@@ -47,9 +47,9 @@ no-ops every statement in the document.
 - A `Weekly Image Vulnerability Scan` run reports HIGH+ CVE(s) on the
   aiperf-bench image and a maintainer needs to add a suppression after
   verifying reachability.
-- A maintainer bumps the aiperf pin (`AIPERF_VERSION` in
-  `validators/performance/aiperf-bench.Dockerfile`) or its dependency
-  pins, fixing a CVE that was previously suppressed → the entry must be
+- A maintainer bumps the aiperf pin (`validators/performance/requirements.txt`
+  and `AIPERF_VERSION` in `validators/performance/aiperf-bench.Dockerfile`)
+  or its dependency pins, fixing a CVE that was previously suppressed → the entry must be
   removed.
 - A maintainer audits the file before a release to drop stale entries.
 - The scan workflow shows non-zero HIGH+ counts but VEX is "supposed to
@@ -317,9 +317,11 @@ For each ID:
 1. **Check upstream first.** Read the GHSA / NVD page. If a fix has
    shipped in a version reachable from aiperf's pins, the right action
    is usually *not* a VEX entry — it's bumping the aiperf pin so the
-   fix lands and the finding disappears. Bump
-   `AIPERF_VERSION` in `validators/performance/aiperf-bench.Dockerfile`,
-   verify with the local repro above, and skip the rest of this section.
+   fix lands and the finding disappears. Bump `aiperf` in
+   `validators/performance/requirements.txt` and `AIPERF_VERSION` in
+   `validators/performance/aiperf-bench.Dockerfile` together (the build
+   fails on a mismatch), run `make python-licenses`, verify with the local
+   repro above, and skip the rest of this section.
 2. **If a bump isn't feasible**, prove non-reachability. The work that
    must be visible in `impact_statement`:
    - Identify the vulnerable function / file in upstream source.
@@ -453,7 +455,8 @@ goes into the document itself.
   bound)
 - Grype config (excludes for source scans only): `.grype.yaml`
 - Image source: `validators/performance/aiperf-bench.Dockerfile`
-- aiperf pin: `AIPERF_VERSION` ARG in that Dockerfile
+- aiperf pin: `validators/performance/requirements.txt` (what installs) and
+  the `AIPERF_VERSION` ARG in that Dockerfile (must match; Renovate moves both)
 - Grype version pin (read from scan-action): `GrypeVersion.js` at the
   pinned scan-action SHA in the workflow
 - Workflow output format (per image, in scan-N artifact):
 
@@ -82,20 +82,36 @@ deferred_verifications:
       references remain. What is unverified is only whether the CI scan step
       accepts the tag-plus-digest matrix value, not whether the override
       works.
+  - id: aiperf-0.13.0-image-scans-clean-in-ci
+    opened: 2026-09-29
+    check: >-
+      The aiperf 0.13.0 bump retired the 10 pillow statements and
+      GHSA-cq5v-8q36-5273 (0.13.0 resolves pillow 12.3.0 and aiohttp 3.14.3,
+      the fixed versions) and rewrote the CVE-2026-82049 evidence for the
+      0.13.0 closure. Read the aiperf-bench scan-result artifact of the first
+      `Weekly Image Vulnerability Scan` run on main after that PR merged.
+    resolves_when: >-
+      that run's aiperf-bench line reports 0 critical, 0 high and exactly
+      1 VEX-suppressed row (CVE-2026-82049 on python 3.13.15)
+    caveat: >-
+      Measured on a local linux/amd64 build of the branch with grype v0.118.0
+      (the version scan-action v7.4.2 pins), `--fail-on high --only-fixed -c
+      .grype.yaml --vex .openvex.json`, against the 2026-09-29 grype DB. A newer DB in CI can add
+      findings this run could not see; triage those as new, not as a
+      regression of the retirement.
 
