npm - model-orchestrator - Versions diffs - 1.0.3 → 1.0.4 - Mend

model-orchestrator 1.0.3 → 1.0.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

package/CHANGELOG.md +12 -1
package/README.md +1 -1
package/docs/catalog-advisories.md +2 -0
package/docs/catalog-advisory-exceptions.json +1019 -1
package/docs/catalog.md +1 -1
package/package.json +1 -1
package/src/catalog.js +3 -3

package/CHANGELOG.md CHANGED Viewed

@@ -4,6 +4,16 @@ All notable changes to this project are documented here. The format follows [Kee
 ## [Unreleased]
+## [1.0.4] - 2026-09-28
+### Security
+- Level 3 images move to `ghcr.io/berriai/litellm:v1.100.3` (from v1.99.1, 23 advisories to 9) and `ollama/ollama:0.34.4` (from 0.33.3). The advisories still inside those vendor images are recorded as reviewed exceptions that expire on 2026-10-28, so the check flags anything new and asks for a fresh review then.
+### Fixed
+- The container advisory check records a Go binary's own unversioned module by name instead of reporting the whole image as unknown; any other package without a version still makes the image unknown.
 ## [1.0.3] - 2026-09-28
 ### Security
@@ -540,7 +550,8 @@ First release.
 - Tests: a case per fix, judges proven to go red, mutation checks; `npm test` prints the current count.
 - Adversarial audit: two Codex rounds plus a two-engine review (Codex, Antigravity); findings and fixes in `docs/audit-brief.md`. After the review: subagents go to the project root (`--project`), snippet paths computed from `--dir`, lane sections rendered from the selection, a primary agent required, level 3 asks for API keys separately from CLIs, images and CLI installs pinned, an activation summary at the end of every install.
-[Unreleased]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.3...HEAD
+[Unreleased]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.4...HEAD
+[1.0.4]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.3...v1.0.4
 [1.0.3]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.2...v1.0.3
 [1.0.2]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.1...v1.0.2
 [1.0.1]: https://github.com/aunysillyme/model-orchestrator/compare/v1.0.0...v1.0.1

package/README.md CHANGED Viewed

@@ -239,7 +239,7 @@ The lane wiring and the output judges were written against these versions, which
 | `grok` | xAI | 1.0.5 | `test/fixtures/grok-1.0.5.json`, a recorded run |
 | `hermes` | Nous Research | 0.20.0 | `test/fixtures/hermes-0.20.0.txt`, a recorded run |
 | `qwen` | Alibaba | 0.22.3 | `test/fixtures/qwen-0.22.3-nokey.json`, a recorded run |
-| `ollama` | Ollama | 0.33.3 | the pinned image the level 3 box runs, `ollama/ollama:0.33.3` |
+| `ollama` | Ollama | 0.34.4 | the pinned image the level 3 box runs, `ollama/ollama:0.34.4` |
 Generated from `src/catalog.js` by `npm run gen:catalog`; `npm test` fails if this table and the catalog disagree. Fixtures were captured 2026-09-06.

package/docs/catalog-advisories.md CHANGED Viewed

@@ -59,6 +59,8 @@ GitHub Actions is the watcher. A maintainer reviews every affected or unknown re
 | unknown | Missing, unavailable, unsupported or malformed evidence, or an invalid exception policy | 2 |
 | excepted | Every advisory match has an exact, reviewed, unexpired exception | 0 if every result is clean or excepted |
+A Go binary built without module version stamping lists its own main module with no version (Trivy marks it `Relationship: root` in a language-package result). Its dependencies are still listed and scanned, so that one entry is recorded by name in `unversionedRoots` and does not make the image unknown. Any other package without a version keeps the image unknown.
 Any unknown takes precedence over affected for the exit code. Known advisory IDs are still retained when a detail lookup fails. Empty results never pass. Read the exclusions alongside the status; exclusions are never counted as clean pins.
 ## Failure modes

