🔒 [IBM OSPO Security Notification] — IBM/cloud-enterprise-examples

[security-ops-bot]

🔒 [IBM OSPO Security Notification] — IBM/cloud-enterprise-examples

Action required: Remediate the alerts listed below before their SLA deadline.
This issue will be closed automatically once all alerts are resolved.

SLA policy: critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
Alerts at or above medium severity will trigger a warning comment before the deadline and
repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
they will never trigger warnings or archiving.

💡 Tip: To have Dependabot automatically open fix PRs for dependency alerts, enable
Dependabot security updates in your repo settings:
Settings → Advanced Security → Dependabot security updates → Enable.

Attention: @timroster

Dependabot Alerts

Severity	CVE/GHSA	Package	Affected	Patched	Deadline	Fix PR
🔴 critical	CVE-2026-53486	decompress	<= 4.2.1	—	2026-09-28	—
🔴 critical	CVE-2026-54466	websocket-driver	< 0.7.5	0.7.5	2026-09-23	—
🔴 critical	CVE-2026-59873	tar	<= 7.5.18	7.5.19	2026-09-23	—
🟠 high	CVE-2026-13149	brace-expansion	< 1.1.16	1.1.16	2026-10-16	—
🟠 high	CVE-2026-73650	svgo	>= 1.0.0, < 2.8.3	2.8.3	2026-10-16	—
🟠 high	CVE-2026-59874	tar	<= 7.5.17	7.5.18	2026-10-16	—
🟠 high	CVE-2026-13311	shell-quote	<= 1.8.4	1.9.0	2026-10-16	—
🟠 high	GHSA-f88m-g3jw-g9cj	sharp	< 0.35.0	0.35.0	2026-10-16	—
🟠 high	CVE-2026-59869	js-yaml	>= 3.0.0, < 3.15.0	3.15.0	2026-10-16	—
🟠 high	CVE-2026-73566	tar	<= 7.5.20	7.5.21	2026-10-16	—
🟠 high	CVE-2026-45623	postcss	<= 8.5.11	8.5.12	2026-10-16	—
🟠 high	CVE-2026-73646	postcss	<= 8.5.17	8.5.18	2026-10-17	—
🟠 high	CVE-2026-69185	socket.io-parser	>= 3.4.0, < 3.4.5	3.4.5	2026-10-17	—
🟠 high	CVE-2026-69152	brace-expansion	< 1.1.18	1.1.18	2026-10-17	—
🟠 high	CVE-2026-14257	brace-expansion	< 1.1.17	1.1.17	2026-10-17	—
🟠 high	GHSA-5p4m-2wfm-xmqj	js-yaml	>= 3.0.0, < 3.15.1	3.15.1	2026-10-16	—
🟠 high	CVE-2026-59880	immutable	< 3.8.4	3.8.4	2026-10-10	—
🟠 high	CVE-2026-73089	browserslist	<= 4.28.6	4.28.7	2026-10-10	—
🟠 high	CVE-2026-73088	browserslist	<= 4.28.6	4.28.7	2026-10-10	—
🟠 high	CVE-2026-84370	svgo	>= 1.0.0, < 2.8.4	2.8.4	2026-10-10	—
🟠 high	GHSA-rgj7-g3m4-5g8c	sharp	< 0.35.4	0.35.4	2026-10-10	—
🟠 high	CVE-2026-84375	js-yaml	>= 3.0.0, < 3.15.2	3.15.2	2026-10-13	—
🟠 high	CVE-2026-59879	immutable	< 3.8.4	3.8.4	2026-10-16	—
🟡 medium	CVE-2026-53550	js-yaml	< 3.15.0	3.15.0	2026-12-20	—
🟡 medium	CVE-2026-54490	websocket-driver	< 0.7.5	0.7.5	2026-12-15	—
🟡 medium	CVE-2026-14620	webpack-dev-server	<= 5.2.5	5.2.6	2026-12-15	—
🟡 medium	CVE-2026-14631	webpack-dev-server	<= 5.2.5	5.2.6	2026-12-15	—
🟡 medium	CVE-2026-59875	tar	<= 7.5.16	7.5.17	2026-12-15	—
🟡 medium	CVE-2026-59871	tar	<= 7.5.17	7.5.18	2026-12-15	—
🟡 medium	CVE-2026-67316	axios	< 0.33.0	0.33.0	2026-12-15	—
🟡 medium	CVE-2026-67319	axios	>= 0.8.0, < 0.33.0	0.33.0	2026-12-15	—
🟡 medium	CVE-2026-10732	decompress	<= 4.2.1	—	2026-12-16	—
🟡 medium	CVE-2026-69153	postcss	<= 8.5.22	8.5.23	2026-12-16	—
🟡 medium	CVE-2026-39243	decompress	<= 4.2.1	—	2026-12-15	—
🟡 medium	CVE-2026-45822	decode-uri-component	<= 0.4.2	0.5.0	2026-12-15	—
🟡 medium	CVE-2026-82417	qs	>= 2.2.5, < 6.16.0	6.16.0	2026-12-09	—
🟡 medium	CVE-2026-84369	svgo	>= 1.0.0, < 2.8.4	2.8.4	2026-12-09	—
🔵 low	CVE-2026-12590	body-parser	< 1.20.6	1.20.6	—	—