 known_negatives:
   - id: no-fixed-cpython-3.13-for-cve-2026-82049
-    checked: 2026-09-21
+    checked: 2026-09-29
     finding: >-
       CVE-2026-82049 (tarfile extraction filters) cannot be remediated by any
       bump available to this image. 3.13.15 is the newest CPython 3.13 release
       (2026-08-05); the advisory published 2026-09-14 and the 3.13 backport
       landed after that release, so grype records the sole fixed version as
       `3.14.0b1` -- which is why `--only-fixed` does not withhold it.
       nvcr.io/nvidia/distroless/python publishes a 3.14-v4.1.4 tag, but aiperf
-      0.11.0 declares `Requires-Python: <3.14,>=3.10` and upstream main still
-      declares `>=3.11,<3.14`, so building the venv on 3.14 fails pip resolution
-      instead of producing a fixed image.
+      0.13.0 still declares `Requires-Python: <3.14,>=3.11`, so building the
+      venv on 3.14 fails pip resolution instead of producing a fixed image.
     also: >-
       The finding is on the base image's interpreter (pkg:generic/python@3.13.15
       at /usr/local/bin/python), not a pip package, so no requirements.txt change
@@ -105,29 +121,6 @@ known_negatives:
       a CPython 3.13.16+ release carrying the backport (then bump the distroless
       3.13 pin and delete the statement), or an aiperf release whose
       Requires-Python admits 3.14 (then the 3.14 base becomes reachable, #1910)
-  - id: aiperf-pins-block-pillow-and-aiohttp-fixes
-    checked: 2026-09-03
-    finding: >-
-      Neither surviving suppression can be remediated by a pin bump. aiperf
-      pins pillow~=12.2.0 while the 10 pillow GHSAs are fixed in 12.3.0, and
-      aiohttp~=3.13.3 (>=3.13.3,<3.14) while GHSA-cq5v-8q36-5273 is fixed in
-      3.14.3. Both caps hold at aiperf 0.11.0 (installed) and 0.12.0 (newest
-      upstream at the time of checking), so requiring a fixed version in
-      validators/performance/requirements.txt would fail pip resolution rather
-      than produce a fixed image.
-    also: >-
-      Both packages arrive through the copied virtualenv layer, not the
-      distroless base, so no base-image bump can retire either statement.
-    update_2026_09_21: >-
-      aiperf upstream main has since relaxed the aiohttp cap to
-      `aiohttp>=3.14.3,<4`, which is past the GHSA-cq5v-8q36-5273 fix. Main is
-      not a release, so the finding stands for now, but the next aiperf release
-      carrying that pyproject.toml very likely retires that one statement. The
-      pillow cap on main is still `pillow~=12.2.0`, so all 10 pillow statements
-      are unaffected by this and stay.
-    invalidated_by: >-
-      an aiperf release later than 0.12.0 that relaxes either cap; re-check
-      pyproject.toml before assuming the suppression is still unavoidable
 
 deliberate_exclusions:
   - id: libexpat1-wont-fix-highs
 
@@ -20,6 +20,8 @@ Policy choices (schedule, cooldown, auto-merge scope, group consolidation) are d
 | `go.mod` | `gomod` (groups: `kubernetes`, `golang-x`, `opencontainers`) |
 | `.github/workflows/*.yaml`, `.github/actions/*/action.yml` | `github-actions` (**disabled** — Dependabot owns workflow / composite-action bumps; Renovate cannot push `.github/workflows/*` with the auto-issued `GITHUB_TOKEN`) |
 | `validators/*/Dockerfile` | `dockerfile` |
+| `validators/performance/requirements.txt` (aiperf) | `pip_requirements` (`aiperf` group) |
+| `validators/performance/aiperf-bench.Dockerfile` `ARG AIPERF_VERSION` | dedicated `pypi` customManager (`aiperf` group, so it moves with `requirements.txt`) |
 | `infra/**/*.tf` | `terraform` (grouped) |
 | `recipes/components/*/values.yaml` | `helm-values` (partial — see limitations) |
 | `recipes/registry.yaml` (35 chart pins) | custom regex manager (`# renovate:` annotations) — **report-only**, see [Registry drift report](#registry-drift-report) |
@@ -134,5 +136,6 @@ This is guidance for a Renovate-owned branch. `AGENTS.md`'s branch-hygiene rule
 
