docs: add release notes and container docs for CVE fixes (PR #1612) - #1733
Merged
Conversation
Document four HIGH-severity CVE fixes (nemo-toolkit RCE, xgrammar DoS, jackson-core DoS) and dependency updates (pynvml removal) in the 26.04 release notes. Add security hardening section to container environments page for the ray_dist.jar removal. Signed-off-by: Lawrence Lane <llane@nvidia.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Lawrence Lane <llane@nvidia.com>
ayushdg
requested changes
Apr 3, 2026
| - **uv**: Added minimum required version (>=0.7.0) to prevent lockfile revision drift | ||
| - **nemo-toolkit**: Bumped `nemo_toolkit[asr]` from `==2.4.0` to `>=2.7.2` to address deserialization CVEs. Only affects `audio_cpu` and `audio_cuda12` extras. | ||
| - **xgrammar**: Moved from `constraint-dependencies` (`>=0.1.21`) to `override-dependencies` (`>=0.1.32`) to override vLLM's pinned version and address CVE-2026-25048. | ||
| - **pynvml**: Removed redundant `pynvml` dependency from the `cuda12` extra since `nvidia-ml-py` already provides the same functionality. |
Contributor
There was a problem hiding this comment.
not needed. This was accidentally added this release and wasn't there in the previous release.
Remove pynvml entry from Dependency Updates — it was accidentally added this release and was not present in the previous release. Signed-off-by: Logan Lane <llane@nvidia.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Lawrence Lane <llane@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Add 26.04 fern documentation for the four HIGH-severity CVE fixes introduced in PR #1612. Adds a new "Security Fixes" section to the release notes covering nemo-toolkit RCE, xgrammar DoS, and jackson-core DoS vulnerabilities. Adds dependency update line items for nemo-toolkit, xgrammar, and pynvml removal. Adds a "Security Hardening" section to the container environments page documenting the
ray_dist.jarremoval and build-time verification guard.Checklist