Code Scanning Alerts

Severity	Rule	Tool	Deadline
🟠 high	py/clear-text-logging-sensitive-data	CodeQL	2026-10-09
🟠 high	py/clear-text-logging-sensitive-data	CodeQL	2026-10-09
🟠 high	py/clear-text-logging-sensitive-data	CodeQL	2026-10-09

Secret Scanning Alerts

No open secret scanning alerts.

---

[security-ops-bot]

🔄 Dependabot Alert Changes

Added: CVE-2023-30548 (medium), CVE-2023-34238 (medium), CVE-2022-37611 (critical), CVE-2024-53382 (medium), CVE-2024-12905 (high), CVE-2025-48387 (high), CVE-2025-30359 (medium), CVE-2025-30360 (medium), CVE-2025-6545 (critical), CVE-2025-7339 (low), CVE-2025-7783 (critical), CVE-2025-54798 (low), CVE-2025-9287 (critical), CVE-2025-9288 (critical), CVE-2025-59343 (high), CVE-2025-57352 (low), CVE-2020-28500 (medium), CVE-2025-64718 (medium), CVE-2025-66030 (medium), CVE-2025-12816 (high), CVE-2025-66031 (high), CVE-2025-15284 (medium), CVE-2025-14505 (low), CVE-2026-23745 (high), CVE-2026-23950 (high), CVE-2025-13465 (medium), CVE-2026-24842 (high), CVE-2021-27515 (medium), CVE-2022-0691 (medium), CVE-2021-3664 (medium), CVE-2022-25883 (high), CVE-2026-2391 (low), CVE-2025-6547 (critical), CVE-2026-26960 (high), CVE-2026-25639 (high), CVE-2022-0639 (medium), CVE-2022-0512 (medium), CVE-2025-69873 (medium), CVE-2026-2739 (medium), CVE-2026-26996 (high), CVE-2026-27903 (high), CVE-2026-27904 (high), GHSA-5c6j-r48x-rmvq (high), CVE-2026-29786 (high), CVE-2026-29063 (high), CVE-2026-31802 (high), CVE-2026-32141 (high), CVE-2026-33151 (high), CVE-2026-33228 (high), CVE-2026-33532 (medium), CVE-2026-33895 (high), CVE-2026-33891 (high), CVE-2026-33894 (high), CVE-2026-33896 (high), CVE-2026-44490 (medium), CVE-2026-44496 (high), CVE-2026-44486 (high), CVE-2026-44487 (high), CVE-2026-44495 (high), CVE-2026-44492 (high), CVE-2026-9277 (critical), CVE-2026-41305 (medium), CVE-2026-12143 (high), CVE-2026-48779 (high), CVE-2026-9595 (medium), CVE-2026-53655 (medium), CVE-2026-49356 (low), CVE-2026-55602 (medium), CVE-2026-53550 (medium), CVE-2026-53486 (critical), CVE-2026-54466 (critical), CVE-2026-54490 (medium), CVE-2026-13149 (high), CVE-2026-73650 (high), CVE-2026-59874 (high), CVE-2026-59879 (high), CVE-2026-14620 (medium), CVE-2026-14631 (medium), CVE-2026-59875 (medium), CVE-2026-59873 (critical), CVE-2026-59871 (medium), CVE-2026-13311 (high), CVE-2026-67316 (medium), CVE-2026-67319 (medium), GHSA-f88m-g3jw-g9cj (high), CVE-2026-59869 (high), CVE-2026-12590 (low), CVE-2026-73566 (high), CVE-2026-45623 (high), CVE-2026-73646 (high), CVE-2026-10732 (medium), CVE-2026-69185 (high), CVE-2026-69152 (high), CVE-2026-14257 (high), CVE-2026-69153 (medium), GHSA-5p4m-2wfm-xmqj (high), CVE-2026-39243 (medium), CVE-2026-45822 (medium), CVE-2026-59880 (high), CVE-2026-73089 (high), CVE-2026-73088 (high), CVE-2026-82417 (medium), CVE-2026-84370 (high), CVE-2026-84369 (medium), GHSA-rgj7-g3m4-5g8c (high)

