docs: refresh downstream usage, repo reach and security guidance (Oct 2026)

[maniator]

Summary

Refresh the 2026-10-14 downstream reference inventory and audit README/security documentation against the actual build and release workflows.

Downstream usage and reach

• 93 distinct public repositories with discoverable image references, counted as 87 in broad GitHub code search, 5 more found only through targeted exact-tag queries, and 1 additional directly verified cidx documentation reference.
• 31 GitHub-code-search-visible repositories with fully qualified version pins, 1 extra supplemental v2.95 mention, 10 literal :latest references, and 51 other/untagged-only code-search references.
• Version-by-version table and linked repository evidence, plus comparison with the June 2026 report; corrected June latest/untagged count to 30 and quantified 29 of 31 fully qualified pins older than v2.100.0.
• Complete 93-repository popularity and activity appendix, including each repository's stars, forks and latest push; a distribution summary; and selected examples such as NVIDIA/Megatron-LM (18,151 stars) and MockServer (4,989). Stars/forks do not equal image users.
• External-web research includes Docker Hub (500K+ rounded aggregate pulls), a HOTOSM development-docs usage example, a Stack Overflow answer (author account Naftali, not treated as independently verified adoption), market.dev's directory, upstream GitHub CLI discussion, and the cidx pin. No independent off-GitHub-hosted code consumer verified. Docker Hub overview still contains stale serveside/gh and token/home-mount examples.
• Notes on copied/vendored Megatron CI files, search caps and indexing lag, and the distinction between a repository string match and active image deployments.

Documentation audit

• SECURITY.md: correct daily/weekly tag refresh behavior; clarify that rolling minor tags stop receiving updates after upstream moves on, and that running/pulled images must be repulled/redeployed. Accurately describe informational vs blocking Trivy gates and distinguish the rechecked October 14 upstream advisories for CVE-2025-15558 (Windows-only path) and CVE-2025-60876 (Alpine 3.24 BusyBox possibly vulnerable) from an actual published-image/digest scan, which was not run.
• README.md: fix old serveside/gh reference, clarify exact/rolling/digest tag semantics, avoid passing a token literal on the command line, avoid mounting the whole home directory, and replace the placeholder Kubernetes sample with a Secret-backed one.
• No application/runtime code, workflow, VEX assertion, or vulnerability resolution was changed. GitHub README updates do not automatically guarantee that the separately managed Docker Hub overview or market.dev cache refreshes.

Verification

• Reviewed Dockerfile, hooks/scripts/set_tags, hooks/scripts/rebuild_recent, and the build/refresh/Trivy/Hadolint/ShellCheck workflow definitions against the new docs.
• Collected tagged references with additional targeted GitHub searches and direct source inspection, avoiding unsupported per-version pull-count claims.
• Documentation-only PR; no image rebuild or published-image security scan run as part of the research. Upstream advisories were independently rechecked on October 14.
• Please review the measured counts and security wording before merging.

Not merging automatically.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.