🔒 [IBM OSPO Security Notification] — IBM/application-simulator

[security-ops-bot]

🔒 [IBM OSPO Security Notification] — IBM/application-simulator

Action required: Remediate the alerts listed below before their SLA deadline.
This issue will be closed automatically once all alerts are resolved.

SLA policy: critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
Alerts at or above medium severity will trigger a warning comment before the deadline and
repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
they will never trigger warnings or archiving.

💡 Tip: To have Dependabot automatically open fix PRs for dependency alerts, enable
Dependabot security updates in your repo settings:
Settings → Advanced Security → Dependabot security updates → Enable.

📖 New to this issue? See the Security Issue Guide for a full explanation of what this issue means and what you need to do.

Attention: @kalpshekhar-ibm

Dependabot Alerts

Severity	CVE/GHSA	Package	Affected	Patched	Deadline	Fix PR
🟠 high	CVE-2025-66035	@angular/common	< 19.2.16	19.2.16	2026-10-23	—
🟠 high	CVE-2025-66412	@angular/compiler	<= 18.2.14	—	2026-10-23	—
🟠 high	CVE-2026-22610	@angular/compiler	<= 18.2.14	—	2026-10-23	—
🟠 high	CVE-2026-27970	@angular/core	<= 18.2.14	—	2026-10-23	—
🟠 high	CVE-2026-50171	@angular/common	<= 18.2.14	—	2026-10-23	—
🟠 high	CVE-2026-54266	@angular/common	<= 19.2.25	—	2026-10-23	—
🟠 high	CVE-2026-54267	@angular/core	<= 19.2.25	—	2026-10-23	—
🟠 high	CVE-2026-50170	@angular/common	<= 18.2.14	—	2026-10-23	—
🟠 high	CVE-2026-54268	@angular/common	<= 19.2.25	—	2026-10-23	—
🟠 high	CVE-2026-68945	@angular/common	<= 19.2.25	—	2026-10-23	—
🟠 high	CVE-2026-69151	@angular/compiler	<= 19.2.25	—	2026-10-23	—
🟡 medium	CVE-2022-0437	karma	< 6.3.14	6.3.14	2026-12-22	—
🟡 medium	CVE-2021-23495	karma	< 6.3.16	6.3.16	2026-12-22	—
🟡 medium	CVE-2026-50557	@angular/core	<= 18.2.14	—	2026-12-22	—
🟡 medium	CVE-2026-54265	@angular/compiler	<= 19.2.25	—	2026-12-22	—
🟡 medium	CVE-2026-52725	@angular/core	<= 18.2.14	—	2026-12-22	—
🟡 medium	CVE-2026-88059	@angular/common	<= 19.2.25	—	2026-12-22	—
🟡 medium	CVE-2026-88057	@angular/compiler	<= 19.2.25	—	2026-12-22	—

Code Scanning Alerts

No open code scanning alerts.

Secret Scanning Alerts

No open secret scanning alerts.

---