[security-ops-bot]

🔄 Dependabot Alert Changes

Resolved: CVE-2026-44490, CVE-2026-44496, CVE-2026-44486, CVE-2026-44487, CVE-2026-44495, CVE-2026-44492, CVE-2026-9277, CVE-2026-41305, CVE-2026-12143, CVE-2026-48779, CVE-2026-9595, CVE-2026-53655, CVE-2026-49356, CVE-2026-55602, CVE-2026-53550, CVE-2026-53486

[security-ops-bot]

🔄 Dependabot Alert Changes

Added: CVE-2026-48779 (high), CVE-2026-9595 (medium), CVE-2026-12143 (high), CVE-2026-53655 (medium), CVE-2026-49356 (low), CVE-2026-55602 (medium), CVE-2026-53550 (medium), CVE-2026-53486 (critical)

Resolved: CVE-2026-33228, CVE-2026-33532, CVE-2026-33895, CVE-2026-33891, CVE-2026-33894, CVE-2026-33896

[security-ops-bot]

🔄 Dependabot Alert Changes

Added: CVE-2026-33671 (high), CVE-2026-33672 (medium), CVE-2026-4800 (high), CVE-2026-2950 (medium), CVE-2026-28291 (high), GHSA-r4q5-vmmm-2653 (medium), CVE-2026-40175 (medium), CVE-2025-62718 (medium), CVE-2026-6951 (high), CVE-2026-42040 (low), CVE-2026-42043 (high), CVE-2026-42042 (medium), CVE-2026-42034 (medium), CVE-2026-42038 (medium), CVE-2026-42039 (medium), CVE-2026-42041 (medium), CVE-2026-42036 (medium), CVE-2026-42035 (high), CVE-2026-6402 (medium), CVE-2026-41907 (medium), CVE-2026-44705 (high), CVE-2026-42033 (high), CVE-2026-44490 (medium), CVE-2026-44496 (high), CVE-2026-44486 (high), CVE-2026-44487 (high), CVE-2026-44495 (high), CVE-2026-44492 (high), CVE-2026-9277 (critical), CVE-2026-41305 (medium), CVE-2026-84375 (high)

Resolved: CVE-2023-30548, CVE-2023-34238, CVE-2022-37611, CVE-2024-53382, CVE-2024-12905, CVE-2025-48387, CVE-2025-30359, CVE-2025-30360, CVE-2025-6545, CVE-2025-7339, CVE-2025-7783, CVE-2025-54798, CVE-2025-9287, CVE-2025-9288, CVE-2025-59343, CVE-2025-57352, CVE-2020-28500, CVE-2025-64718, CVE-2025-66030, CVE-2025-12816, CVE-2025-66031, CVE-2025-15284, CVE-2025-14505, CVE-2026-23745, CVE-2026-23950, CVE-2025-13465, CVE-2026-24842, CVE-2021-27515, CVE-2022-0691, CVE-2021-3664, CVE-2022-25883, CVE-2026-2391, CVE-2025-6547, CVE-2026-26960, CVE-2026-25639, CVE-2022-0639, CVE-2022-0512, CVE-2025-69873, CVE-2026-2739, CVE-2026-26996, CVE-2026-27903, CVE-2026-27904, GHSA-5c6j-r48x-rmvq, CVE-2026-29786, CVE-2026-29063, CVE-2026-31802, CVE-2026-32141, CVE-2026-33151

[security-ops-bot]

⚠️ SLA Warning — IBM/cloud-enterprise-examples

The following 2 alerts are approaching their SLA deadline with 3 days remaining. Please remediate before the deadline to avoid automatic repository archiving.