package/docs/catalog-advisory-exceptions.json CHANGED Viewed

@@ -1 +1,1019 @@
-[]
+[
+  {
+    "ecosystem": "wolfi",
+    "package": "glibc-2.44",
+    "version": "2.44-r1",
+    "advisory": "CVE-2026-18374",
+    "target": "ghcr.io/berriai/litellm:v1.100.3",
+    "rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "wolfi",
+    "package": "glibc-2.44",
+    "version": "2.44-r1",
+    "advisory": "CVE-2026-19499",
+    "target": "ghcr.io/berriai/litellm:v1.100.3",
+    "rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "wolfi",
+    "package": "glibc-2.44-locale-posix",
+    "version": "2.44-r1",
+    "advisory": "CVE-2026-18374",
+    "target": "ghcr.io/berriai/litellm:v1.100.3",
+    "rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "wolfi",
+    "package": "glibc-2.44-locale-posix",
+    "version": "2.44-r1",
+    "advisory": "CVE-2026-19499",
+    "target": "ghcr.io/berriai/litellm:v1.100.3",
+    "rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "wolfi",
+    "package": "ld-linux-2.44",
+    "version": "2.44-r1",
+    "advisory": "CVE-2026-18374",
+    "target": "ghcr.io/berriai/litellm:v1.100.3",
+    "rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "wolfi",
+    "package": "ld-linux-2.44",
+    "version": "2.44-r1",
+    "advisory": "CVE-2026-19499",
+    "target": "ghcr.io/berriai/litellm:v1.100.3",
+    "rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "wolfi",
+    "package": "libcrypt1-2.44",
+    "version": "2.44-r1",
+    "advisory": "CVE-2026-18374",
+    "target": "ghcr.io/berriai/litellm:v1.100.3",
+    "rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "wolfi",
+    "package": "libcrypt1-2.44",
+    "version": "2.44-r1",
+    "advisory": "CVE-2026-19499",
+    "target": "ghcr.io/berriai/litellm:v1.100.3",
+    "rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "wolfi",
+    "package": "zlib",
+    "version": "1.3.2-r5",
+    "advisory": "CVE-2026-85091",
+    "target": "ghcr.io/berriai/litellm:v1.100.3",
+    "rationale": "Inside the vendor's own image. v1.100.3 and the newest v1.103.0 both carry these 9 MEDIUM advisories (Trivy 0.74.0, 2026-09-28); no image without them exists yet. Level 3 gateway only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libc-bin",
+    "version": "2.39-0ubuntu8.9",
+    "advisory": "CVE-2026-18374",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libc-bin",
+    "version": "2.39-0ubuntu8.9",
+    "advisory": "CVE-2026-89092",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libc6",
+    "version": "2.39-0ubuntu8.9",
+    "advisory": "CVE-2026-18374",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libc6",
+    "version": "2.39-0ubuntu8.9",
+    "advisory": "CVE-2026-89092",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libelf1t64",
+    "version": "0.190-1.1ubuntu0.1",
+    "advisory": "CVE-2025-1352",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libelf1t64",
+    "version": "0.190-1.1ubuntu0.1",
+    "advisory": "CVE-2025-1376",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2025-66382",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2026-56131",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2026-56132",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2026-56406",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2026-56407",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2026-56409",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2026-56410",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2026-56411",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2026-66046",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2026-72522",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2026-76641",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libexpat1",
+    "version": "2.6.1-2ubuntu0.5",
+    "advisory": "CVE-2026-76957",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libicu74",
+    "version": "74.2-1ubuntu3.1",
+    "advisory": "CVE-2025-5222",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libpcre2-8-0",
+    "version": "10.42-4ubuntu2.1",
+    "advisory": "CVE-2026-86145",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libpcre2-8-0",
+    "version": "10.42-4ubuntu2.1",
+    "advisory": "CVE-2026-89161",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libsystemd0",
+    "version": "255.4-1ubuntu8.17",
+    "advisory": "CVE-2026-40228",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "libudev1",
+    "version": "255.4-1ubuntu8.17",
+    "advisory": "CVE-2026-40228",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "login",
+    "version": "1:4.13+dfsg1-4ubuntu3.2",
+    "advisory": "CVE-2024-56433",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "passwd",
+    "version": "1:4.13+dfsg1-4ubuntu3.2",
+    "advisory": "CVE-2024-56433",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "perl-base",
+    "version": "5.38.2-3.2ubuntu0.4",
+    "advisory": "CVE-2026-15534",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "perl-base",
+    "version": "5.38.2-3.2ubuntu0.4",
+    "advisory": "CVE-2026-19487",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "tar",
+    "version": "1.35+dfsg-3ubuntu0.4",
+    "advisory": "CVE-2026-18477",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "tar",
+    "version": "1.35+dfsg-3ubuntu0.4",
+    "advisory": "CVE-2026-18508",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "ubuntu",
+    "package": "zlib1g",
+    "version": "1:1.3.dfsg-3.1ubuntu2.2",
+    "advisory": "CVE-2026-85091",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "github.com/buger/jsonparser",
+    "version": "v1.1.1",
+    "advisory": "CVE-2026-32285",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-39828",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-39829",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-39830",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-39831",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-39832",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-39835",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-42508",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-46595",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-46597",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-56854",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2025-47914",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2025-58181",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-39827",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-39833",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-39834",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-46598",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-56855",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "CVE-2026-78662",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/crypto",
+    "version": "v0.43.0",
+    "advisory": "GO-2026-5932",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/image",
+    "version": "v0.22.0",
+    "advisory": "CVE-2026-46602",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/image",
+    "version": "v0.22.0",
+    "advisory": "CVE-2026-46603",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/image",
+    "version": "v0.22.0",
+    "advisory": "CVE-2026-33809",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/image",
+    "version": "v0.22.0",
+    "advisory": "CVE-2026-33812",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/image",
+    "version": "v0.22.0",
+    "advisory": "CVE-2026-33813",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/image",
+    "version": "v0.22.0",
+    "advisory": "CVE-2026-42500",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/image",
+    "version": "v0.22.0",
+    "advisory": "CVE-2026-46599",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/image",
+    "version": "v0.22.0",
+    "advisory": "CVE-2026-46601",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/image",
+    "version": "v0.22.0",
+    "advisory": "CVE-2026-46604",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/mod",
+    "version": "v0.30.0",
+    "advisory": "CVE-2026-56864",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/mod",
+    "version": "v0.30.0",
+    "advisory": "CVE-2026-56865",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/net",
+    "version": "v0.46.0",
+    "advisory": "CVE-2026-25681",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/net",
+    "version": "v0.46.0",
+    "advisory": "CVE-2026-27136",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/net",
+    "version": "v0.46.0",
+    "advisory": "CVE-2026-33814",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/net",
+    "version": "v0.46.0",
+    "advisory": "CVE-2026-39821",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/net",
+    "version": "v0.46.0",
+    "advisory": "CVE-2026-46600",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/net",
+    "version": "v0.46.0",
+    "advisory": "CVE-2026-25680",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/net",
+    "version": "v0.46.0",
+    "advisory": "CVE-2026-42502",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/net",
+    "version": "v0.46.0",
+    "advisory": "CVE-2026-42506",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/sys",
+    "version": "v0.37.0",
+    "advisory": "CVE-2026-39824",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "golang.org/x/text",
+    "version": "v0.30.0",
+    "advisory": "CVE-2026-56852",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-25679",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-27137",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-27145",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-32280",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-32281",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-32283",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-33810",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-33811",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-33814",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-33818",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-39820",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-39821",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-39822",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-39836",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-42499",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-42504",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-46600",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-56853",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-56858",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-56859",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-56860",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-56862",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-27142",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-32282",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-32288",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-32289",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-39823",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-39825",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-39826",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-42505",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-42507",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-27138",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  },
+  {
+    "ecosystem": "gobinary",
+    "package": "stdlib",
+    "version": "v1.26.0",
+    "advisory": "CVE-2026-27139",
+    "target": "ollama/ollama:0.34.4",
+    "rationale": "Inside the vendor's own image, which is the newest release (0.34.4); most are in Go libraries compiled into the ollama binary, so no newer image clears them. Level 3 local model only. Auny's ruling 2026-09-28: upgrade and dated exceptions; re-check at expiry.",
+    "expires": "2026-10-28"
+  }
+]

