v2.16
What's Changed
This update is expected to be backward-compatible.
Important
Users should upgrade to this release where possible to get fixes/mitigations for:
- CVE-2026-31431 "copyfail"
- CVE-2026-43284 "dirtyfrag"
- CVE tbd "copyfail 2"
Consider reviewing #946 and making similar changes to your environment/$ENV/activate scripts so that there is no need to cd environments/$ENV/tofu to run OpenTofu commands.
Security & Updates
- Scan images using grype scanner by @sjpb in #937
- Bump tornado package for Jupyter to v6.5.5 by @wtripp180901 in #944
- Upgrade prometheus stack to latest LTS versions by @elelaysh in #943
- Bump CUDA to 13.2.1 and NVIDIA driver to 595.71.05 by @priteau in #939
- Update OS packages in images to get kernels with copy fail resolved by @sjpb in #956
- Add dirtyfrag mitigation to images by @sjpb in #961
General enhancements and fixes
- Validate ansible-galaxy installs are up to date in build by @sjpb in #921
- Sort NHC elements to ensure repeatable ordering by @priteau in #915
- Improve hpctests: account and qos options and allowance for reserved cores for HPL by @elelaysh in #924
- Use pam_slurm_adopt instead of pam_slurm by @elelaysh in #905
- Support Let's Encrypt for Open OnDemand by @priteau in #714
- Make ondemand server config idempotent by @sjpb in #929
- Fix hpctests script templates by @elelaysh in #933
- doca: fix rare failure when Waiting for process by @elelaysh in #930
- basic_users role: Prevent user changes to skeleton-templated files being lost by @sjpb in #941
- Run tofu from anywhere by @jovial in #946
- Fix node health checks failure for auto mounted filesystems by @jovial in #913
- Host Slurm logo image and reference it in ui-meta by @m-bull in #950
- Fixup inventory retrieval adhoc playbook for current OpenTofu config by @sjpb in #951
- Fix pulp sync on RL8 by @sjpb in #958
- Fix cvmfs config templating in eessi role by @MoteHue in #960
- Fix no sssd_packages installed if not sssd_install_ldap by @elelaysh in #959
StackHPC CI & development tools
- Use only ruff for python linting and only black for python formatting by @sjpb in #927
- Add script to run linters locally by @elelaysh in #932
- Deactivate trivy and rotate CI creds by @sjpb in #934
- Enable and fix GitHub action warnings by @elelaysh in #935
- Add a do-nothing scan.yml workflow so can run workflow_dispatch by @sjpb in #938
- Fix typos in linter command references by @jovial in #945
- Add pins from github-actions-list @ e6fd9c5 by @sjpb in #947
- Update GitHub actions versions for organisation allowlist by @sjpb in #954
Full Changelog: v2.15.1...v2.16
Images
Two new images are available:
- RockyLinux 8: openhpc-RL8-260508-1119-0374764b
- RockyLinux 9: openhpc-RL9-260508-1119-0374764b