To prevent archiving, open a pull request that fixes each alert and include the alert ID (e.g. #CVE-XXXX-YYYY) in the PR title.

Alert	Severity	Deadline
CVE-2026-54466	critical	2026-09-17
CVE-2026-59873	critical	2026-09-17

@timroster

[security-ops-bot]

🔄 Dependabot Alert Changes

Added: CVE-2023-30548 (medium), CVE-2023-34238 (medium), CVE-2022-37611 (critical), CVE-2024-53382 (medium), CVE-2024-12905 (high), CVE-2025-48387 (high), CVE-2025-30359 (medium), CVE-2025-30360 (medium), CVE-2025-6545 (critical), CVE-2025-7339 (low), CVE-2025-7783 (critical), CVE-2025-54798 (low), CVE-2025-9287 (critical), CVE-2025-9288 (critical), CVE-2025-59343 (high), CVE-2025-57352 (low), CVE-2020-28500 (medium), CVE-2025-64718 (medium), CVE-2025-66030 (medium), CVE-2025-12816 (high), CVE-2025-66031 (high), CVE-2025-15284 (medium), CVE-2025-14505 (low), CVE-2026-23745 (high), CVE-2026-23950 (high), CVE-2025-13465 (medium), CVE-2026-24842 (high), CVE-2021-27515 (medium), CVE-2022-0691 (medium), CVE-2021-3664 (medium), CVE-2022-25883 (high), CVE-2026-2391 (low), CVE-2025-6547 (critical), CVE-2026-26960 (high), CVE-2026-25639 (high), CVE-2022-0639 (medium), CVE-2022-0512 (medium), CVE-2025-69873 (medium), CVE-2026-2739 (medium), CVE-2026-26996 (high), CVE-2026-27903 (high), CVE-2026-27904 (high), GHSA-5c6j-r48x-rmvq (high), CVE-2026-29786 (high), CVE-2026-29063 (high), CVE-2026-31802 (high), CVE-2026-32141 (high), CVE-2026-33151 (high), CVE-2026-33228 (high), CVE-2026-33532 (medium), CVE-2026-33895 (high), CVE-2026-33891 (high), CVE-2026-33894 (high), CVE-2026-33896 (high)

Resolved: CVE-2026-33671, CVE-2026-33672, CVE-2026-4800, CVE-2026-2950, CVE-2026-28291, GHSA-r4q5-vmmm-2653, CVE-2026-40175, CVE-2025-62718, CVE-2026-6951, CVE-2026-42040, CVE-2026-42043, CVE-2026-42042, CVE-2026-42034, CVE-2026-42038, CVE-2026-42039, CVE-2026-42041, CVE-2026-42036, CVE-2026-42035, CVE-2026-6402, CVE-2026-41907, CVE-2026-44705, CVE-2026-42033, CVE-2026-44490, CVE-2026-44496, CVE-2026-44486, CVE-2026-44487, CVE-2026-44495, CVE-2026-44492, CVE-2026-9277, CVE-2026-41305, CVE-2026-12143, CVE-2026-48779, CVE-2026-9595, CVE-2026-53655, CVE-2026-49356, CVE-2026-55602, CVE-2026-53550, CVE-2026-53486, CVE-2026-54466, CVE-2026-54490, CVE-2026-13149, CVE-2026-73650, CVE-2026-59874, CVE-2026-59879, CVE-2026-14620, CVE-2026-14631, CVE-2026-59875, CVE-2026-59873, CVE-2026-59871, CVE-2026-13311, CVE-2026-67316, CVE-2026-67319, GHSA-f88m-g3jw-g9cj, CVE-2026-59869, CVE-2026-12590, CVE-2026-73566, CVE-2026-45623, CVE-2026-73646, CVE-2026-10732, CVE-2026-69185, CVE-2026-69152, CVE-2026-14257, CVE-2026-69153, GHSA-5p4m-2wfm-xmqj, CVE-2026-39243, CVE-2026-45822