package/docs/catalog.md CHANGED Viewed

@@ -207,7 +207,7 @@ Generated from `src/catalog.js`. Do not hand-edit; `npm run gen:catalog` rewrite
 - **What it is:** A local model runtime; work sent here stays on the machine
 - **Install:** https://ollama.com/download (or `brew install ollama`)
 - **Sign in:** none
-- **Built against:** 0.33.3
+- **Built against:** 0.34.4
 **Capability facts.** An unverified value needs a current capability check before use. Role assignments come from the selected stack, using these facts.

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "model-orchestrator",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "Model router for AI coding agents: installs routing rules, 8 subagents, hooks and a CLI runner so your AI picks model and effort per task and saves tokens",
   "type": "module",
   "bin": {

package/src/catalog.js CHANGED Viewed

@@ -300,7 +300,7 @@ export const AIS = [
     summary: 'A local model runtime; work sent here stays on the machine',
     minLevel: 2,
     install: { url: 'https://ollama.com/download', brew: 'ollama' },
-    builtAgainst: '0.33.3',
+    builtAgainst: '0.34.4',
     auth: 'none',
     rulesFile: null,
   },
@@ -457,8 +457,8 @@ export const providerById = Object.fromEntries(PROVIDERS.map((p) => [p.id, p]));
 // Container image pins for the level 3 templates. Bump deliberately; a
 // reviewed box should not change underneath the user on a restart.
 export const IMAGES = {
-  litellm: 'ghcr.io/berriai/litellm:v1.99.1',
-  ollama: 'ollama/ollama:0.33.3'
+  litellm: 'ghcr.io/berriai/litellm:v1.100.3',
+  ollama: 'ollama/ollama:0.34.4'
 };
 export const byId = Object.fromEntries(AIS.map((a) => [a.id, a]));