urlfloorAvailability.MI210.versionfloorAvailability.MI250.aIdfloorAvailability.MI250.availablefloorAvailability.MI250.bulletinReleasedfloorAvailability.MI250.urlfloorAvailability.MI250.versionfloorAvailability.MI250X.aIdfloorAvailability.MI250X.availablefloorAvailability.MI250X.bulletinReleasedfloorAvailability.MI250X.feedfloorAvailability.MI250X.statusfloorAvailability.MI250X.urlfloorAvailability.MI250X.versionfloorAvailability.MI300A.aIdfloorAvailability.MI300A.availablefloorAvailability.MI300A.bulletinReleasedfloorAvailability.MI300A.urlfloorAvailability.MI300A.versionfloorAvailability.MI300X.aIdfloorAvailability.MI300X.availablefloorAvailability.MI300X.bulletinReleasedfloorAvailability.MI300X.urlfloorAvailability.MI300X.versionfloorAvailability.MI308X.aIdfloorAvailability.MI308X.availablefloorAvailability.MI308X.bulletinReleasedfloorAvailability.MI308X.urlfloorAvailability.MI308X.versionfloorAvailability.MI325X.aIdfloorAvailability.MI325X.availablefloorAvailability.MI325X.bulletinReleasedfloorAvailability.MI325X.urlfloorAvailability.MI325X.versionfloorAvailability.MI350X.aIdfloorAvailability.MI350X.availablefloorAvailability.MI350X.bulletinReleasedfloorAvailability.MI350X.feedfloorAvailability.MI350X.statusfloorAvailability.MI350X.urlfloorAvailability.MI350X.versionfloorAvailability.MI355X.aIdfloorAvailability.MI355X.availablefloorAvailability.MI355X.bulletinReleasedfloorAvailability.MI355X.feedfloorAvailability.MI355X.statusfloorAvailability.MI355X.urlfloorAvailability.MI355X.versionprogramCves.MI210programCves.MI250programCves.MI250XprogramCves.MI300AprogramCves.MI300XprogramCves.MI308XprogramCves.MI325XprogramCves.MI350XprogramCves.MI355XprogramSources.MI210programSources.MI250programSources.MI250XprogramSources.MI300AprogramSources.MI300XprogramSources.MI308XprogramSources.MI325XprogramSources.MI350XprogramSources.MI355Xprograms.MI210programs.MI250programs.MI250Xprograms.MI300Aprograms.MI300Xprograms.MI308Xprograms.MI325Xprograms.MI350Xprograms.MI355Xsource.aIdsource.releasedsource.urlsourcesUpstream sources:
ubuntuJammy
advisorypackages.linuxBadEpoll.fixAvailability.availablepackages.linuxBadEpoll.fixAvailability.bulletinReleasedpackages.linuxBadEpoll.fixAvailability.feedpackages.linuxBadEpoll.fixAvailability.idpackages.linuxBadEpoll.fixAvailability.statuspackages.linuxBadEpoll.fixAvailability.urlpackages.linuxBadEpoll.fixAvailability.versionpackages.linuxBadEpoll.releasedpackages.linuxBadEpoll.source.feedpackages.linuxBadEpoll.source.idpackages.linuxBadEpoll.source.urlpackages.linuxPwnescape.source.feedpackages.linuxPwnescape.source.reviewedAtpackages.linuxPwnescape.source.urlsource.feedsource.urlUpstream sources:
ubuntuNoble
packages.linux.abipackages.linux.coverage.feedpackages.linux.coverage.matchedNoticespackages.linux.coverage.querypackages.linux.cveCountpackages.linux.fixAvailability.availablepackages.linux.fixAvailability.bulletinReleasedpackages.linux.fixAvailability.feedpackages.linux.fixAvailability.idpackages.linux.fixAvailability.statuspackages.linux.fixAvailability.urlpackages.linux.fixAvailability.versionpackages.linux.fixedpackages.linux.packagepackages.linux.releasedpackages.linux.source.feedpackages.linux.source.idpackages.linux.source.urlpackages.linux.statuspackages.linuxBadEpoll.fixAvailability.availablepackages.linuxBadEpoll.fixAvailability.bulletinReleasedpackages.linuxBadEpoll.fixAvailability.feedpackages.linuxBadEpoll.fixAvailability.idpackages.linuxBadEpoll.fixAvailability.statuspackages.linuxBadEpoll.fixAvailability.urlpackages.linuxBadEpoll.fixAvailability.versionpackages.linuxBadEpoll.