[security-ops-bot]

🔄 Dependabot Alert Changes

Added: CVE-2026-33671 (high), CVE-2026-33672 (medium), CVE-2026-4800 (high), CVE-2026-2950 (medium), CVE-2026-28291 (high), GHSA-r4q5-vmmm-2653 (medium), CVE-2026-40175 (medium), CVE-2025-62718 (medium), CVE-2026-6951 (high), CVE-2026-42040 (low), CVE-2026-42043 (high), CVE-2026-42042 (medium), CVE-2026-42034 (medium), CVE-2026-42038 (medium), CVE-2026-42039 (medium), CVE-2026-42041 (medium), CVE-2026-42036 (medium), CVE-2026-42035 (high), CVE-2026-6402 (medium), CVE-2026-41907 (medium), CVE-2026-44705 (high), CVE-2026-42033 (high), CVE-2026-44490 (medium), CVE-2026-44496 (high), CVE-2026-44486 (high), CVE-2026-44487 (high), CVE-2026-44495 (high), CVE-2026-44492 (high), CVE-2026-9277 (critical), CVE-2026-41305 (medium), CVE-2026-12143 (high), CVE-2026-48779 (high), CVE-2026-9595 (medium), CVE-2026-53655 (medium), CVE-2026-49356 (low), CVE-2026-55602 (medium), CVE-2026-53550 (medium), CVE-2026-53486 (critical), CVE-2026-54466 (critical), CVE-2026-54490 (medium), CVE-2026-13149 (high), CVE-2026-73650 (high), CVE-2026-59874 (high), CVE-2026-59879 (high), CVE-2026-14620 (medium), CVE-2026-14631 (medium), CVE-2026-59875 (medium), CVE-2026-59873 (critical), CVE-2026-59871 (medium), CVE-2026-13311 (high), CVE-2026-67316 (medium), CVE-2026-67319 (medium), GHSA-f88m-g3jw-g9cj (high), CVE-2026-59869 (high), CVE-2026-12590 (low), CVE-2026-73566 (high), CVE-2026-45623 (high), GHSA-5p4m-2wfm-xmqj (high), CVE-2026-39243 (medium), CVE-2026-45822 (medium)

Resolved: CVE-2023-30548, CVE-2023-34238, CVE-2022-37611, CVE-2024-53382, CVE-2024-12905, CVE-2025-48387, CVE-2025-30359, CVE-2025-30360, CVE-2025-6545, CVE-2025-7339, CVE-2025-7783, CVE-2025-54798, CVE-2025-9287, CVE-2025-9288, CVE-2025-59343, CVE-2025-57352, CVE-2020-28500, CVE-2025-64718, CVE-2025-66030, CVE-2025-12816, CVE-2025-66031, CVE-2025-15284, CVE-2025-14505, CVE-2026-23745, CVE-2026-23950, CVE-2025-13465, CVE-2026-24842, CVE-2021-27515, CVE-2022-0691, CVE-2021-3664, CVE-2022-25883, CVE-2026-2391, CVE-2025-6547, CVE-2026-26960, CVE-2026-25639, CVE-2022-0639, CVE-2022-0512, CVE-2025-69873, CVE-2026-2739, CVE-2026-26996, CVE-2026-27903, CVE-2026-27904, GHSA-5c6j-r48x-rmvq, CVE-2026-29786, CVE-2026-29063, CVE-2026-31802, CVE-2026-32141, CVE-2026-33151, CVE-2026-33228, CVE-2026-33532, CVE-2026-33895, CVE-2026-33891, CVE-2026-33894, CVE-2026-33896

[security-ops-bot]

🔄 Dependabot Alert Changes

Added: CVE-2026-73646 (high), CVE-2026-10732 (medium), CVE-2026-69185 (high), CVE-2026-69152 (high), CVE-2026-14257 (high), CVE-2026-69153 (medium)

[security-ops-bot]