 - **AWS EFA device-plugin image** (`recipes/components/aws-efa/values.yaml`) is published only to AWS's authenticated public ECR (`602401143452.dkr.ecr.us-west-2.amazonaws.com/...`); no `public.ecr.aws` mirror. The image is in `ignoreDeps`; bumps must be coordinated manually with EKS add-on releases.
 - **`recipes/components/*/values.yaml`** is partially covered, and cannot be extended in place. `helm-values` only auto-detects the conventional `image: { repository, tag }` shape. No custom manager's `managerFilePatterns` covers this path, so a `# renovate:` annotation added in one of these files rotates nothing and reports nothing — extending coverage means adding a custom manager, as `.settings.yaml` and `recipes/registry.yaml` each do.
+- **aiperf PRs need a manual license refresh and VEX re-audit.** The committed `validators/performance/licenses/python-notices.md` records the sha256 of `requirements.txt`, so an `aiperf` group PR fails `notices-generator` until a maintainer runs `make python-licenses` (network access to PyPI) and pushes the regenerated fragment; no `postUpgradeTasks` entry regenerates it. The same maintainer must re-audit `.openvex.json` against the new closure with the `aicr-managing-openvex` skill: its statements cite the installed aiperf version as evidence, and nothing gates them against `requirements.txt`.
 - **No vulnerability fast-path.** Self-hosted Renovate cannot consume GitHub vulnerability alerts (Mend-hosted feature). The weekday cron is the mitigation.
 - **The Renovate runner image** (`ghcr.io/renovatebot/renovate`) is not yet auto-managed. The digest is pinned in two places — the `RENOVATE_VALIDATOR_IMAGE` variable in `Makefile` and the `renovate-version` input in the workflow — and must be bumped manually in lockstep. The custom regex doesn't yet capture `image:tag@sha256:...` shapes.
@@ -144,6 +144,19 @@
       ],
       depTypeTemplate: "registry-chart",
     },
+    {
+      // aiperf is pinned twice: validators/performance/requirements.txt (read
+      // by the pip_requirements manager) and the AIPERF_VERSION default in
+      // aiperf-bench.Dockerfile, which the image build requires to match it.
+      // No built-in manager reads a bare ARG, so without this the Dockerfile
+      // copy never moves and every aiperf PR fails its own image build (#2956).
+      // The `aiperf` group below keeps both edits in one PR.
+      customType: "regex",
+      managerFilePatterns: ["/^validators/performance/aiperf-bench\\.Dockerfile$/"],
+      matchStrings: ["(?m)^ARG AIPERF_VERSION=(?<currentValue>\\S+)"],
+      datasourceTemplate: "pypi",
+      depNameTemplate: "aiperf",
+    },
   ],
 
   // Kubernetes manager: scan AICR's component manifests for Pod-spec
@@ -249,6 +262,12 @@
       matchManagers: ["gomod"],
       matchPackageNames: ["github.com/opencontainers/**"],
     },
+    // Cross-manager: requirements.txt (pip_requirements) and the Dockerfile
+    // ARG (custom.regex) must move together; see the aiperf customManager.
+    {
+      groupName: "aiperf",
+      matchPackageNames: ["aiperf"],
+    },
     // Disable the github-actions manager — dependabot owns workflow/action
     // bumps because GitHub's auto-issued GITHUB_TOKEN cannot push changes to
     // `.github/workflows/*` regardless of `permissions:` set in the workflow.
@@ -466,7 +485,7 @@
     // PR #1906 auto-bumped this to 3.14 and broke the UAT validator image
     // build (aiperf's pyzmq/uvloop had no cp314 wheels, and the single-stage
     // image had no toolchain to compile them). Even with the current
-    // multi-stage toolchain, aiperf 0.11.0 declares requires-python <3.14, so
+    // multi-stage toolchain, aiperf 0.13.0 declares requires-python <3.14, so
     // pip refuses to install on 3.14 — the 3.14 move is blocked upstream until
     // aiperf supports it. This cap mirrors that constraint; #1910 tracks
     // lifting it.
 
@@ -39,9 +39,9 @@ exclude:
 # carries the structured status + justification + per-CVE
 # reachability evidence and is self-sufficient for suppression.
 # The image builds on python:3.13-slim (Debian trixie) and ships on
-# nvcr.io/nvidia/distroless/python:3.13-v4.1.4, so suppressed findings
-# now come from pillow and aiohttp in the copied venv only. Base-package
-# findings are answered by bumping this pin, never by a statement: the
+# nvcr.io/nvidia/distroless/python:3.13-v4.1.4. The only suppressed finding
+# is CVE-2026-82049 on that base's CPython 3.13.15, which no 3.13 release
+# fixes yet. Other base-package findings are answered by bumping this pin: the
 # v4.1.4 bump (from v4.1.2) moved glibc 2.41-12+deb13u3 -> u4 and
 # libsqlite3-0 3.46.1-7+deb13u1 -> u2, clearing 6 HIGH+ rows without
 # adding one; the v4.1.2 bump (from v4.1.1) moved openssl
@@ -52,9 +52,9 @@ exclude:
 # When scanning the aiperf-bench image locally, pass `--vex
 # .openvex.json` alongside `-c .grype.yaml`. Scans of the AICR Go
 # source tree (`make scan` → `grype dir:.`) don't need VEX since the
-# suppressed CVEs are all in Python packages (pillow, aiohttp) and
-# never surface against Go source.
-# Reviewed: 2026-09-17
+# suppressed CVE is in the image's CPython interpreter and never
+# surfaces against Go source.
+# Reviewed: 2026-09-29
 
 # Go-source suppressions (accepted risk, not "not affected").
 #