releasedpackages.linuxBadEpoll.source.feedpackages.linuxBadEpoll.source.idpackages.linuxBadEpoll.source.urlpackages.linuxBadEpollNvidia617.fixAvailability.availablepackages.linuxBadEpollNvidia617.fixAvailability.bulletinReleasedpackages.linuxBadEpollNvidia617.fixAvailability.feedpackages.linuxBadEpollNvidia617.fixAvailability.idpackages.linuxBadEpollNvidia617.fixAvailability.statuspackages.linuxBadEpollNvidia617.fixAvailability.urlpackages.linuxBadEpollNvidia617.fixAvailability.versionpackages.linuxBadEpollNvidia617.releasedpackages.linuxBadEpollNvidia617.source.feedpackages.linuxBadEpollNvidia617.source.idpackages.linuxBadEpollNvidia617.source.urlpackages.linuxFragnesiaNvidia617.fixAvailability.availablepackages.linuxFragnesiaNvidia617.fixAvailability.bulletinReleasedpackages.linuxFragnesiaNvidia617.fixAvailability.feedpackages.linuxFragnesiaNvidia617.fixAvailability.idpackages.linuxFragnesiaNvidia617.fixAvailability.statuspackages.linuxFragnesiaNvidia617.fixAvailability.urlpackages.linuxFragnesiaNvidia617.fixAvailability.versionpackages.linuxFragnesiaNvidia617.releasedpackages.linuxFragnesiaNvidia617.source.feedpackages.linuxFragnesiaNvidia617.source.idpackages.linuxFragnesiaNvidia617.source.urlpackages.linuxPwnescape.fixAvailability.urlpackages.linuxPwnescape.source.feedpackages.linuxPwnescape.source.reviewedAtpackages.linuxPwnescape.source.urlpackages.qemu.coverage.feedpackages.qemu.coverage.matchedNoticespackages.qemu.coverage.querypackages.qemu.cveCountpackages.qemu.fixAvailability.availablepackages.qemu.fixAvailability.bulletinReleasedpackages.qemu.fixAvailability.idpackages.qemu.fixAvailability.urlpackages.qemu.fixAvailability.versionpackages.qemu.fixedpackages.qemu.prioritypackages.qemu.releasedpackages.qemu.source.idpackages.qemu.source.urlsource.feedsource.urlUpstream sources:
ubuntuResolute
packages.linuxPwnescape.fixAvailability.urlpackages.linuxPwnescape.source.feedpackages.linuxPwnescape.source.reviewedAtpackages.linuxPwnescape.source.urlUpstream sources:
New upstream bulletins
The generator found no new bulletin. It reports each deferred bulletin and its written reason on every run, so the decision stays visible.
Effect
that did not change. Read each source link above before you
approve this change.
stay unchanged. The table keeps schema version 1.
Technical terms
minimum: the lowest version of a component that has no knownapplicable vulnerability.
CVE: Common Vulnerabilities and Exposures. A public identifierfor one vulnerability.
CSAF: Common Security Advisory Framework. The machine-readableadvisory format that NVIDIA publishes.
fix availability: the confirmed date when the exact fixedrelease became available from the upstream vendor.
Validation
python3 -m cmax.minimum_refresh --write cmax/scripts/1-audit/minimum-versions.json: pass. Thegenerator stops with an error and writes nothing if a populated
component extracts empty. It also records confirmed or
unconfirmed availability for every generated minimum.
python3 -m pytest -q tests/audit/: pass. The policytests grade each minimum at the minimum and below the minimum.
Merge plan
Design decisions for approval
and correct the generator.
upstream source link above, including the fixed-release link.
Automation notes:
minimum-versions-refreshworkflow made this pull requestfrom run https://github.com/SemiAnalysisAI/ClusterMAX/actions/runs/40302687462.
masterand force-pushes it. Do not add commits to this branch.To change the table, change the generator
cmax/minimum_refresh.py.a workflow token created. Close and reopen this pull request to
start the usual checks.