🔄 Dependabot Alert Changes

Added: CVE-2023-30548 (medium), CVE-2023-34238 (medium), CVE-2022-37611 (critical), CVE-2024-53382 (medium), CVE-2024-12905 (high), CVE-2025-48387 (high), CVE-2025-30359 (medium), CVE-2025-30360 (medium), CVE-2025-6545 (critical), CVE-2025-7339 (low), CVE-2025-7783 (critical), CVE-2025-54798 (low), CVE-2025-9287 (critical), CVE-2025-9288 (critical), CVE-2025-59343 (high), CVE-2025-57352 (low), CVE-2020-28500 (medium), CVE-2025-64718 (medium), CVE-2025-66030 (medium), CVE-2025-12816 (high), CVE-2025-66031 (high), CVE-2025-15284 (medium), CVE-2025-14505 (low), CVE-2026-23745 (high), CVE-2026-23950 (high), CVE-2025-13465 (medium), CVE-2026-24842 (high), CVE-2021-27515 (medium), CVE-2022-0691 (medium), CVE-2021-3664 (medium), CVE-2022-25883 (high), CVE-2026-2391 (low), CVE-2025-6547 (critical), CVE-2026-26960 (high), CVE-2026-25639 (high), CVE-2022-0639 (medium), CVE-2022-0512 (medium), CVE-2025-69873 (medium), CVE-2026-2739 (medium), CVE-2026-26996 (high), CVE-2026-27903 (high), CVE-2026-27904 (high), GHSA-5c6j-r48x-rmvq (high), CVE-2026-29786 (high), CVE-2026-29063 (high), CVE-2026-31802 (high), CVE-2026-32141 (high), CVE-2026-33151 (high), CVE-2026-33228 (high), CVE-2026-33532 (medium), CVE-2026-33895 (high), CVE-2026-33891 (high), CVE-2026-33894 (high), CVE-2026-33896 (high)

Resolved: CVE-2026-33671, CVE-2026-33672, CVE-2026-4800, CVE-2026-2950, CVE-2026-28291, GHSA-r4q5-vmmm-2653, CVE-2026-40175, CVE-2025-62718, CVE-2026-6951, CVE-2026-42040, CVE-2026-42043, CVE-2026-42042, CVE-2026-42034, CVE-2026-42038, CVE-2026-42039, CVE-2026-42041, CVE-2026-42036, CVE-2026-42035, CVE-2026-6402, CVE-2026-41907, CVE-2026-44705, CVE-2026-42033, CVE-2026-44490, CVE-2026-44496, CVE-2026-44486, CVE-2026-44487, CVE-2026-44495, CVE-2026-44492, CVE-2026-9277, CVE-2026-41305, CVE-2026-12143, CVE-2026-48779, CVE-2026-9595, CVE-2026-53655, CVE-2026-49356, CVE-2026-55602, CVE-2026-53550, CVE-2026-53486

[security-ops-bot]

🔄 Dependabot Alert Changes

Added: CVE-2026-53550 (medium), CVE-2026-53486 (critical)

Resolved: CVE-2023-30548, CVE-2023-34238, CVE-2022-37611, CVE-2024-53382, CVE-2024-12905, CVE-2025-48387, CVE-2025-30359, CVE-2025-30360, CVE-2025-6545, CVE-2025-7339, CVE-2025-7783, CVE-2025-54798, CVE-2025-9287, CVE-2025-9288, CVE-2025-59343, CVE-2025-57352, CVE-2020-28500, CVE-2025-64718, CVE-2025-66030, CVE-2025-12816, CVE-2025-66031, CVE-2025-15284, CVE-2025-14505, CVE-2026-23745, CVE-2026-23950, CVE-2025-13465, CVE-2026-24842, CVE-2021-27515, CVE-2022-0691, CVE-2021-3664, CVE-2022-25883, CVE-2026-2391, CVE-2025-6547, CVE-2026-26960, CVE-2026-25639, CVE-2022-0639, CVE-2022-0512, CVE-2025-69873, CVE-2026-2739, CVE-2026-26996, CVE-2026-27903, CVE-2026-27904, GHSA-5c6j-r48x-rmvq, CVE-2026-29786, CVE-2026-29063, CVE-2026-31802, CVE-2026-32141, CVE-2026-33151, CVE-2026-33228, CVE-2026-33532, CVE-2026-33895, CVE-2026-33891, CVE-2026-33894, CVE-2026-33896